The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill contains multiple detailed procedures for achieving RCE on a target host. This includes:
Crontab injection using Redis CONFIG SET commands to write reverse shell payloads into system cron directories (e.g., /var/spool/cron/).
Master-Slave replication exploitation (redis-rogue-server) to force the target to load malicious .so modules.
Lua script injection exploiting CVE-2022-0543 (Debian/Ubuntu specific) to break out of the Redis sandbox.
Webshell injection by writing PHP or JSP payloads into web directories.
[DATA_EXFILTRATION]: The skill provides targeted strategies for stealing sensitive information from Redis databases. It includes specific commands to search for keys containing password, token, secret, api_key, and session. It also details how to use MONITOR to capture real-time authentication credentials and SYNC to dump the entire database for offline analysis.
[COMMAND_EXECUTION]: The instructions direct the agent to execute a variety of external security tools, including redis-cli, nmap (with NSE scripts), hydra, medusa, and ssh-keygen. It also involves direct shell manipulation, such as piping formatted keys into redis-cli and setting up listeners for reverse shells.
[EXTERNAL_DOWNLOADS]: The documentation references and encourages the use of several third-party exploitation tools hosted on GitHub, such as n0b0dyCN/redis-rogue-server, n0b0dyCN/RedisModules-ExecuteCommand, and sripathikrishnan/redis-rdb-tools.
[PERSISTENCE_MECHANISMS]: The skill outlines techniques for maintaining long-term access to a compromised system by injecting attacker-controlled RSA public keys into the authorized_keys file of the Redis or root user, and by establishing recurring reverse shells via crontab.

redis-attack