HackTheBox Starting Point Tier 0 machine: Redeemer Walkthrough
Complete walkthrough with answers for the HackTheBox Redeemer machine
Table of contents
Setup
First, we need to connect to the HTB network. There are two different methods to do the same:
- Using Pwnbox
- Using OpenVPN
(Click here to learn to connect to HackTheBox VPN)
Introduction
This lab focuses on enumerating a Redis server remotely and then dumping its database in order to retrieve the flag. In this process, we will learn about some basic redis-cli
commands, which are used to interact with the Redis service.
Redis is an 'in-memory' database. In-memory databases rely essentially on the primary memory (RAM) for data storage and since the primary memory is significantly faster than the secondary memory, in-memory databases are very efficient & have minimal response times. Redis and other in-memory databases are widely used to cache frequently requested data for rapid retrieval.
Scanning and enumeration
After our connection to the HTB network is successfully established, we can spawn the target machine from the Starting Point lab’s page by clicking on “SPAWN MACHINE” as show above. After spawning the machine, we can check if our packets reach their destination by using the ping command.
Grab the IP address of your current target and paste it into your terminal after typing in the ping command. After 4-5 successful replies from the target, we can confirm that our connection is formed and stable. We can cancel the ping command by pressing the Ctrl + C
combination on our keyboard.
Now let's start scanning the target using nmap
to find any open ports and services
We can use the following nmap command: sudo nmap -p- -sV {target_ip}
{target_ip} has to be replaced with the IP address of the Dancing machine.
The -p-
switch is used to scan all the ports. The -sV
switch is used to display the version of the services running on the open ports.
After the completion of the scan, we can see that port 6379 is open and is running a Redis server.
Redis (REmote DIctionary Server) is an open-source advanced NoSQL key-value data store used as a database, cache, and message broker.
Foothold
We can use the Redis command-line interface to communicate with the Redis server. It can be installed using the following command: sudo apt install redis-tools
After the installation is completed, we can use the command redis-cli --help
to see the available commands which can be used with redis-cli
We can see that we can use the -h
switch to specify the hostname and connect to the Redis server. Let’s do that now using the following command: redis-cli -h {target_IP}
After successful connection to the server, we can use the info
command to see the information and statistics about the Redis server.
From the output, under keyspace section, we can see that there is only one database with index 0 and having 4 keys
We can select this database using the command select 0
. Using keys *
we can see all the keys present in the database. Now we can use the get
command followed by the key name to see the contents of the key
Copy the flag value and paste it into the Starting Point lab's page to complete your task.
Congrats, you have just pwned Redeemer! 👏
Task answers
Task 1: Which TCP port is open on the machine?
6379
Task 2: Which service is running on the port that is open on the machine?
redis
Task 3: What type of database is Redis? Choose from the following options: (i) In-memory Database, (ii) Traditional Database
In-memory Database
Task 4: Which command-line utility is used to interact with the Redis server? Enter the program name you would enter into the terminal without any arguments.
redis-cli
Task 5: Which flag is used with the Redis command-line utility to specify the hostname?
-h
Task 6: Once connected to a Redis server, which command is used to obtain the information and statistics about the Redis server?
info
Task 7: What is the version of the Redis server being used on the target machine?What is the command we can use within the SMB shell to download the files we find?
5.0.7
Task 8: Which command is used to select the desired database in Redis?
select
Task 9: How many keys are present inside the database with index 0?
4
Task 10: Which command is used to obtain all the keys in a database?
keys *
🚩 Root flag:
03e1d2b376c37ab3f5319922053953eb