wwsX0r

3 ms·

1. 1.▲
   by wwsX0r 1y ago

   But it says the lua script feature is open by default, so any authenticated (or 60k without auth) can run lua scripts -> use this RCE
2. 2.▲
   by wwsX0r 1y ago

   The Lua interpreter in Redis doesn’t allow you to run regular code, you can’t event to “print”, not to talk about load libraries as in regular Lua interpreter. It’s a sanboxed one with very minimal operations you can do
3. 3.▲
   by wwsX0r 1y ago

   Surprisingly high numbers of exposed instances to the internet and unauth