Redis in the wild
- Category: OSINT
- 300 Points
Description
In order to evaluate your OSINT skills, we hid a server on the internet!
All we share is the following things:
Our server is located in Frankfurt and belongs to DigitalOcean. Our server has been indexed in shodan. Our server is running a Redis service that contains the flag by the key "flag"Your mission is to figure out and find our server, and then submit the flag!
Solution
This one was pretty simple.
Search Shodan for ‘org:”DigitalOcean” city:Frankfurt Redis flag”’.
The only result is:
46.101.175.108
Property Name Value
area_code null
asn AS200130
city Frankfurt
country_code DE
country_code3 DEU
country_name Germany
data.0._shodan.crawler 545144fc95e7a7ef13ece5dbceb98ee386b37950
data.0._shodan.id null
data.0._shodan.module ssh
data.0._shodan.ptr True
data.0.cpe ['cpe:/a:openbsd:openssh:7.6p1 Ubuntu-4ubuntu0.3']
data.0.data SSH-2.0-OpenSSH_7.6p1 Ubuntu-4ubuntu0.3 Key type: ssh-rsa Key: AAAAB3NzaC1yc2EAAAADAQABAAABAQC2d54zxb0xRv9HlqnMp1Qe/elxyhw9q7+jm/cEg2Fq+oQo hDKyrhRbXr+YOf/+QxeZdFNj6xHHRB9v+C2p9rArEI9k1QwTUgQFwhpqNGKLhDhdXWkxWoVmomRl elSVKK2pbq0URZlFscfgesZgUySoER8OXCJ2WS2mmY1CE0ho0u2MaATRk+7akTlGwn2RA/3x2gU0 wTPBOCQ8UyhHSEXiVbDWC0fXHkF8G6l18rXqKheHM913UY6AedHqhHpG0WRbOSt5p8J0pvDGOn5v teLhqfLz3WL6QBrQzzYSqLD9+qz6WJKIfUhkECLmPqwm4k5ZLly5ru2gA+v0aYls1HFB Fingerprint: 4e:9a:71:fc:a6:2b:4b:d5:ef:ec:cf:73:1d:02:e1:a2 Kex Algorithms: curve25519-sha256 [email protected] ecdh-sha2-nistp256 ecdh-sha2-nistp384 ecdh-sha2-nistp521 diffie-hellman-group-exchange-sha256 diffie-hellman-group16-sha512 diffie-hellman-group18-sha512 diffie-hellman-group14-sha256 diffie-hellman-group14-sha1 Server Host Key Algorithms: ssh-rsa rsa-sha2-512 rsa-sha2-256 ecdsa-sha2-nistp256 ssh-ed25519 Encryption Algorithms: [email protected] aes128-ctr aes192-ctr aes256-ctr [email protected] [email protected] MAC Algorithms: [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] hmac-sha2-256 hmac-sha2-512 hmac-sha1 Compression Algorithms: none [email protected]
data.0.domains []
data.0.hash 436255690
data.0.hostnames []
data.0.info protocol 2.0
data.0.port 22
data.0.product OpenSSH
data.0.ssh.cipher aes128-ctr
data.0.ssh.fingerprint 4e:9a:71:fc:a6:2b:4b:d5:ef:ec:cf:73:1d:02:e1:a2
data.0.ssh.hassh b12d2871a1189eff20364cf5333619ee
data.0.ssh.kex.compression_algorithms ['none', '[email protected]']
data.0.ssh.kex.encryption_algorithms ['[email protected]', 'aes128-ctr', 'aes192-ctr', 'aes256-ctr', '[email protected]', '[email protected]']
data.0.ssh.kex.kex_algorithms ['curve25519-sha256', '[email protected]', 'ecdh-sha2-nistp256', 'ecdh-sha2-nistp384', 'ecdh-sha2-nistp521', 'diffie-hellman-group-exchange-sha256', 'diffie-hellman-group16-sha512', 'diffie-hellman-group18-sha512', 'diffie-hellman-group14-sha256', 'diffie-hellman-group14-sha1']
data.0.ssh.kex.kex_follows False
data.0.ssh.kex.languages ['']
