# 27017,27018 - Pentesting MongoDB {% hint style="success" %} Learn & practice AWS Hacking:[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)\ Learn & practice GCP Hacking: [**HackTricks Training GCP Red Team Expert (GRTE)**](https://training.hacktricks.xyz/courses/grte)
Support HackTricks * Check the [**subscription plans**](https://github.com/sponsors/carlospolop)! * **Join the** πŸ’¬ [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.** * **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
{% endhint %}
Join [**HackenProof Discord**](https://discord.com/invite/N3FrSbmwdy) server to communicate with experienced hackers and bug bounty hunters! **Hacking Insights**\ ν•΄ν‚Ήμ˜ 슀릴과 도전에 λŒ€ν•΄ 깊이 μžˆλŠ” μ½˜ν…μΈ μ— μ°Έμ—¬ν•˜μ„Έμš”. **Real-Time Hack News**\ μ‹€μ‹œκ°„ λ‰΄μŠ€μ™€ 톡찰λ ₯을 톡해 λΉ λ₯΄κ²Œ λ³€ν™”ν•˜λŠ” ν•΄ν‚Ή μ„Έκ³„μ˜ μ΅œμ‹  정보λ₯Ό μœ μ§€ν•˜μ„Έμš”. **Latest Announcements**\ μƒˆλ‘œμš΄ 버그 λ°”μš΄ν‹°μ™€ μ€‘μš”ν•œ ν”Œλž«νΌ μ—…λ°μ΄νŠΈμ— λŒ€ν•œ 정보λ₯Ό μœ μ§€ν•˜μ„Έμš”. **Join us on** [**Discord**](https://discord.com/invite/N3FrSbmwdy) and start collaborating with top hackers today! ## Basic Information **MongoDB**λŠ” λ‹€μ–‘ν•œ ν˜•νƒœμ˜ 데이터λ₯Ό μ²˜λ¦¬ν•˜κΈ° μœ„ν•΄ **λ¬Έμ„œ 지ν–₯ λ°μ΄ν„°λ² μ΄μŠ€ λͺ¨λΈ**을 μ‚¬μš©ν•˜λŠ” **μ˜€ν”ˆ μ†ŒμŠ€** λ°μ΄ν„°λ² μ΄μŠ€ 관리 μ‹œμŠ€ν…œμž…λ‹ˆλ‹€. λΉ„μ •ν˜• λ˜λŠ” λ°˜μ •ν˜• 데이터λ₯Ό κ΄€λ¦¬ν•˜κΈ° μœ„ν•œ μœ μ—°μ„±κ³Ό ν™•μž₯성을 μ œκ³΅ν•˜λ©°, λΉ… 데이터 뢄석 및 μ½˜ν…μΈ  관리와 같은 μ• ν”Œλ¦¬μΌ€μ΄μ…˜μ—μ„œ μ‚¬μš©λ©λ‹ˆλ‹€. **κΈ°λ³Έ 포트:** 27017, 27018 ``` PORT STATE SERVICE VERSION 27017/tcp open mongodb MongoDB 2.6.9 2.6.9 ``` ## Enumeration ### μˆ˜λ™ ```python from pymongo import MongoClient client = MongoClient(host, port, username=username, password=password) client.server_info() #Basic info #If you have admin access you can obtain more info admin = client.admin admin_info = admin.command("serverStatus") cursor = client.list_databases() for db in cursor: print(db) print(client[db["name"]].list_collection_names()) #If