Redis:

Persistence

Write SSH keys, cron jobs, or webshells via Redis config

1 guide • Created Dec 28, 2025 • Updated May 6, 2026

1 guide

Redis Persistence via CONFIG SET

Abuses Redis CONFIG SET to redirect DB dumps or AOF logs to attacker-controlled paths, achieving filesystem writes and persistent backdoor placement.

May 6, 2026 • 5 min read

Redis persistence techniques maintain access by writing to system files that execute on schedule or at login. Cron-based reverse shells use CONFIG SET dir /var/spool/cron/ and write a crontab entry that calls back to your listener every few minutes. This survives Redis restarts and runs as the cron user.

SSH authorized_keys injection is both an exploitation and persistence technique. Once your key is in place, SSH access persists independently of Redis. For defense evasion, write keys to less obvious user accounts rather than root.

Module-based backdoors load a shared library into Redis that exposes custom commands for command execution, file operations, or reverse shell callbacks. The module persists across restarts if added to the Redis configuration file via CONFIG SET or direct file write. Combined with replication (SLAVEOF), you can re-inject a malicious module from a rogue master if the original gets removed.