# Exploitation

> RCE, auth bypass, SSRF, and shell writes against Redis

- **URL:** https://hackindex.io/services/redis/exploitation
- **Service:** [Redis](https://hackindex.io/services/redis.md)
- **Tags:** initial-access, execution
- **Published:** 2026-03-12
- **Updated:** 2026-03-29

Redis exploitation turns unauthenticated or weakly authenticated access into system-level compromise. The core technique uses CONFIG SET to change dir and dbfilename, then writes attacker-controlled content via SET and BGSAVE. This lets you drop SSH public keys into /root/.ssh/authorized_keys, write a webshell into a web root, or inject a crontab entry into /var/spool/cron/.

SSH key injection is the most reliable path: write your public key as a Redis value, point dir to /home/user/.ssh/ and dbfilename to authorized_keys, then BGSAVE. Redis wraps the value in its dump format, but SSH ignores the surrounding garbage. The same approach works for crontab entries and webshells.

Redis modules (MODULE LOAD) execute arbitrary shared libraries, giving you direct code execution without file write tricks. Tools like redis-rogue-server automate this by spinning up a rogue replication master that pushes a malicious module to the target. Credential brute-forcing against password-protected instances works with Hydra or custom scripts since Redis has no default rate limiting.

## Guides

- [Redis Authenticated Access – Password Brute Force and Login](https://hackindex.io/services/redis/exploitation/authenticated-access.md)
- [CVE-2022-0543 – Redis Lua Sandbox Escape RCE](https://hackindex.io/services/redis/exploitation/cve-2022-0543.md)
- [Redis Master-Slave Replication RCE](https://hackindex.io/services/redis/exploitation/master-slave-replication.md): Exploiting Redis master-slave replication to achieve RCE by loading a malicious module via the SLAVEOF command on exposed instances.
- [Redis RCE via Cron Job Write](https://hackindex.io/services/redis/exploitation/rce-cron.md)
- [Redis RCE via Malicious Module Load](https://hackindex.io/services/redis/exploitation/rce-module-load.md): Exploit unauthenticated or authenticated Redis instances by loading a malicious .so module to achieve remote code execution on the target system.
- [Redis RCE via SSH Key Injection](https://hackindex.io/services/redis/exploitation/rce-ssh-key.md): Exploit unauthenticated Redis instances to achieve RCE by injecting attacker-controlled SSH public keys into root's authorized_keys via Redis config manipulation.
- [SSRF to Redis – Gopher Protocol Command Injection](https://hackindex.io/services/redis/exploitation/ssrf-redis.md)
- [Redis Unauthenticated Access – No-Auth Enumeration and Exploitation](https://hackindex.io/services/redis/exploitation/unauthenticated-access.md)
- [Redis Webshell Write – Planting a Shell via File Write](https://hackindex.io/services/redis/exploitation/webshell-write.md)