> For the complete documentation index, see [llms.txt](https://gitbook.seguranca-informatica.pt/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://gitbook.seguranca-informatica.pt/cheat-sheet-1/services-by-port/11211-phpmemcached.md).

# 11211 - PHPMemCached

**Memcached** is a general-purpose distributed [memory caching](https://en.wikipedia.org/wiki/Memory_caching) system. It is often used to speed up dynamic database-driven websites by caching data and objects in RAM to reduce the number of times an external data source (such as a database or API) must be read.

## Memcached Port

**Port:** 11211/tcp open  

## Dir list

```
/memcachedadmin/stats.php
/memcachedadmin/Temp/.version
/memcachedadmin/configure.php
/memcachedadmin/index.php?server=127.0.0.1:11211
/memcachedadmin/index.php?server=127.0.0.1:11211&show=slabs
/memcachedadmin/commands.php
```

![](/files/-MZOfv70lRk21s5OIIZu)

![](/files/-MZOg6pNMjsf8I7xitc7)

```
echo "version" | nc -vn -w 1 <IP> 11211      #Get version
echo "stats" | nc -vn -w 1 <IP> 11211        #Get status
echo "stats slabs" | nc -vn -w 1 <IP> 11211  #Get slabs
echo "stats items" | nc -vn -w 1 <IP> 11211  #Get items of slabs with info
echo "stats cachedump <number> 0" | nc -vn -w 1 <IP> 11211  #Get key names (the 0 is for unlimited output size)
echo "get <item_name>" | nc -vn -w 1 <IP> 11211  #Get saved info

#This php will just dump the keys, you need to use "get <item_name> later"
sudo apt-get install php-memcached
php -r '$c = new Memcached(); $c->addServer("localhost", 11211); var_dump( $c->getAllKeys() );'
```

## Using libmemcached-tools

```
sudo apt install libmemcached-tools
memcstat --servers=127.0.0.1 #Get stats
memcdump --servers=127.0.0.1 #Get all items
memccat  --servers=127.0.0.1 <item1> <item2> <item3> #Get info inside the item(s
```

## Automatic scripts

```
nmap -n -sV --script memcached-info -p 11211 <IP>   #Just gather info
msf > use auxiliary/gather/memcached_extractor      #Extracts saved data
msf > use auxiliary/scanner/memcached/memcached_amp #Check is UDP DDoS amplification attack is possible
```

## CVEs

{% embed url="<https://www.cvedetails.com/vulnerability-list/vendor_id-9678/product_id-17294/version_id-79779/Memcachedb-Memcached-1.2.2.html>" %}

Any input is vulnerable to XSS.

![](/files/-MZOhZluk-UYPe8ORzyn)

![](/files/-MZOhNBam_6EFi3EWebD)

## **References**

{% embed url="<https://www.hackingarticles.in/penetration-testing-on-memcached-server/>" %}

{% embed url="<https://hackmag.com/security/a-small-injection-for-memcached/>" %}

{% embed url="<https://www.exploit-db.com/exploits/41455>" %}