admin access, you could dump the database also ``` **일뢀 MongoDB λͺ…λ Ήμ–΄:** ```bash show dbs use show collections db..find() #Dump the collection db..count() #Number of records of the collection db.current.find({"username":"admin"}) #Find in current db the username admin ``` ### μžλ™ ```bash nmap -sV --script "mongo* and default" -p 27017 #By default all the nmap mongo enumerate scripts are used ``` ### Shodan * λͺ¨λ“  mongodb: `"mongodb server information"` * 전체 곡개 mongodb μ„œλ²„ 검색: `"mongodb server information" -"partially enabled"` * 인증이 λΆ€λΆ„μ μœΌλ‘œλ§Œ ν™œμ„±ν™”λœ 경우: `"mongodb server information" "partially enabled"` ## 둜그인 기본적으둜 mongoλŠ” λΉ„λ°€λ²ˆν˜Έλ₯Ό μš”κ΅¬ν•˜μ§€ μ•ŠμŠ΅λ‹ˆλ‹€.\ **Admin**은 일반적인 mongo λ°μ΄ν„°λ² μ΄μŠ€μž…λ‹ˆλ‹€. ```bash mongo mongo : mongo :/ mongo -u -p '' ``` The nmap script: _**mongodb-brute**_λŠ” 자격 증λͺ…이 ν•„μš”ν•œμ§€ ν™•μΈν•©λ‹ˆλ‹€. ```bash nmap -n -sV --script mongodb-brute -p 27017 ``` ### [**Brute force**](../generic-methodologies-and-resources/brute-force.md#mongo) _자격 증λͺ…이 ν•„μš”ν•œμ§€ ν™•μΈν•˜λ €λ©΄ /opt/bitnami/mongodb/mongodb.conf_ νŒŒμΌμ„ ν™•μΈν•˜μ„Έμš”: ```bash grep "noauth.*true" /opt/bitnami/mongodb/mongodb.conf | grep -v "^#" #Not needed grep "auth.*true" /opt/bitnami/mongodb/mongodb.conf | grep -v "^#\|noauth" #Not needed ``` ## Mongo Objectid Predict Example [from here](https://techkranti.com/idor-through-mongodb-object-ids-prediction/). Mongo Object IDsλŠ” **12λ°”μ΄νŠΈ 16μ§„μˆ˜** λ¬Έμžμ—΄μž…λ‹ˆλ‹€: ![http://techidiocy.com/\_id-objectid-in-mongodb/](../.gitbook/assets/id-and-ObjectIds-in-MongoDB.png) 예λ₯Ό λ“€μ–΄, μ• ν”Œλ¦¬μΌ€μ΄μ…˜μ—μ„œ λ°˜ν™˜λœ μ‹€μ œ Object IDλ₯Ό 뢄해해보면: 5f2459ac9fa6dc2500314019 1. 5f2459ac: 1596217772 (10μ§„μˆ˜) = 2020λ…„ 7μ›” 31일 κΈˆμš”μΌ 17:49:32 2. 9fa6dc: λ¨Έμ‹  μ‹λ³„μž 3. 2500: ν”„λ‘œμ„ΈμŠ€ ID 4. 