data.0.ssh.kex.mac_algorithms ['[email protected]', '[email protected]', '[email protected]', '[email protected]', '[email protected]', '[email protected]', '[email protected]', 'hmac-sha2-256', 'hmac-sha2-512', 'hmac-sha1']
data.0.ssh.kex.server_host_key_algorithms ['ssh-rsa', 'rsa-sha2-512', 'rsa-sha2-256', 'ecdsa-sha2-nistp256', 'ssh-ed25519']
data.0.ssh.kex.unused 0
data.0.ssh.key AAAAB3NzaC1yc2EAAAADAQABAAABAQC2d54zxb0xRv9HlqnMp1Qe/elxyhw9q7+jm/cEg2Fq+oQo hDKyrhRbXr+YOf/+QxeZdFNj6xHHRB9v+C2p9rArEI9k1QwTUgQFwhpqNGKLhDhdXWkxWoVmomRl elSVKK2pbq0URZlFscfgesZgUySoER8OXCJ2WS2mmY1CE0ho0u2MaATRk+7akTlGwn2RA/3x2gU0 wTPBOCQ8UyhHSEXiVbDWC0fXHkF8G6l18rXqKheHM913UY6AedHqhHpG0WRbOSt5p8J0pvDGOn5v teLhqfLz3WL6QBrQzzYSqLD9+qz6WJKIfUhkECLmPqwm4k5ZLly5ru2gA+v0aYls1HFB
data.0.ssh.mac hmac-sha2-256
data.0.ssh.type ssh-rsa
data.0.tags ['cloud']
data.0.timestamp 2019-06-18T18:19:00.323936
data.0.transport tcp
data.0.version 7.6p1 Ubuntu-4ubuntu0.3
data.1._shodan.crawler d264629436af1b777b3b513ca6ed1404d7395d80
data.1._shodan.id f9d51810-0115-4ab3-9d9c-efa82ec28b47
data.1._shodan.module redis
data.1._shodan.ptr True
data.1.data # Server redis_version:5.0.5 redis_git_sha1:00000000 redis_git_dirty:0 redis_build_id:7983a619928f1f2d redis_mode:standalone os:Linux 4.15.0-50-generic x86_64 arch_bits:64 multiplexing_api:epoll atomicvar_api:atomic-builtin gcc_version:6.3.0 process_id:9 run_id:62dcdf7717bb79e873dd972f8b2a749bce0bbf57 tcp_port:6379 uptime_in_seconds:636175 uptime_in_days:7 hz:10 configured_hz:10 lru_clock:15941456 executable:/tmp/redis-server config_file: # Clients connected_clients:2 client_recent_max_input_buffer:2 client_recent_max_output_buffer:0 blocked_clients:0 # Memory used_memory:1923832 used_memory_human:1.83M used_memory_rss:5947392 used_memory_rss_human:5.67M used_memory_peak:1984640 used_memory_peak_human:1.89M used_memory_peak_perc:96.94% used_memory_overhead:1906568 used_memory_startup:791272 used_memory_dataset:17264 used_memory_dataset_perc:1.52% allocator_allocated:1893776 allocator_active:2064384 allocator_resident:4460544 total_system_memory:1033347072 total_system_memory_human:985.48M used_memory_lua:37888 used_memory_lua_human:37.00K used_memory_scripts:0 used_memory_scripts_human:0B number_of_cached_scripts:0 maxmemory:0 maxmemory_human:0B maxmemory_policy:noeviction allocator_frag_ratio:1.09 allocator_frag_bytes:170608 allocator_rss_ratio:2.16 allocator_rss_bytes:2396160 rss_overhead_ratio:1.33 rss_overhead_bytes:1486848 mem_fragmentation_ratio:3.20 mem_fragmentation_bytes:4086464 mem_not_counted_for_evict:0 mem_replication_backlog:1048576 mem_clients_slaves:0 mem_clients_normal:66616 mem_aof_buffer:0 mem_allocator:jemalloc-5.1.0 active_defrag_running:0 lazyfree_pending_objects:0 # Persistence loading:0 rdb_changes_since_last_save:0 rdb_bgsave_in_progress:0 rdb_last_save_time:1559364040 rdb_last_bgsave_status:ok rdb_last_bgsave_time_sec:-1 rdb_current_bgsave_time_sec:-1 rdb_last_cow_size:0 aof_enabled:0 