> For the complete documentation index, see [llms.txt](https://gitbook.seguranca-informatica.pt/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://gitbook.seguranca-informatica.pt/cheat-sheet-1/services-by-port/11211-phpmemcached.md).

# 11211 - PHPMemCached

**Memcached** is a general-purpose distributed [memory caching](https://en.wikipedia.org/wiki/Memory_caching) system. It is often used to speed up dynamic database-driven websites by caching data and objects in RAM to reduce the number of times an external data source (such as a database or API) must be read.

## Memcached Port

**Port:** 11211/tcp open  

## Dir list

```
/memcachedadmin/stats.php
/memcachedadmin/Temp/.version
/memcachedadmin/configure.php
/memcachedadmin/index.php?server=127.0.0.1:11211
/memcachedadmin/index.php?server=127.0.0.1:11211&show=slabs
/memcachedadmin/commands.php
```

![](https://4052868066-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MWd-VcvRHVgUtkahm85%2F-MZOdygglNaWYWro4icH%2F-MZOfv70lRk21s5OIIZu%2Fimage.png?alt=media\&token=cd5e9e56-77c7-435a-84c9-f883ebf7dae5)

![](https://4052868066-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MWd-VcvRHVgUtkahm85%2F-MZOdygglNaWYWro4icH%2F-MZOg6pNMjsf8I7xitc7%2Fimage.png?alt=media\&token=1ed6a4d9-7870-40ee-99a4-b7a6937b09ca)

```
echo "version" | nc -vn -w 1 <IP> 11211      #Get version
echo "stats" | nc -vn -w 1 <IP> 11211        #Get status
echo "stats slabs" | nc -vn -w 1 <IP> 11211  #Get slabs
echo "stats items" | nc -vn -w 1 <IP> 11211  #Get items of slabs with info
echo "stats cachedump <number> 0" | nc -vn -w 1 <IP> 11211  #Get key names (the 0 is for unlimited output size)
echo "get <item_name>" | nc -vn -w 1 <IP> 11211  #Get saved info

#This php will just dump the keys, you need to use "get <item_name> later"
sudo apt-get install php-memcached
php -r '$c = new Memcached(); $c->addServer("localhost", 11211); var_dump( $c->getAllKeys() );'
```

## Using libmemcached-tools

```
sudo apt install libmemcached-tools
memcstat --servers=127.0.0.1 #Get stats
memcdump --servers=127.0.0.1 #Get all items
memccat  --servers=127.0.0.1 <item1> <item2> <item3> #Get info inside the item(s
```

## Automatic scripts

```
nmap -n -sV --script memcached-info -p 11211 <IP>   #Just gather info
msf > use auxiliary/gather/memcached_extractor      #Extracts saved data
msf > use auxiliary/scanner/memcached/memcached_amp #Check is UDP DDoS amplification attack is possible
```

## CVEs

{% embed url="<https://www.cvedetails.com/vulnerability-list/vendor_id-9678/product_id-17294/version_id-79779/Memcachedb-Memcached-1.2.2.html>" %}

Any input is vulnerable to XSS.

![](https://4052868066-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MWd-VcvRHVgUtkahm85%2F-MZOdygglNaWYWro4icH%2F-MZOhZluk-UYPe8ORzyn%2Fimage.png?alt=media\&token=14169db0-e8a5-4a00-96a1-84c67f9dcf08)

![](https://4052868066-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MWd-VcvRHVgUtkahm85%2F-MZOdygglNaWYWro4icH%2F-MZOhNBam_6EFi3EWebD%2Fimage.png?alt=media\&token=c9d79350-0a2f-4675-b9c8-43caf3e4c57d)

## **References**

{% embed url="<https://www.hackingarticles.in/penetration-testing-on-memcached-server/>" %}

{% embed url="<https://hackmag.com/security/a-small-injection-for-memcached/>" %}

{% embed url="<https://www.exploit-db.com/exploits/41455>" %}