314019: μ¦κ°€ν•˜λŠ” μΉ΄μš΄ν„° μœ„ μš”μ†Œ 쀑 λ¨Έμ‹  μ‹λ³„μžλŠ” λ°μ΄ν„°λ² μ΄μŠ€κ°€ λ™μΌν•œ 물리적/가상 λ¨Έμ‹ μ—μ„œ μ‹€ν–‰λ˜λŠ” ν•œ λ™μΌν•˜κ²Œ μœ μ§€λ©λ‹ˆλ‹€. ν”„λ‘œμ„ΈμŠ€ IDλŠ” MongoDB ν”„λ‘œμ„ΈμŠ€κ°€ μž¬μ‹œμž‘λ  λ•Œλ§Œ λ³€κ²½λ©λ‹ˆλ‹€. νƒ€μž„μŠ€νƒ¬ν”„λŠ” 맀초 μ—…λ°μ΄νŠΈλ©λ‹ˆλ‹€. μΉ΄μš΄ν„°μ™€ νƒ€μž„μŠ€νƒ¬ν”„ 값을 λ‹¨μˆœνžˆ μ¦κ°€μ‹œμΌœ Object IDλ₯Ό μΆ”μΈ‘ν•˜λŠ” 데 μœ μΌν•œ 도전 κ³Όμ œλŠ” Mongo DBκ°€ Object IDλ₯Ό μƒμ„±ν•˜κ³  μ‹œμŠ€ν…œ μˆ˜μ€€μ—μ„œ Object IDλ₯Ό ν• λ‹Ήν•œλ‹€λŠ” μ‚¬μ‹€μž…λ‹ˆλ‹€. 도ꡬ [https://github.com/andresriancho/mongo-objectid-predict](https://github.com/andresriancho/mongo-objectid-predict)λŠ” μ‹œμž‘ Object IDλ₯Ό μ£Όλ©΄ (계정을 μƒμ„±ν•˜κ³  μ‹œμž‘ IDλ₯Ό 얻을 수 μžˆμŠ΅λ‹ˆλ‹€), λ‹€μŒ 객체에 할당될 κ°€λŠ₯성이 μžˆλŠ” μ•½ 1000개의 Object IDλ₯Ό λ°˜ν™˜ν•˜λ―€λ‘œ 이λ₯Ό λΈŒλ£¨νŠΈν¬μŠ€ν•˜λ©΄ λ©λ‹ˆλ‹€. ## Post 루트 κΆŒν•œμ΄ μžˆλŠ” 경우 **mongodb.conf** νŒŒμΌμ„ **μˆ˜μ •**ν•˜μ—¬ 자격 증λͺ…이 ν•„μš” 없도둝 ν•  수 μžˆμŠ΅λ‹ˆλ‹€ (_noauth = true_) 그리고 **자격 증λͺ… 없이 둜그인**ν•  수 μžˆμŠ΅λ‹ˆλ‹€. ***
κ²½ν—˜μ΄ ν’λΆ€ν•œ 해컀 및 버그 λ°”μš΄ν‹° ν—Œν„°μ™€ μ†Œν†΅ν•˜κΈ° μœ„ν•΄ [**HackenProof Discord**](https://discord.com/invite/N3FrSbmwdy) μ„œλ²„μ— μ°Έμ—¬ν•˜μ„Έμš”! **Hacking Insights**\ ν•΄ν‚Ήμ˜ 슀릴과 도전에 λŒ€ν•΄ 깊이 μžˆλŠ” μ½˜ν…μΈ μ— μ°Έμ—¬ν•˜μ„Έμš”. **Real-Time Hack News**\ μ‹€μ‹œκ°„ λ‰΄μŠ€μ™€ 톡찰λ ₯을 톡해 λΉ λ₯΄κ²Œ λ³€ν™”ν•˜λŠ” ν•΄ν‚Ή μ„Έκ³„μ˜ μ΅œμ‹  정보λ₯Ό μœ μ§€ν•˜μ„Έμš”. **Latest Announcements**\ μƒˆλ‘œμš΄ 버그 λ°”μš΄ν‹° μΆœμ‹œ 및 μ€‘μš”ν•œ ν”Œλž«νΌ μ—…λ°μ΄νŠΈμ— λŒ€ν•œ 정보λ₯Ό μœ μ§€ν•˜μ„Έμš”. 였늘 [**Discord**](https://discord.com/invite/N3FrSbmwdy)에 μ°Έμ—¬ν•˜μ—¬ 졜고의 해컀듀과 ν˜‘μ—…μ„ μ‹œμž‘ν•˜μ„Έμš”! {% hint style="success" %} Learn & practice AWS Hacking:[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)\ Learn & practice GCP Hacking: [**HackTricks Training GCP Red Team Expert (GRTE)**](https://training.hacktricks.xyz/courses/grte)
Support HackTricks * Check the [**subscription plans**](https://github.com/sponsors/carlospolop)! * **Join the** πŸ’¬ [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.** * **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
{% endhint %}