Unauthorized access playbook for common exposed services. Use when Redis, Rsync, PHP-FPM, AJP/Ghostcat, Hadoop YARN, H2 Console, or similar management interfaces are exposed without authentication.

SKILL: Unauthorized Access to Common Services — Expert Attack Playbook AI LOAD INSTRUCTION : Expert techniques for exploiting unauthenticated or weakly authenticated management services. Covers Redis write to RCE, Rsync data theft, PHP FPM code execution, Ghostcat AJP file read, Hadoop YARN job submission, and H2 Console JNDI. These are infrastructure level findings distinct from web application vulnerabilities. 0. RELATED ROUTING [ssrf server side request forgery](../ssrf server side request forgery/SKILL.md) when these services are reachable via SSRF (e.g., SSRF → Redis) [jndi injection](../jndi injection/SKILL.md) when H2 Console or similar accepts JNDI connection strings [deserialization insecure](../deserialization insecure/SKILL.md) when RMI Registry or T3 protocol is exposed [network protocol attacks](../network protocol attacks/SKILL.md) for layer 2/3 attacks during service enumeration [reverse shell techniques](../reverse shell techniques/SKILL.md) for shell payloads after gaining command execution Comprehensive Port Reference Also load [PORT SERVICE MATRIX.md](./PORT SERVICE MATRIX.md) when you need: Full exploitation matrix organized by port number (20+ services) Enumeration, brute force, and post exploitation per service Quick triage during nmap/masscan output analysis 1. DISCOVERY — PORT SCANNING 2. REDIS (PORT 6379) Detection Write SSH Authorized Keys Write Crontab (Reverse Shell) Write Webshell Master Slave Replication RCE Use redis rogue server to exploit master slave replication for loading malicious .so module: Hardening 3. RSYNC (PORT 873) Detection Exploitation — Write Crontab Hardening 4. PHP FPM / FASTCGI (PORT 9000) Mechanism PHP FPM listens for FastCGI requests. If exposed to the network (instead of Unix socket), an attacker can send crafted FastCGI packets to execute arbitrary PHP code. Exploitation Key FastCGI Environment Variables for Exploitation Via SSRF (gopher) Hardening 5. GHOSTCAT — AJP (PORT 8009) — CVE 2020 1938 Mechanism Apache JServ Protocol (AJP) is used between reverse proxy and Tomcat. AJP trusts all incoming data — an attacker connecting directly can set javax.servlet.include.request uri to read arbitrary files from the webapp directory. File Read File Include → RCE If a file upload exists (e.g., uploaded JSP disguised as image), AJP can include it as JSP: Hardening 6. HADOOP YARN RESOURCEMANAGER (PORT 8088) Detection RCE via Application Submission Hardening Enable Kerberos authentication; restrict network access to management ports. 7. H2 DATABASE CONSOLE Detection H2 Console is often enabled in Spring Boot apps via: Access: http://TARGET:PORT/h2 console JNDI Injection via Connection String In the H2 Console login form, the JDBC URL field accepts JNDI. BeanFactory + EL bypass (works on Java 8u252+): Also see [jndi injection](../jndi injection/SKILL.md) for the full JNDI/BeanFactory exploitation flow. RCE via RUNSCRIPT 8. QUICK REFERENCE 9. REVERSE PROXY MISCONFIGURATION Nginx Off By Slash Path Traversal Nginx Missing Root Location X Forwarded For / X Real IP Trust Caddy Template Injection Useful Tools yandex/gixy — Nginx configuration analyzer Raelize/Kyubi — Reverse proxy misconfiguration scanner GerbenJavado/bypass url parser — URL parser confusion tester

unauthorized-access-common-services