srozb/reditrapMinimal Redis honeypot detecting RediShell (CVE-2025-49844) exploits.
RediTrap is a minimal Redis honeypot tailored to spot early attempts to exploit
CVE-2025-49844 ("RediShell"), the critical Remote Code Execution vulnerability
described by Wiz Research. The exploit abuses a 13 year old use-after-free bug in
the embedded Lua engine: Redis would store the Lua chunk name without first
anchoring it on the stack, allowing a garbage collection cycle to reclaim the
string while C code still used the pointer. The Redis patch
d5728cb
fixes the issue by pushing the chunk name onto the Lua stack (via
setsvalue2s/incr_top) before parsing and popping it afterwards, preventing
the stale pointer and closing the RCE primitive.
Because the published exploit path relies on sending malicious Lua scripts via
EVAL, EVALSHA, or SCRIPT LOAD, the honeypot focuses on surfacing those
interactions while pretending to be an unpatched Redis node.
6379 by default) and speaks a small RESP
subset so basic probes succeed (, , , etc.).PINGINFOAUTHHELLO) to encourage
attackers to continue their workflow.python3 reditrap.py --host 0.0.0.0 --port 6379 --log-file logs/redis-honeypot-events.ndjson
Use --verbose for additional stdout logging during development.
Build a compact image (Alpine base):
docker build -t reditrap .
# or: podman build -t reditrap .
Run it with the Redis port exposed and the log directory mounted on the host:
mkdir -p honeypot-logs
docker run -d --name reditrap \
-p 6379:6379 \
-v "$(pwd)/honeypot-logs:/data" \
reditrap
The container defaults to --host 0.0.0.0 --port 6379 --log-file /data/redis-honeypot-events.ndjson, so logs land on the host at
honeypot-logs/redis-honeypot-events.ndjson.
Podman works the same way (add the SELinux flag if applicable):
podman run -d --name reditrap \
-p 6379:6379 \
-v "$(pwd)/honeypot-logs:/data:Z" \
reditrap
Override defaults by appending arguments after the image name, for example:
docker run --rm -p 6379:6379 reditrap --redis-version 7.0.15 --log-file /data/attempts.ndjson
Each incoming request becomes an NDJSON entry. Suspicious Lua activity includes heuristics to make triage easier. For example:
{
"action": "lua_eval",
"args": ["return debug.getregistry()", "0"],
"command": "EVAL",
"info": {
"arg_count": 2,
"heuristics": {
"length": 26,
"matched_tokens": ["debug."],
"preview": "return debug.getregistry()"
},
"key_count": "0",
"script_hash": "763200efa15885c9fa970d45cc2b11711c739c13"
},
"remote": {"host": "203.0.113.42", "port": 58231},
"timestamp": "2025-10-07T15:04:12.123456+00:00"
}
Pair the logs with network telemetry to trace the attacking source and decide on response actions.