4 ms·

Redis can be exploited to run executables ???

qbasic_forever 5y ago
It can execute Lua, I'm sure there's plenty of fun for hackers to have with this: https://redis.io/commands/eval https://redis.io/commands/eval
dawnerd 5y ago
Yeah - kinda crazy theres no auth by default AND eval is allowed. Pretty trivial for someone to have it download a script and run it pretty much with free reign.
- slavak 5y ago
  Redis doesn't accept unauthenticated external connections by default for a while now, specifically to try and eliminate this footgun. https://github.com/redis/redis/commit/edd4d555df57dc84265fdfb4ef59a4678832f6da https://github.com/redis/redis/commit/edd4d555df57dc84265fdf...
  - dawnerd 5y ago
    Interesting, this definitely happened with a more recent version... Wonder if theres some other exploit at play too (could also be the containerized version?)
  - SilverRed 5y ago
    I had an issue where I used the redis docker image and didn't understand docker networking properly so I set the network mode as host so my other container could connect. Not knowing this had exposed redis to the world unauthenticated (in about 2018). Eventually a kind script set a password on redis which caused me to notice and fix this issue.
bigiain 5y ago
From antirez the guy who wrote redis's blog: 'The Redis security model is: “it’s totally insecure to let untrusted clients access the system, please protect it from the outside world yourself”.' -- http://antirez.com/news/96 http://antirez.com/news/96 That blog post also helpfully shows how to write you own key into .ssh/authorized_keys to you can log in as the redis user over ssh. From there use your favourite lunar priv escalation bug to p0wn the box completely. (Or just run your cryptominer as the redis user...) Note: that's about 5 years old now...
- js4ever 5y ago
  Holy shit! thanks for the details
dento 5y ago
https://2018.zeronights.ru/wp-content/uploads/materials/15-redis-post-exploitation.pdf https://2018.zeronights.ru/wp-content/uploads/materials/15-r...

It can execute Lua, I'm sure there's plenty of fun for hackers to have with this: https://redis.io/commands/eval https://redis.io/commands/eval

dawnerd 5y ago

Yeah - kinda crazy theres no auth by default AND eval is allowed. Pretty trivial for someone to have it download a script and run it pretty much with free reign.

slavak 5y ago
Redis doesn't accept unauthenticated external connections by default for a while now, specifically to try and eliminate this footgun. https://github.com/redis/redis/commit/edd4d555df57dc84265fdfb4ef59a4678832f6da https://github.com/redis/redis/commit/edd4d555df57dc84265fdf...
- dawnerd 5y ago
  Interesting, this definitely happened with a more recent version... Wonder if theres some other exploit at play too (could also be the containerized version?)
- SilverRed 5y ago
  I had an issue where I used the redis docker image and didn't understand docker networking properly so I set the network mode as host so my other container could connect. Not knowing this had exposed redis to the world unauthenticated (in about 2018). Eventually a kind script set a password on redis which caused me to notice and fix this issue.

bigiain 5y ago

From antirez the guy who wrote redis's blog: 'The Redis security model is: “it’s totally insecure to let untrusted clients access the system, please protect it from the outside world yourself”.' -- http://antirez.com/news/96 http://antirez.com/news/96 That blog post also helpfully shows how to write you own key into .ssh/authorized_keys to you can log in as the redis user over ssh. From there use your favourite lunar priv escalation bug to p0wn the box completely. (Or just run your cryptominer as the redis user...) Note: that's about 5 years old now...

js4ever 5y ago
Holy shit! thanks for the details

dento 5y ago

https://2018.zeronights.ru/wp-content/uploads/materials/15-redis-post-exploitation.pdf https://2018.zeronights.ru/wp-content/uploads/materials/15-r...