unauthorized-access-common-services

SKILL: Unauthorized Access to Common Services — Expert Attack Playbook

AI LOAD INSTRUCTION: Expert techniques for exploiting unauthenticated or weakly authenticated management services. Covers Redis write-to-RCE, Rsync data theft, PHP-FPM code execution, Ghostcat AJP file read, Hadoop YARN job submission, and H2 Console JNDI. These are infrastructure-level findings distinct from web application vulnerabilities.

0. RELATED ROUTING

• ssrf-server-side-request-forgery when these services are reachable via SSRF (e.g., SSRF → Redis)
• jndi-injection when H2 Console or similar accepts JNDI connection strings
• deserialization-insecure when RMI Registry or T3 protocol is exposed
• network-protocol-attacks for layer 2/3 attacks during service enumeration
• reverse-shell-techniques for shell payloads after gaining command execution

Comprehensive Port Reference

Also load PORT_SERVICE_MATRIX.md when you need:

• Full exploitation matrix organized by port number (20+ services)
• Enumeration, brute force, and post-exploitation per service
• Quick triage during nmap/masscan output analysis

---

1. DISCOVERY — PORT SCANNING

nmap -sV -p 6379,873,9000,8009,8088,8082,1099,9200,5984,2375,27017,11211 TARGET

# Key ports:
# 6379  — Redis
# 873   — Rsync
# 9000  — PHP-FPM (FastCGI)
# 8009  — AJP (Tomcat Ghostcat)
# 8088  — Hadoop YARN ResourceManager
# 8082  — H2 Console (or embedded in Spring Boot)
# 1099  — Java RMI Registry
# 9200  — Elasticsearch
# 5984  — CouchDB
# 2375  — Docker API
# 27017 — MongoDB
# 11211 — Memcached

---

2. REDIS (PORT 6379)

Detection

redis-cli -h TARGET ping
# Response: PONG = unauthenticated access confirmed

redis-cli -h TARGET INFO server
# Returns Redis version, OS, config

Write SSH Authorized Keys