Lion Cipher Lab
Exploit an exposed Memcached in your own lab, then lock it down
- Penetration Testing / Red Team
- Intermediate
- ~45 min
- Free · no account required
Why it matters
Memcached is one of the quietest, most widely deployed pieces of infrastructure on the internet: a simple, blazing-fast in-memory cache that sits in front of databases and web apps to remember the expensive-to-compute things — rendered pages, database query results, and very often session data and authentication tokens. It was designed, explicitly, to live on a trusted internal network and talk to trusted clients, so for its entire life it has had NO authentication in its default configuration and it listens, in the common deployment, on every network interface. On the developer's laptop, or…
What you'll learn
- defining what Memcached is, what 'unauthenticated' means for a cache, and why an exposed one is one of the most common findings on the internet
- standing up an isolated two-container lab (a Memcached server and a busybox 'attacker' with netcat on a private Docker network) so the whole exercise touches nothing but your own machine
- speaking Memcached's plain-text protocol by hand over nc: version, stats, stats items, stats cachedump, get and set
- reading cached data an application never meant a stranger to see, and demonstrating CACHE POISONING by overwriting a cached value from an anonymous client
- understanding the flush_all cache-wipe as a denial-of-service against the backend, and the UDP reflection/amplification vector (the 2018 'memcrashed' DDoS) WITHOUT ever performing one
- naming precisely how Memcached's impact DIFFERS from Redis's — data disclosure, poisoning and DDoS amplification, but NO built-in file-write-to-RCE — so you report it accurately
- applying the fix and measuring it: bind to loopback (-l 127.0.0.1), disable UDP (-U 0), enable SASL auth, firewall the port, run non-root — then re-run the same stats probe and watch it refuse
- judgment: why a cache that 'trusts the network' is a time bomb the moment it moves onto one, and why the finding generalises across every store with that heritage
Steps in this lab
- What Memcached is, and what 'unauthenticated' actually means here
- Build the isolated lab: two containers, one private network, your machine only
- Confirm unauthenticated access — speak the protocol by hand
- Read the cache — and poison it — from an anonymous client
- The UDP amplification history — the big one, understood not weaponised
- The fix, and the measurement: bind, UDP, SASL, firewall, non-root
- Do it better — recognise, report, and prevent the exposed cache