https://chaelsoo.me/tags/redis/Recent content in Redis on kanyo's blogHugo -- gohugo.ioen-gbMon, 08 Jun 2026 00:00:00 +0000https://chaelsoo.me/writeups/htb-postman/Mon, 08 Jun 2026 00:00:00 +0000https://chaelsoo.me/writeups/htb-postman/<p>An Easy box that teaches two separate lessons: unauthenticated Redis is a direct shell primitive, and version numbers on admin panels are worth looking up before you give up and move on. The initial nmap scan shows a Webmin instance on port 10000, but it needs credentials. Easy to dismiss and come back to. The full port scan reveals Redis on 6379, no auth, which hands you a foothold as the redis user. From there a backup SSH key in <code>/opt</code> cracks quickly, and that password ends up being exactly what Matt uses to log into Webmin. CVE-2019-15642 on that Webmin version is an authenticated RCE that shells out as root.</p>