redis-rogue-server

RCE on exposed Redis by abusing replication (malicious module).

Gets command execution on an exposed Redis by abusing replication: it stands up a rogue Redis master that serves a malicious module (.so) and forces the victim to replicate and load it.

Family Databases

Flags --rhost --rport --lhost

Concepts Redis RCE via rogue server (replication), Redis RCE via MODULE LOAD

Cheatsheet Redis · 6379

Installation

git clone https://github.com/n0b0dyCN/redis-rogue-server

Repositorygithub.com/n0b0dyCN/redis-rogue-server

Useful commands2 commands

Reference tool: it does not yet appear in a published machine on the blog, but it is part of the arsenal for its everyday use.