{"uuid": "17d8111b-b4c0-4da9-a536-7ac8865e5be9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0543", "type": "seen", "source": "https://t.me/hacking_Attack/78645", "content": "Black Hat Ethical Hacking\nNew Redigo malware drops stealthy backdoor on Redis servers\n\nNew Redigo malware drops stealthy backdoor on Redis serversPost Views: 68 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes Go-based malware RedigoA new Go-based malware threat that researchers call Redigo\u00a0has been targeting Redis\u00a0servers vulnerable to CVE-2022-0543 to plant a stealthy backdoor and allow\u00a0command execution.\n\nCVE-2022-0543 is a critical vulnerability in Redis (Remote Dictionary Server) software with a maximum severity rating. It was\u00a0discovered and fixed in February 2022.\n\nAttackers continued to leverage it on unpatched machines several months\u00a0after the fix came out, as proof-of-concept exploit code\u00a0became publicly available.\n\nThe name of the malware, Redigo, was coined from the machine it targets and the programming language for building it.\n\nToday, AquaSec reports\u00a0that its Redis honeypots vulnerable to CVE-2022-0543 caught a new piece of malware that is not detected as a threat by antivirus engines on Virus Total.\nhttps://www.bleepstatic.com/images/news/u/1220909/Website%20snaps/vt.png \n<figcaptionRedigo\u00a0payload coming out clean on Virus Total scan (AquaSec) \nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Redigo attacksAquaSec says that Redigo attacks start with scans on port 6379 to locate Redis servers exposed on the open web.\u00a0After locating a target endpoint, the atacker connect and run the following commands:\n\n* INFO\u00a0\u2013 Check the Redis version to determine if the server is vulnerable to CVE-2022-0543.\n* SLAVEOF\u00a0\u2013 Create a copy of the attacking server.\n* REPLCONF\u00a0\u2013 Configure the connection from the attacking server to the newly created replica.\n* PSYNC\u00a0\u2013 Initiate the replication stream and download the shared library \u2018exp_lin.so\u2019 on the server\u2019s disk.\n* MODULE LOAD\u00a0\u2013 Load module from the downloaded dynamic library, which is capable of executing arbitrary commands and exploiting CVE-2022-0543.\n* SLAVEOF NO ONE\u00a0\u2013 Covert the vulnerable Redis server into master.\n* \n\nhttps://www.bleepstatic.com/images/news/u/1220909/Code%20and%20Details/commands-redigo.png \n<figcaptionCommands observed in the Redis honeypot (AquaSec) \nUsing the command execution abilities of the implanted backdoor, the attackers collect hardware info about the host and then download Redigo (redis-1.2-SNAPSHOT). The malware is executed after escalating privileges.\n\nThe attackers simulate normal Redis communication over port 6379 to evade detection by network analysis tools while attempting to hide traffing from Redigo\u2019s command and control server.\n\nDue to attack duration limitations in AquaSec\u2019s honeypots, its analysts couldn\u2019t determine exactly what Redigo does after establishing its foothold in the environment.\nhttps://www.bleepstatic.com/images/news/u/1220909/Code%20and%20Details/redigo-functions.png \n<figcaptionRedigo malware functions (AquaSec) \nTrending: Find Hidden Info using Google Dorking manually, and Automated using Pagodo Trending: Offensive Security Tool: linWinPwn Mitigation\u200bAquaSec says it\u2019s likely that the ultimate goal of Redigo is to add the vulnerable server as a bot in a network for distributed denial-of-service (DDoS) attacks or to run cryptocurrency miners on the compromised systems.\n\nAlso, since Redis is a database, accessing the data to steal it would also be a plausible scenario in\u00a0Redigo attacks.\n\nFor more information on mitigating the Redis flaw, check out the Debian security advisory\u00a0or Ubuntu\u2019s security bulletin\u00a0on CVE-2022-0543.\nTrending: AXLocker \u2013 a new ransomware that encrypts yours files, and then steals your Discord a[...]", "creation_timestamp": "2026-09-01T20:01:15.101397Z"}