Hello folks,
This blog focuses on a machine with the name “Redeemer” within HackTheBox’s Starting point tier 0. It has been classified as an easy-level challenge. Let’s proceed without any delay and begin the penetration testing process.
Click here to access the Redeemer machine.
In this writeup, we will be learning about a service called Redis which can be found in your real-life pentesting.
There are a total of 11 tasks that we have to complete. So, let’s connect to the HTB network using OpenVPN and then use nmap to scan the machine’s IP.
nmap -p- -sS <Mahine_IP>
Task 1
There is only one port open which is the answer to the first task.
Task 2
The next task asks for the name of the service that you will get from the output of Nmap scan.
Task 3
Now we need to do some research on this service using the Google Search Engine.
So we got our answer from here. Now let’s move towards the next task.
Task 4
We need to find the name of the command line tool that we can use to interact with this service. I know the name of the tool. You can also Google the same. You should know the power of how to use Search engines.
Task 5
Now, check out the help menu of the tool with the –help flag.
Task 6
Now let’s connect with the following command to the remote server.
redis-cli –h <Machine_IP>
Now we need to find the information of the Redis server for which we need to find a command using Google.
Task 7
Using the info command, let’s get the version of Redis Server.
Task 8
To select the desired database inside the Redis server, we will use the “select” command.
Task 9
Now we need to find the keys with index 0. So in the output of the Info command, there was a heading with Keyspace under which you will find the answer.
Task 10
To find or get all keys stored in the Redis server we need to run the following command:
keys *
Task 11
Now final question is to get the flag. You saw in the above output that there was a key with the name Flag. So we can simply use the “get” command followed by the key name to get the value of the specific key.
This write-up is just an overview of Redis penetration testing. HackTheBox has created this awesome room “Redeemer” for this.
Also, you can check out our other blogs on Cyber Security and Penetration Testing here.
Happy Pentesting!!!
Team CyberiumX