Redis is injected with crackit, but I disabled the persistent storage function. how can I determine if my server is hacked?

Due to my negligence, I forgot to set a password for redis I installed two months ago and bound it to a public IP address. so I opened redis today and saw the crackit field injected, the value is an ssh-rsa, but it seems that my root password has not been changed during this period. does it mean that he only needs to note...

Due to my negligence, I forgot to set a password for redis I installed two months ago and bound it to a public IP address. so I opened redis today and saw the crackit field injected, the value is an ssh-rsa, but it seems that my root password has not been changed during this period. does it mean that he only injected the key, but it has not been replaced successfully?

After I installed redis, I commented out the three lines. In theory, I should have disabled the persistent storage function. if I disabled it, can I still use this method to hack my server?

I asked this question to confirm whether my server was hacked by him? Because I have important data on my server, thank you!

Reply content:

Due to my negligence, I forgot to set a password for redis I installed two months ago and bound it to a public IP address. so I opened redis today and saw the crackit field injected, the value is an ssh-rsa, but it seems that my root password has not been changed during this period. does it mean that he only injected the key, but it has not been replaced successfully?

After I installed redis, I commented out the three lines. In theory, I should have disabled the persistent storage function. if I disabled it, can I still use this method to hack my server?

I asked this question to confirm whether my server was hacked by him? Because I have important data on my server, thank you!

In this way, persistence is disabled.
Check whether authorized_keys under/root/. ssh is abnormal.
This vulnerability can only be used to write files through redis. it is mainly used to write ssh-rsa and then log on to it through ssh.
If the lua script is executed through redis, this will not work.
If it is hacked, other backdoors may also be left, and the record will be clearly cleared. In this way, you do not know that you have been hacked.