# 🔴 Hack The Box Starting Point: Redeemer Walkthrough Welcome to the final walkthrough in our Hack The Box Starting Point Tier 0 series. If you completed Meow, Fawn, and Dancing, you've learned about telnet, FTP, and SMB enumeration. Now we're moving on to **Redeemer**, which introduces you to Redis—an in-memory database that's commonly exposed and misconfigured. **Redeemer completes Tier 0** by teaching you how to enumerate and interact with database services. You'll learn about Redis, NoSQL databases, and how exposed databases can lead to data breaches. By the end of this post, you'll understand: - What Redis is and how it works - How to identify Redis services - How to connect to and interact with Redis - Database enumeration techniques - The risks of exposed databases - How to retrieve data from Redis Let's get started. --- ## 🎯 The Objective Redeemer is a very easy Linux machine that teaches Redis database enumeration and interaction. Your goal is to: 1. Connect to the HTB network and spawn the machine 2. Enumerate the target to find Redis running 3. Connect to the Redis server 4. Enumerate databases and keys 5. Retrieve the flag **What you'll learn:** - Redis database basics - Port scanning and service identification - Redis client usage - Database enumeration - Key-value database concepts **Difficulty:** Very Easy (Tier 0) --- ## 🔍 Initial Setup ### Connecting to HTB Network If you haven't already, connect to the HTB network using **OpenVPN** (or use Pwnbox). Make sure you're connected before proceeding. ### Spawning the Machine 1. Go to the [Starting Point page](https://app.hackthebox.com/starting-point) 2. Find the **Redeemer** machine 3. Click **"Spawn Machine"** — this starts the vulnerable VM 4. Wait a minute or two for it to boot up 5. Note the **target IP address** — you'll need this for all your commands --- ## 📡 Step 1: Reconnaissance ### Verifying Connectivity with Ping First, let's verify we can reach the target machine using `ping`: ```bash ping -c 4 ``` **Expected output:** ``` PING () 56(84) bytes of data. 64 bytes from : icmp_seq=1 ttl=63 time=XX ms 64 bytes from : icmp_seq=2 ttl=63 time=XX ms 64 bytes from : icmp_seq=3 ttl=63 time=XX ms 64 bytes from : icmp_seq=4 ttl=63 time=XX ms --- ping statistics --- 4 packets transmitted, 4 received, 0% packet loss ``` If you see responses, you're connected! --- ## 🔍 Step 2: Port Scanning ### Finding Open Ports with Nmap Now let's scan for open ports using `nmap`: ```bash nmap -sV ``` **What this does:** - `nmap` — Port scanning tool - `-sV` — Version detection (identifies service versions and OS) - `` — The target machine's IP address **Expected output:** ``` Starting Nmap 7.94 ( https://nmap.org ) at 2026-02-01 12:00 UTC Nmap scan report for Host is up (0.XXs latency). Not shown: 999 closed tcp ports (reset) PORT STATE SERVICE VERSION 6379/tcp open redis Redis key-value store 5.0.7 ``` **What we learned:** - **Which TCP port is open on the machine?** → Port **6379** is open - **Which service is running on the port that is open on the machine?** → **redis** is running ### Understanding Redis **What is Redis?** Redis (Remote Dictionary Server) is an open-source, in-memory data structure store. It's commonly used as a database, cache, and message broker. **What type of database is Redis? Choose from: (i) In-memory Database, (ii) Traditional Database** → Redis is an **In-memory Database**. **Key characteristics of Redis:** - **In-memory storage** — Data stored in RAM for fast access - **Key-value store** — Simple data model (key → value) - **NoSQL database** — Non-relational, doesn't use SQL - **High performance** — Extremely fast read/write operations - **Persistence options** — Can save data to disk (optional) - **Multiple data types** — Strings, lists, sets, hashes, etc. **Common use cases:** - Caching (web applications, APIs) - Session storage - Real-time analytics - Message queues - Leaderboards and counters **Default port:** Redis typically runs on port **6379** (chosen because it spells "MERZ" on a phone keypad, a reference to an old German TV show). **Security considerations:** - Redis often runs without authentication by default - Should only be accessible from trusted networks - Exposed Redis instances can lead to: - Data exposure - Data manipulation - Remote code execution (in some configurations) - Cache poisoning attacks --- ## 🚨 Step 3: Redis Enumeration ### Connecting to Redis Now that we know Redis is running, let's connect to it. **Which command-line utility is used to interact with the Redis server? Enter the program name you would enter into the terminal without any arguments.