# 11211 - PHPMemCached

**Memcached** is a general-purpose distributed [memory caching](https://en.wikipedia.org/wiki/Memory_caching) system. It is often used to speed up dynamic database-driven websites by caching data and objects in RAM to reduce the number of times an external data source (such as a database or API) must be read.

## Memcached Port

**Port:** 11211/tcp open  

## Dir list

```
/memcachedadmin/stats.php
/memcachedadmin/Temp/.version
/memcachedadmin/configure.php
/memcachedadmin/index.php?server=127.0.0.1:11211
/memcachedadmin/index.php?server=127.0.0.1:11211&show=slabs
/memcachedadmin/commands.php
```

![](/files/-MZOfv70lRk21s5OIIZu)

![](/files/-MZOg6pNMjsf8I7xitc7)

```
echo "version" | nc -vn -w 1 <IP> 11211      #Get version
echo "stats" | nc -vn -w 1 <IP> 11211        #Get status
echo "stats slabs" | nc -vn -w 1 <IP> 11211  #Get slabs
echo "stats items" | nc -vn -w 1 <IP> 11211  #Get items of slabs with info
echo "stats cachedump <number> 0" | nc -vn -w 1 <IP> 11211  #Get key names (the 0 is for unlimited output size)
echo "get <item_name>" | nc -vn -w 1 <IP> 11211  #Get saved info

#This php will just dump the keys, you need to use "get <item_name> later"
sudo apt-get install php-memcached
php -r '$c = new Memcached(); $c->addServer("localhost", 11211); var_dump( $c->getAllKeys() );'
```

## Using libmemcached-tools

```
sudo apt install libmemcached-tools
memcstat --servers=127.0.0.1 #Get stats
memcdump --servers=127.0.0.1 #Get all items
memccat  --servers=127.0.0.1 <item1> <item2> <item3> #Get info inside the item(s
```

## Automatic scripts

```
nmap -n -sV --script memcached-info -p 11211 <IP>   #Just gather info
msf > use auxiliary/gather/memcached_extractor      #Extracts saved data
msf > use auxiliary/scanner/memcached/memcached_amp #Check is UDP DDoS amplification attack is possible
```

## CVEs

{% embed url="<https://www.cvedetails.com/vulnerability-list/vendor_id-9678/product_id-17294/version_id-79779/Memcachedb-Memcached-1.2.2.html>" %}

Any input is vulnerable to XSS.

![](/files/-MZOhZluk-UYPe8ORzyn)

![](/files/-MZOhNBam_6EFi3EWebD)

## **References**

{% embed url="<https://www.hackingarticles.in/penetration-testing-on-memcached-server/>" %}

{% embed url="<https://hackmag.com/security/a-small-injection-for-memcached/>" %}

{% embed url="<https://www.exploit-db.com/exploits/41455>" %}


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://gitbook.seguranca-informatica.pt/cheat-sheet-1/services-by-port/11211-phpmemcached.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.