Redeemer is a Very Easy Linux machine that explores Redis database enumeration and exploitation. Redis is an in-memory database that can be misconfigured to allow unauthenticated access, potentially exposing sensitive data like flags or credentials.
Path to root, at a glance:
Scan the target → discover port 6379 (Redis) open
Connect to Redis using redis-cli
Enumerate database information and keys
Select database 0 and retrieve the flag
Nmap
┌──(r3vpwnx㉿r3vpwnx)-[~/CTF/HTB/Redeemer] └─$ sudo nmap -Pn -sSCV 10.129.136.187 -p- --min-rate=1000 -oA redeemer-nmap Starting Nmap 7.99 ( https://nmap.org ) at 2022-05-11 17:30 -0400 Nmap scan report for 10.129.136.187 Host is up (0.35s latency). Not shown: 65534 closed tcp ports (reset) PORT STATE SERVICE VERSION 6379/tcp open redis Redis key-value store 5.0.7
The scan reveals:
Port 6379/tcp: Redis key-value store version 5.0.7
No other open ports found
The Service: Redis
Redis (Remote Dictionary Server) is an in-memory data structure store used as a database, cache, and message broker. Key characteristics:
Port: 6379 (default)
Type: In-memory database (NoSQL)
Protocol: TCP with RESP (REdis Serialization Protocol)
Use the GET command to retrieve the value of the “flag” key:
10.129.136.187:6379> GET flag "03e1************************53eb"
Task Answers
1 Which TCP port is open on the machine? 6379 2 Which service is running on the port that is open on the machine? redis 3 What type of database is Redis? In-memory Database 4 Which command-line utility is used to interact with the Redis server? redis-cli 5 Which flag is used with the Redis command-line utility to specify the hostname? -h 6 Once connected to a Redis server, which command is used to obtain the information and statistics about the Redis server? info 7 What is the version of the Redis server being used on the target machine? 5.0.7 8 Which command is used to select the desired database in Redis? select 9 How many keys are present inside the database with index 0? 4 10 Which command is used to obtain all the keys in a database? keys *
Security Recommendations
Enable authentication - Set requirepass in redis.conf
Bind to specific interfaces - Use bind 127.0.0.1 or internal IPs
Use TLS encryption - Enable SSL/TLS for Redis connections
Disable dangerous commands - Rename or disable FLUSHALL, CONFIG, etc.
Network segmentation - Restrict access to Redis port with firewalls
Regular updates - Keep Redis updated to latest version
Monitor logs - Check for suspicious access patterns
Why It Worked
This machine demonstrates how a misconfigured Redis instance (no password required, accessible over the network) can expose sensitive data. Redis is designed for speed, not security by default. Without proper configuration, it can become a significant security risk, especially when storing sensitive information like flags, credentials, or API keys.