** → **`redis-cli`** The `redis-cli` command is the Redis command-line interface—a tool for interacting with Redis servers. **Which flag is used with the Redis command-line utility to specify the hostname?** → **`-h`** The command to connect to Redis is: ```bash redis-cli -h ``` **What this does:** - `redis-cli` — Redis command-line interface - `-h` — Specify hostname (target IP address) - `` — Target machine IP address **Expected output:** ``` :6379> ``` **Success!** We're connected to the Redis server. The `:6379>` prompt means we're in the Redis CLI and can run Redis commands. **Note:** If Redis requires authentication, you'd use `-a ` flag, but this instance doesn't require authentication (which is the vulnerability). ### Understanding Redis Commands Once connected, you're in an interactive Redis shell. Redis commands are simple and follow patterns like: - `COMMAND key [arguments]` - Commands are case-insensitive (though convention uses uppercase) - Most commands return simple responses (strings, integers, arrays) --- ## 📊 Step 4: Gathering Server Information ### Using the INFO Command **Once connected to a Redis server, which command is used to obtain the information and statistics about the Redis server?** → **`info`** Let's gather information about the Redis server: ```redis INFO ``` **What this does:** - `INFO` — Returns information and statistics about the Redis server - Provides details about server, clients, memory, persistence, etc. **Expected output:** ``` # Server redis_version:5.0.7 redis_git_sha1:00000000 redis_git_dirty:0 redis_build_id:... redis_mode:standalone os:Linux 5.4.0-74-generic x86_64 arch_bits:64 multiplexing_api:epoll atomicvar_api:atomic-builtin gcc_version:9.3.0 process_id:1 run_id:... tcp_port:6379 uptime_in_seconds:... uptime_in_days:... hz:10 configured_hard_limit:... client_recent_max_input_buffer:... client_recent_max_output_buffer:... ... ``` **What we learned:** - **What is the version of the Redis server being used on the target machine?** → **5.0.7** **Key information from INFO:** - `redis_version` — Version number (important for vulnerability research) - `os` — Operating system - `tcp_port` — Port Redis is listening on - `connected_clients` — Number of connected clients - `used_memory` — Memory usage - `keyspace` — Number of databases and keys ### Understanding Redis Versions Redis 5.0.7 is from 2019. While not the latest, it's important to: - Check for known vulnerabilities in this version - Understand feature availability - Know compatibility with tools and exploits **Note:** Always check Redis version during enumeration—older versions may have known vulnerabilities. --- ## 🗄️ Step 5: Database Selection ### Understanding Redis Databases Redis supports multiple databases (numbered 0-15 by default). Each database is independent and can contain different keys. **Which command is used to select the desired database in Redis?** → **`select`** The default database is 0. Let's make sure we're in database 0: ```redis SELECT 0 ``` **What this does:** - `SELECT` — Switches to the specified database - `0` — Database index (0 is the default) **Expected output:** ``` OK ``` **Understanding Redis databases:** - Databases are numbered starting from 0 - Default is database 0 - Each database is isolated (keys don't overlap) - You can have up to 16 databases (0-15) by default - Configuration can change the number of databases --- ## 🔑 Step 6: Enumerating Keys ### Listing All Keys Now let's see what keys are stored in this database. **Which command is used to obtain all the keys in a database?** → **`keys *`** ```redis KEYS * ``` **What this does:** - `KEYS` — Lists keys matching a pattern - `*` — Wildcard pattern (matches all keys) **Expected output:** ``` 1) "flag" 2) "numbat" 3) "second" 4) "temp" ``` **What we learned:** - **How many keys are present inside the database with index 0?** → There are **4** keys: 1. `flag` — This is likely what we're looking for! 2. `numbat` 3. `second` 4. `temp` ### Understanding Redis Keys **What are keys?** - Keys are identifiers for values stored in Redis - Keys are strings (can contain any binary data) - Each key maps to a value (string, list, set, hash, etc.) - Keys are unique within a database **Key naming conventions:** - Often use colons as separators: `user:123:name` - Descriptive names: `flag`, `session:abc123` - Can be any string --- ## 🏴 Step 7: Retrieving the Flag ### Reading Key Values Now let's retrieve the value of the `flag` key. The command to get a value is `GET`: ```redis GET flag ``` **What this does:** - `GET` — Retrieves the value of a key - `flag` — The key name **Expected output:** ``` "" ``` **Success!