To answer that question, go to - redis/redis repository
evilRedis is the devil re-incarnation .... umm, blah blah.
- Was bored
- Needed to re-learn C
- I knew much about redis and thought that it would be the apt playground to learn c again
- Was exploiting buffer overflows and writing shellcodes recently (harmless CTFs of course)
- All of that just came together I guess
Pass in your shell command using redis's echo
command along with a trigger keyword.
# Normal echo behavior
> echo whoami
whoami
# Shell execution is triggered with the keyword "evilRedisCmd:"
> echo evilRedisCmd:whoami
keshiba\n
When evilRedis finds the trigger keyword, it will try to execute the command that follows in the shell and returns the output. Fun right?
Stay tuned for more...
Until then, Enjoy!