aof_rewrite_in_progress:0 aof_rewrite_scheduled:0 aof_last_rewrite_time_sec:-1 aof_current_rewrite_time_sec:-1 aof_last_bgrewrite_status:ok aof_last_write_status:ok aof_last_cow_size:0 # Stats total_connections_received:90 total_commands_processed:63543 instantaneous_ops_per_sec:0 total_net_input_bytes:896638 total_net_output_bytes:24769302 instantaneous_input_kbps:0.00 instantaneous_output_kbps:0.05 rejected_connections:0 sync_full:0 sync_partial_ok:0 sync_partial_err:0 expired_keys:0 expired_stale_perc:0.00 expired_time_cap_reached_count:0 evicted_keys:0 keyspace_hits:4 keyspace_misses:0 pubsub_channels:0 pubsub_patterns:0 latest_fork_usec:0 migrate_cached_sockets:0 slave_expires_tracked_keys:0 active_defrag_hits:0 active_defrag_misses:0 active_defrag_key_hits:0 active_defrag_key_misses:0 # Replication role:slave master_host:redis-master master_port:6380 master_link_status:up master_last_io_seconds_ago:8 master_sync_in_progress:0 slave_repl_offset:887572 slave_priority:100 slave_read_only:1 connected_slaves:0 master_replid:cb2d2104e3a00cddb597c7076c3beec4022ff2f6 master_replid2:0000000000000000000000000000000000000000 master_repl_offset:887572 second_repl_offset:-1 repl_backlog_active:1 repl_backlog_size:1048576 repl_backlog_first_byte_offset:1 repl_backlog_histlen:887572 # CPU used_cpu_sys:562.952297 used_cpu_user:476.872706 used_cpu_sys_children:0.000000 used_cpu_user_children:0.000000 # Cluster cluster_enabled:0 # Keyspace db0:keys=1,expires=0,avg_ttl=0 # Keys flag # Connected Clients id=3 addr=172.18.0.2:6380 fd=9 name= age=636175 idle=8 flags=M db=0 sub=0 psub=0 multi=-1 qbuf=0 qbuf-free=0 obl=0 oll=0 omem=0 events=r cmd=ping id=93 addr=82.98.254.57:55094 fd=10 name= age=0 idle=0 flags=N db=0 sub=0 psub=0 multi=-1 qbuf=26 qbuf-free=32742 obl=0 oll=0 omem=0 events=r cmd=client
data.1.domains []
data.1.hash 601215482
data.1.hostnames []
data.1.port 6379
data.1.product Redis key-value store
data.1.redis.clients [{u'sub': 0, u'obl': 0, u'addr': [u'172.18.0.2', 6380], u'omem': 0, u'db': 0, u'age': 636175, u'cmd': u'ping', u'oll': 0, u'multi': -1, u'id': 3, u'qbuf': 0, u'psub': 0, u'fd': 9, u'qbuf-free': 0, u'flags': u'M', u'events': u'r', u'idle': 8, u'name': u''}, {u'sub': 0, u'obl': 0, u'addr': [u'82.98.254.57', 55094], u'omem': 0, u'db': 0, u'age': 0, u'cmd': u'client', u'oll': 0, u'multi': -1, u'id': 93, u'qbuf': 26, u'psub': 0, u'fd': 10, u'qbuf-free': 32742, u'flags': u'N', u'events': u'r', u'idle': 0, u'name': u''}]
data.1.redis.cluster.cluster_enabled 0
data.1.redis.cpu.used_cpu_sys 562.952297
data.1.redis.cpu.used_cpu_sys_children 0.0
data.1.redis.cpu.used_cpu_user 476.872706
data.1.redis.cpu.used_cpu_user_children 0.0
data.1.redis.keys.data ['flag']
data.1.redis.keys.more False
data.1.redis.keyspace.db0 keys=1,expires=0,avg_ttl=0
data.1.redis.memory.active_defrag_running 0
data.1.redis.memory.allocator_active 2064384
data.1.redis.memory.allocator_allocated 1893776