** You've found the flag. Copy this and submit it on the HTB platform to mark the machine as complete. ### Exploring Other Keys Let's also check the other keys to understand what's stored: ```redis GET numbat GET second GET temp ``` These might contain additional information or just be example data. The important thing is we found the flag! ### Exiting Redis To exit the Redis CLI: ```redis exit ``` Or press `Ctrl+C` or `Ctrl+D`. --- ## ✅ HTB Task Answers Summary If you're working through HTB's questions, here are the answers: 1. **Which TCP port is open on the machine?** → **6379** 2. **Which service is running on the open port?** → **redis** 3. **What type of database is Redis?** → **In-memory Database** 4. **Which command-line utility interacts with Redis?** → **redis-cli** 5. **Which flag specifies the hostname?** → **-h** 6. **Which command obtains server information?** → **info** 7. **What is the Redis server version?** → **5.0.7** 8. **Which command selects a database?** → **select** 9. **How many keys are in database 0?** → **4** 10. **Which command lists all keys?** → **keys *** --- ## 💡 Key Takeaways ### What You Learned 1. **Redis basics** — In-memory database, port 6379, key-value store 2. **Service identification** — Recognizing Redis from port scans 3. **Redis client usage** — Connecting with `redis-cli -h` 4. **Server enumeration** — Using `INFO` to gather server details 5. **Database navigation** — Using `SELECT` to switch databases 6. **Key enumeration** — Using `KEYS *` to list all keys 7. **Data retrieval** — Using `GET` to read key values ### Why This Matters in Real Penetration Testing **Exposed Redis instances** are a common finding in: - Cloud environments (AWS, Azure, GCP) - Docker containers with exposed ports - Development and staging environments - Misconfigured production systems **What this teaches you:** - Always check for exposed database services - Understand that databases shouldn't be publicly accessible - Know how to enumerate and interact with NoSQL databases - Recognize that default configurations are often insecure **In real assessments:** - Exposed Redis instances often contain: - Session data - User credentials - API keys and tokens - Cached sensitive data - Application configuration - Personal information **Common Redis vulnerabilities:** - No authentication (default configuration) - Exposed to internet (should be internal only) - Old versions with known vulnerabilities - Unrestricted commands (CONFIG, FLUSHALL, etc.) - Weak or default passwords --- ## 🔒 Security Lessons ### For System Administrators **Never expose Redis to the internet:** - Bind Redis to localhost (127.0.0.1) or internal IPs only - Use firewall rules to restrict access - Implement authentication: Set `requirepass` in redis.conf - Use SSL/TLS for remote connections (Redis 6+) - Regularly update Redis to latest version **Secure Redis configurations:** - Enable authentication: `requirepass ` - Disable dangerous commands: `rename-command CONFIG ""` - Bind to specific IPs: `bind 127.0.0.1` (not 0.0.0.0) - Use Redis ACLs (Access Control Lists) for fine-grained permissions - Monitor Redis access logs **Best practices:** - Run Redis in a private network/VPC - Use VPN or SSH tunneling for remote access - Implement network segmentation - Regular security assessments - Monitor for unauthorized access attempts ### For Penetration Testers **This machine demonstrates:** - The importance of thorough service enumeration - How to identify and interact with database services - Why exposed databases are critical findings - How to enumerate and extract data from Redis **In real assessments:** - Always check for exposed database services (Redis, MongoDB, Elasticsearch, etc.) - Test for authentication requirements - Enumerate databases and keys - Look for sensitive data exposure - Document the risk: exposed database = potential data breach **Enumeration checklist:** - [ ] Scan for common database ports (6379 Redis, 27017 MongoDB, 9200 Elasticsearch) - [ ] Attempt connection without authentication - [ ] Use `INFO` to gather server details - [ ] Enumerate databases (`SELECT 0`, `SELECT 1`, etc.) - [ ] List all keys (`KEYS *`) - [ ] Retrieve sensitive keys - [ ] Check for dangerous commands enabled - [ ] Test for remote code execution (if applicable) --- ## 🛠 Alternative Approaches ### Using Nmap Redis Scripts Nmap has built-in scripts for Redis enumeration: ```bash nmap --script redis-info -p 6379 ``` **What this does:** - `--script redis-info` — Gathers Redis server