Redis:
Exploitation
RCE, auth bypass, SSRF, and shell writes against Redis
Redis Master-Slave Replication RCE
Exploiting Redis master-slave replication to achieve RCE by loading a malicious module via the SLAVEOF command on exposed instances.
Redis RCE via Malicious Module Load
Exploit unauthenticated or authenticated Redis instances by loading a malicious .so module to achieve remote code execution on the target system.
Redis RCE via SSH Key Injection
Exploit unauthenticated Redis instances to achieve RCE by injecting attacker-controlled SSH public keys into root's authorized_keys via Redis config manipulation.
Redis exploitation turns unauthenticated or weakly authenticated access into system-level compromise. The core technique uses CONFIG SET to change dir and dbfilename, then writes attacker-controlled content via SET and BGSAVE. This lets you drop SSH public keys into /root/.ssh/authorized_keys, write a webshell into a web root, or inject a crontab entry into /var/spool/cron/.
SSH key injection is the most reliable path: write your public key as a Redis value, point dir to /home/user/.ssh/ and dbfilename to authorized_keys, then BGSAVE. Redis wraps the value in its dump format, but SSH ignores the surrounding garbage. The same approach works for crontab entries and webshells.
Redis modules (MODULE LOAD) execute arbitrary shared libraries, giving you direct code execution without file write tricks. Tools like redis-rogue-server automate this by spinning up a rogue replication master that pushes a malicious module to the target. Credential brute-forcing against password-protected instances works with Hydra or custom scripts since Redis has no default rate limiting.