data.1.redis.memory.allocator_frag_bytes 170608
data.1.redis.memory.allocator_frag_ratio 1.09
data.1.redis.memory.allocator_resident 4460544
data.1.redis.memory.allocator_rss_bytes 2396160
data.1.redis.memory.allocator_rss_ratio 2.16
data.1.redis.memory.lazyfree_pending_objects 0
data.1.redis.memory.maxmemory 0
data.1.redis.memory.maxmemory_human 0B
data.1.redis.memory.maxmemory_policy noeviction
data.1.redis.memory.mem_allocator jemalloc-5.1.0
data.1.redis.memory.mem_aof_buffer 0
data.1.redis.memory.mem_clients_normal 66616
data.1.redis.memory.mem_clients_slaves 0
data.1.redis.memory.mem_fragmentation_bytes 4086464
data.1.redis.memory.mem_fragmentation_ratio 3.2
data.1.redis.memory.mem_not_counted_for_evict 0
data.1.redis.memory.mem_replication_backlog 1048576
data.1.redis.memory.number_of_cached_scripts 0
data.1.redis.memory.rss_overhead_bytes 1486848
data.1.redis.memory.rss_overhead_ratio 1.33
data.1.redis.memory.total_system_memory 1033347072
data.1.redis.memory.total_system_memory_human 985.48M
data.1.redis.memory.used_memory 1923832
data.1.redis.memory.used_memory_dataset 17264
data.1.redis.memory.used_memory_dataset_perc 1.52%
data.1.redis.memory.used_memory_human 1.83M
data.1.redis.memory.used_memory_lua 37888
data.1.redis.memory.used_memory_lua_human 37.00K
data.1.redis.memory.used_memory_overhead 1906568
data.1.redis.memory.used_memory_peak 1984640
data.1.redis.memory.used_memory_peak_human 1.89M
data.1.redis.memory.used_memory_peak_perc 96.94%
data.1.redis.memory.used_memory_rss 5947392
data.1.redis.memory.used_memory_rss_human 5.67M
data.1.redis.memory.used_memory_scripts 0
data.1.redis.memory.used_memory_scripts_human 0B
data.1.redis.memory.used_memory_startup 791272
data.1.redis.persistence.aof_current_rewrite_time_sec -1
data.1.redis.persistence.aof_enabled 0
data.1.redis.persistence.aof_last_bgrewrite_status ok
data.1.redis.persistence.aof_last_cow_size 0
data.1.redis.persistence.aof_last_rewrite_time_sec -1
data.1.redis.persistence.aof_last_write_status ok
data.1.redis.persistence.aof_rewrite_in_progress 0
data.1.redis.persistence.aof_rewrite_scheduled 0
data.1.redis.persistence.loading 0
data.1.redis.persistence.rdb_bgsave_in_progress 0
data.1.redis.persistence.rdb_changes_since_last_save 0
data.1.redis.persistence.rdb_current_bgsave_time_sec -1
data.1.redis.persistence.rdb_last_bgsave_status ok
data.1.redis.persistence.rdb_last_bgsave_time_sec -1
data.1.redis.persistence.rdb_last_cow_size 0
data.1.redis.persistence.rdb_last_save_time 1559364040
data.1.redis.replication.connected_slaves 0
data.1.redis.replication.master_host redis-master
data.1.redis.replication.master_last_io_seconds_ago 8
data.1.redis.replication.master_link_status up
data.1.redis.replication.master_port 6380
data.1.redis.replication.master_repl_offset 887572
data.1.redis.replication.master_replid cb2d2104e3a00cddb597c7076c3beec4022ff2f6
data.1.redis.replication.master_replid2 0