information - Can automate information gathering ### Using redis-cli with Authentication If Redis requires authentication: ```bash redis-cli -h -a ``` **What this does:** - `-a` — Authenticate with password - Useful if you've found credentials elsewhere ### Using redis-cli with Non-Default Port If Redis is on a non-default port: ```bash redis-cli -h -p ``` **What this does:** - `-p` — Specify port number - Default is 6379, but can be changed ### Automated Redis Enumeration Scripts Tools like `redis-rogue-server` can automate Redis enumeration and exploitation: ```bash python3 redis-rogue-server.py --rhost --rport 6379 ``` **Warning:** Only use on systems you own or have permission to test. ### Checking Redis Configuration If you have access, you can check Redis configuration: ```redis CONFIG GET * ``` **What this does:** - `CONFIG GET` — Retrieves configuration parameters - `*` — Gets all configuration settings - Can reveal authentication settings, bind addresses, etc. **Note:** This command may be disabled in secure configurations. --- ## 🚨 Common Issues ### "Connection refused" or "Connection timed out" **Problem:** Can't connect to Redis. **Solutions:** - Make sure the machine is spawned - Verify you're connected to HTB network - Check that you're using the correct IP address - Wait for the machine to fully boot - Verify Redis is actually running on port 6379 ### "NOAUTH Authentication required" **Problem:** Redis requires authentication. **Solutions:** - Try common default passwords (`redis`, `password`, blank) - Look for credentials in configuration files or other services - Check if authentication can be bypassed (some versions have vulnerabilities) - This machine doesn't require authentication, so this shouldn't happen ### "redis-cli: command not found" **Problem:** redis-cli isn't installed. **Solution:** Install Redis client tools: - **Linux:** `sudo apt install redis-tools` (Debian/Ubuntu) or `sudo yum install redis` (RHEL/CentOS) - **macOS:** `brew install redis` - **Windows:** Download from [Redis downloads page](https://redis.io/download) ### "ERR unknown command" **Problem:** Command not recognized. **Solutions:** - Check Redis version (some commands require newer versions) - Verify command syntax (Redis commands are case-insensitive but check spelling) - Use `HELP` command to see available commands - Check Redis documentation for your version ### Keys not showing up **Problem:** `KEYS *` returns empty or wrong database. **Solutions:** - Make sure you're in the correct database (`SELECT 0`) - Check if keys exist in other databases (`SELECT 1`, `SELECT 2`, etc.) - Verify you have access to the database - Some Redis instances may have keys in non-default databases --- ## 📚 Additional Resources - [Redis Documentation](https://redis.io/docs/) — Complete Redis documentation - [Redis Commands Reference](https://redis.io/commands/) — All Redis commands - [HTB Redeemer Machine Page](https://www.hackthebox.com/machines/redeemer) — Official machine page - [Redis Security Guide](https://redis.io/docs/management/security/) — Security best practices - [Nmap Redis Scripts](https://nmap.org/nsedoc/categories/redis.html) — Nmap Redis enumeration scripts --- ## 🎯 What's Next? Congratulations! You've completed all four machines in **Hack The Box Starting Point Tier 0**: 1. ✅ **Meow** — Telnet enumeration and weak credentials 2. ✅ **Fawn** — FTP enumeration and anonymous access 3. ✅ **Dancing** — SMB enumeration and network share access 4. ✅ **Redeemer** — Redis enumeration and database interaction **What you've accomplished:** - Learned basic enumeration techniques - Understood common service vulnerabilities - Practiced interacting with different protocols - Gained experience with penetration testing methodology **Next steps:** - Continue with HTB Starting Point Tier 1 (requires VIP subscription) - Practice on other free HTB machines - Try TryHackMe rooms for more practice - Build your own lab environment - Study for certifications (OSCP, CEH, etc.) --- ## 📊 Completion Proof I successfully completed Redeemer on June 14, 2025. You can verify the completion [here](https://labs.hackthebox.com/achievement/machine/2419237/472). --- **Questions about Redeemer or Redis enumeration?** Reach out directly: - **Email:** [m1k3@msquarellc.net](mailto:m1k3@msquarellc.net) - **Phone:** [(559) 670-3159](tel:+15596703159) - **Schedule:** [Book a free consultation](https://calendly.com/m1k3-msquarellc) --- **M Square LLC** Cybersecurity | Penetration Testing | No-Nonsense Advice

#Redeemer

Hack The Box Starting Point: Redeemer Walkthrough

Related Tags