Fix bad loop terminator checks and data checks in memcached_extractor.rb

[gwillcox-r7]

Fixes #15975 by adding in additional error handling and checks to break out of the loop

Verification

List the steps needed to make sure this thing works

• Start msfconsole
• use auxiliary/gather/memcached_extractor
• Contact me for the target host.
• set RHOST <IP of target>
• run
• Verify that the program no longer errors out with the type conversion error.
• Test this on any other hosts n verify it still works correctly and that my additional code changes look correct.

[jmartin-tech]

Does max_keys here end up a reason for iteration or is the response guaranteed to be all keys?

[gwillcox-r7]

So according to https://elijaa.org/2010/12/24/understanding-memcached-stats-cachedump-command.html this is simply the maximum number of keys to dump however supposedly there may be a maximum return size of 1 MB, though given this command isn't documented and is part of the undocumented interface, there is speculation it may be 2 MB but not confirmed.

This is also noted at https://lzone.de/blog/How-to-Dump-Keys-from-Memcache where they note the following constraints:

1. You can only dump keys per slab class (keys with roughly the same content size)
2. You can only dump one page per slab class (1MB of data)
3. This is an unofficial feature that might be removed anytime.

Hopefully that helps explain things a bit here.

[cdelafuente-r7]

Thanks @gwillcox-r7 ! I verified it fixed the issue on faulty targets and also still work on normal ones. I'll go ahead and land it.

Before the fix

msf6 auxiliary(gather/memcached_extractor) > run verbose=true RHOSTS=<redacted>

[*] 123.207.184.223:11211 - Connecting to memcached server...
[+] 123.207.184.223:11211 - Connected to memcached version 2.5.1
[*] 123.207.184.223:11211 - Using lru_crawler to enumerate keys
[*] 123.207.184.223:11211 - Error: <redacted>: TypeError no implicit conversion of nil into Array
[*] 123.207.184.223:11211 - Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

With the fix

msf6 auxiliary(gather/memcached_extractor) > run verbose=true RHOSTS=<redacted>

[*] 123.207.184.223:11211 - Connecting to memcached server...
[+] 123.207.184.223:11211 - Connected to memcached version 2.5.1
[*] 123.207.184.223:11211 - Using lru_crawler to enumerate keys
[+] 123.207.184.223:11211 - Found 0 keys
[*] 123.207.184.223:11211 - Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

[cdelafuente-r7]

Release Notes

This fixes an issue when targeting some faulty memcached servers that return an error when extracting the keys and values stored in slabs. The module no longer errors out with a type conversion error.