[刷题]水题-memcache安全相关

写在开头：

忙里偷闲刷的题，所以中间有重启lab导致ip变更的情况。

Questions

Find the version of memcached server using nmap.
Find the version information using netcat or telnet.
Find the maximum number of simultaneous incoming connections allowed by the memcached server use available nmap scripts.
Find the number of current items on the memcached server using memcstat.
Find the value stored in the key 'flag' from the key value pairs dumped by available Metasploit module.
Find the name of all keys present on the memcached server using memcdump.
Find the value stored in key “first_name” using memcached-tool.

Instructions:

This lab is dedicated to you! No other users are on this network 😃
Once you start the lab, you will have access to a root terminal of a Kali instance
Your Kali has an interface with IP address 192.X.Y.Z. Run "ip addr" to know the values of X and Y.
The Target machine should be located at the IP address 192.X.Y.3.
Do not attack the gateway located at IP address 192.X.Y.1

Question1&2

根据questions，获得ip

root@attackdefense:~# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
2: ip_vti0@NONE: <NOARP> mtu 1480 qdisc noop state DOWN group default qlen 1000
    link/ipip 0.0.0.0 brd 0.0.0.0
4783: eth0@if4784: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default
    link/ether 02:42:0a:01:01:04 brd ff:ff:ff:ff:ff:ff link-netnsid 0
    inet 10.1.1.4/24 brd 10.1.1.255 scope global eth0
       valid_lft forever preferred_lft forever
4786: eth1@if4787: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default
    link/ether 02:42:c0:98:32:02 brd ff:ff:ff:ff:ff:ff link-netnsid 0
    inet 192.152.50.2/24 brd 192.152.50.255 scope global eth1
       valid_lft forever preferred_lft forever

可知目标ip是192.152.50.3,nmap用nmap -sV -p- 192.152.50.3解得version是1.5.1211211/tcp open memcached Memcached 1.5.12 (uptime 613 seconds)看了下nmap的help，也没写-p后的“-”是什么，搜了一下发现也是规范没写到说明里就是了（反正没找到)。如下：

netcatecho -e "version\r\nquit\r\n" | nc 192.211.230.3 11211VERSION 1.5.12可知端口11211端口开放，扫描该端口echo -e 是用于处理特殊字符

Question3

问题3解决我看了一阵help，然后搜索了一下。这个问题需要了解nmap都有哪些script脚本，nmap的script目录位于/usr/share/nmap/script下（我通过输入一个错误的脚本名称，然后发现路径的=。=当然也可以直接google搜，我是在尝试只靠工具的提示能最大化获取信息到什么程度）