Let's see if the cli is available `redis-cli`  It is but we need to auth. I don't really want to go the curl route, so let's see if we can find some creds `find / -name *.conf 2>/dev/null | grep redis`   Nice. Back to the cli  So now we're authenticated, we can try getting RCE.  That should give us a very basic webshell that we can curl. `curl http://localhost/rce.php?cmd=ls --output -`  It's a mess, but it works. We can see `maintenance.php` our `rce.php` and `index.php`. The challenge wanted us to read `index.php`. `curl http://localhost/rce.php?cmd=cat+index.php --output - `  Andddd that's all it wanted. --- Back to [[_WebSite Publish/CTF/CTF Index|CTF Index]] Tags: #redis #ctf #rce #web Related: