# Privilege Escalation

> Escalate via Redis file writes to SUID, SSH keys, or cron paths

- **URL:** https://hackindex.io/services/redis/privilege-escalation
- **Service:** [Redis](https://hackindex.io/services/redis.md)
- **Tags:** elevation, permissions
- **Published:** 2026-03-14
- **Updated:** 2026-03-29

Redis privilege escalation exploits the ability to write files to arbitrary locations on the filesystem. Since Redis typically runs as the redis user (or root in misconfigured setups), file writes land with those permissions. Writing to /etc/cron.d/, /var/spool/cron/root, or systemd unit directories executes commands as root on the next trigger.

Module loading provides direct code execution as the Redis process user. If Redis runs as root, MODULE LOAD with a custom .so gives you an immediate root shell. When Redis runs as a lower-privilege user, the module still executes code at that level, and you can chain local privilege escalation from there.

On systems where Redis has write access to privileged locations (web roots with setuid scripts, application directories, or system configuration paths), the CONFIG SET dir/dbfilename technique pivots from Redis access to execution under a more privileged context. Check what the Redis user can actually write to, that determines your escalation path.

## Guides

- [Redis Running as Root – Privilege Escalation via File Write](https://hackindex.io/services/redis/privilege-escalation/redis-root-rce.md)