data.1.redis.replication.master_sync_in_progress 0
data.1.redis.replication.repl_backlog_active 1
data.1.redis.replication.repl_backlog_first_byte_offset 1
data.1.redis.replication.repl_backlog_histlen 887572
data.1.redis.replication.repl_backlog_size 1048576
data.1.redis.replication.role slave
data.1.redis.replication.second_repl_offset -1
data.1.redis.replication.slave_priority 100
data.1.redis.replication.slave_read_only 1
data.1.redis.replication.slave_repl_offset 887572
data.1.redis.server.arch_bits 64
data.1.redis.server.atomicvar_api atomic-builtin
data.1.redis.server.config_file
data.1.redis.server.configured_hz 10
data.1.redis.server.executable /tmp/redis-server
data.1.redis.server.gcc_version 6.3.0
data.1.redis.server.hz 10
data.1.redis.server.lru_clock 15941456
data.1.redis.server.multiplexing_api epoll
data.1.redis.server.os Linux 4.15.0-50-generic x86_64
data.1.redis.server.process_id 9
data.1.redis.server.redis_build_id 7983a619928f1f2d
data.1.redis.server.redis_git_dirty 0
data.1.redis.server.redis_git_sha1 0
data.1.redis.server.redis_mode standalone
data.1.redis.server.redis_version 5.0.5
data.1.redis.server.run_id 62dcdf7717bb79e873dd972f8b2a749bce0bbf57
data.1.redis.server.tcp_port 6379
data.1.redis.server.uptime_in_days 7
data.1.redis.server.uptime_in_seconds 636175
data.1.redis.stats.active_defrag_hits 0
data.1.redis.stats.active_defrag_key_hits 0
data.1.redis.stats.active_defrag_key_misses 0
data.1.redis.stats.active_defrag_misses 0
data.1.redis.stats.evicted_keys 0
data.1.redis.stats.expired_keys 0
data.1.redis.stats.expired_stale_perc 0.0
data.1.redis.stats.expired_time_cap_reached_count 0
data.1.redis.stats.instantaneous_input_kbps 0.0
data.1.redis.stats.instantaneous_ops_per_sec 0
data.1.redis.stats.instantaneous_output_kbps 0.05
data.1.redis.stats.keyspace_hits 4
data.1.redis.stats.keyspace_misses 0
data.1.redis.stats.latest_fork_usec 0
data.1.redis.stats.migrate_cached_sockets 0
data.1.redis.stats.pubsub_channels 0
data.1.redis.stats.pubsub_patterns 0
data.1.redis.stats.rejected_connections 0
data.1.redis.stats.slave_expires_tracked_keys 0
data.1.redis.stats.sync_full 0
data.1.redis.stats.sync_partial_err 0
data.1.redis.stats.sync_partial_ok 0
data.1.redis.stats.total_commands_processed 63543
data.1.redis.stats.total_connections_received 90
data.1.redis.stats.total_net_input_bytes 896638
data.1.redis.stats.total_net_output_bytes 24769302
data.1.tags ['cloud']
data.1.timestamp 2019-06-02T03:15:28.641722
data.1.transport tcp
data.1.version 5.0.5
dma_code null
hostnames []
ip 778415980
ip_str 46.101.175.108
isp DigitalOcean
last_update 2019-06-18T18:19:00.323936
latitude 50.1155
longitude 8.6842
org DigitalOcean
os null
ports [22, 6379]
postal_code 60313
region_code 05
tags ['cloud']
Connect to the server and request the flag:
root@kali:/media/sf_CTFs/bsidestlv/Redis_in_the_wild# nc 46.101.175.108 6379
get flag
$26
BSidesTLV{L00ksL1k30s1nt!}