The New Page of Injections Book: Memcached Injections
summary
Shodan shows ~118,000 exposed memcached instances; research tests drivers for Go, Ruby, Java, Python, PHP, Lua and .NET and finds concrete exploits. Vulnerabilities include CRLF delimiter injection (inject extra memcached commands via keys), state-break via invalid command (use malformed command to make subsequent data parsed as commands) and argument-shift attacks that abuse space delimiters. Demos succeed: PHP shows key overwrite, Ruby shows null-byte state break, Python achieves remote code execution via pickle deserialization. Several real-world drivers are vulnerable.
AI-written summary · about
chapters (18)
- 0:00Intro
- 0:46Memcached BIO
- 1:49Shodan stats
- 2:44Protocol overview
- 4:06Commands types
- 5:00How applications uses memcached
- 6:54Memcached wrappers
- 8:08Scope of research
- 8:48Injection types
- 11:13Command injection
- 23:41State breaking
- 29:49Who is vulnerable
- 36:36Argument injection
- 38:49Length breaking
- 39:39Post exploitation
- 40:21Application level
- 40:51Deserialization
- 41:27RCE demo
related talks
40mMemcached Injections: They Exist and They Work
44mCache Me If You Can: Messing with Web Caching
38mInjections - 4 Ways of Penetration
54mTaking on the King: Killing Injection Vulnerabilities
35mInside a hacker’s mind
35mPHP is evil (Defensive programming)
01h 01mHow hacking works - Web edition
42mHack Me If You Can