metasploit-cursor-harness: Skill for Cursor

Memcache Pentest

Prerequisites

• Target is in scope (scope/scope-master.txt, engagement ROE).
• Web targets with exposed cache: load web-app-pentest.
• Do not run amplification attacks. auxiliary/dos/* modules are forbidden by ROE.

Ports and detection

Port	Service
11211/tcp	Memcached
11211/udp	Memcached (amplification vector, document only)

Service fingerprint

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/memcached/memcached_amp",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "RPORT": 11211}
)

CLI fallback:

nmap -n -sV --script memcached-info -p 11211 <target>
echo "version" | nc -vn -w 1 <target> 11211
echo "stats" | nc -vn -w 1 <target> 11211

Workflow

Task Progress:
- [ ] Version and stats enumeration
- [ ] SASL auth testing
- [ ] Slab and key discovery (TCP and UDP)
- [ ] Cached data extraction
- [ ] Deserialization chain assessment
- [ ] Document findings

Stats and version enumeration

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/gather/memcached_extractor",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "RPORT": 11211}
)

CLI fallback:

echo "version" | nc -vn -w 1 <target> 11211
echo "stats" | nc -vn -w 1 <target> 11211
echo "stats slabs" | nc -vn -w 1 <target> 11211
echo "stats items" | nc -vn -w 1 <target> 11211
memcstat --servers=<target>

SASL auth testing

MSF: No direct module; use CLI.

CLI fallback:

# Check if SASL required
echo "stats" | nc -vn <target> 11211
# CLIENT ERROR: auth required
echo -e "stats\r\n" | nc -vn <target> 11211

# Brute SASL credentials (when enabled)
# Using memcached-tool or custom script with SASL PLAIN
python3 -c "
import socket, base64
s = socket.create_connection(('<target>', 11211))
s.send(b'sasl plain\r\n')
# Send base64 null-separated auth string
auth = base64.b64encode(b'\\x00user\\x00pass').decode()
s.send(f'{len(auth)}\\r\\n{auth}\\r\\n'.encode())
print(s.recv(4096))
"

# libmemcached with SASL
memcstat --servers=<target> --username=user --password=pass