Hunting on memcached servers: Dumping data

-

What is a Memcached server?



Memcached servers are used to store and retrieve data in the form of key-value pairs. When client requests for data from server, its checks for the data stored in the cache. If the data is available, it is loaded into the memory. If the data is not present, the server fetches it from the backend storage and stores it in its cache for future requests. So, it is used to speedup the web application by reducing the database load.

LETS DISCUSS!

Today we will be discussing on my recent bounty i got for key dumping from an open memcached server.


I got an ip from censys search which is targets ip. So as an initial recon i used nmap for scanning the ip.

nmap IPADDRESS -Pn

from initial scan i was able to find a port 11211 which is Memcached!! So i started pentesting on the server to retrieve data if it has no authentication. For confirmation i tried to connect the Memcached server via Telnet.

telnet IPADDRESS 11211

Wow! I was able to connect to the server without authentication. Great!. Now i tried command to check the version.

version


Now i checked the server statistics with stats command,

stats



the command "stats items" is used to display detailed statistics about each item that is currently stored in the cache. When the command is executed, the Memcached server responds with a list of all the slabs (memory pools) and the items that are currently stored in them. A slab is a pre-allocated block of memory that is divided into smaller chunks of fixed size.

The command provides information about the following:

  • The slab ID: unique identifier for the memory pool in which the item is stored.
  • The item key: This is the unique identifier for the cached item.
  • The item's size: size of the cached item in bytes.
  • The item's age: length of time (in seconds) since the item was last accessed.
  • The item's expiration time: time (in seconds) after which the item will expire and be automatically removed from the cache.
  • The number of times the item has been accessed: number of times the item has been requested from the cache.
  • The number of times the item has been evicted: number of times the item has been removed from the cache due to memory constraints.

 


After that I tried to list all the items in the Slab with ID 1 and 808 indicates items ,

stats cachedump 1 808




Here you can see the data listed!.

Now we are going to retrieve the data stored using keys,

get KEY


 

Here KEY should be replaced with the Item Key. Now we get the data and dump the data with item keys!!

About the report

This issue was reported on march 1st 2023 and was fixed and rewarded by march 3rd 2023. The issue triaged as High 7.5 cause i was able to retrieve the item keys and data from the Memcached server.

References

https://chat.openai.com/

https://book.hacktricks.xyz/network-services-pentesting/11211-memcache

https://www.hackingarticles.in/penetration-testing-on-memcached-server/


Hope you enjoyed the write-up! Thanks.

Buy me a Pizza

Comments

Post a Comment

Popular posts from this blog

Playing With s3 Leaks

-
Image
Hi Everyone, My name is Aswin Thambi Panikulangara (R0074G3N7). In this writeup, I will be sharing my technique of enumerating s3 buckets, finding misconfigurations, and recent bug I found in a public program(P1). Tools :  Subfinder ,  Ffuf ,  waybackurls *.redacted.com is in scope. As usual, I started with subdomain enumeration, for subdomain enumeration I usually use  subfinder. subfinder -d redacted.com > subdomains.txt Now I used f fuf  for Fuzzing and enumerating s3 buckets. ffuf -u  http://FUZZ.s3.amazonaws.com  -w subdomains.txt After fuzzing got 5 buckets. Four of them were denied access and one was open. Bucket was like  : sub.redacted.com.s3.amazonaws.com So I need to confirm this bucket belongs to redacted.com. I used waybackurls this time. cat subdomains.txt | waybackurls | grep s3.amazonaws After seeing this just tried to list the bucket. aws s3 ls s3://sub.redacted.com Bucket listed successfully!!! It was leaking tons of private pictures of users where anyone can acces
Read more

Playing With S3 Part 2

-
Image
     S3 Bucket Enumeration Via Response   Hi Hackers, In this article, I will be talking about one of my recent find on a program triaged as critical.Target "redacted.com" was a large scope and was using amazon web services. You can find previous article on s3 bucket enumeration here   After enumerating subdomains using subfinder , I randomly visited all subdomains and my burpsuite was running in background. After sometime i just visited my burpsuite's HTTP history tab where i can list of all of the requests that i have made and the responses received.   Here i went to BURP tab > search and searched keyword    "amazonaws.com"  Here you can see one of the s3 bucket using by redacted.com was leaking in response. Just copied this URL and paste it in browser.   Eg: http://bucket. s3.amazonaws.com/attachment. jpg   The s3 bucket was Open to public and was leaking user attachments, bills, identity cards, etc.. Now i need to check for another privileges like uploadi
Read more