mirror of
https://github.com/carlospolop/hacktricks
synced 2024-11-23 13:13:41 +00:00
242 lines
12 KiB
Markdown
242 lines
12 KiB
Markdown
# 27017,27018 - MongoDB渗透测试
|
||
|
||
<details>
|
||
|
||
<summary><a href="https://cloud.hacktricks.xyz/pentesting-cloud/pentesting-cloud-methodology"><strong>☁️ HackTricks云 ☁️</strong></a> -<a href="https://twitter.com/hacktricks_live"><strong>🐦 推特 🐦</strong></a> - <a href="https://www.twitch.tv/hacktricks_live/schedule"><strong>🎙️ Twitch 🎙️</strong></a> - <a href="https://www.youtube.com/@hacktricks_LIVE"><strong>🎥 YouTube 🎥</strong></a></summary>
|
||
|
||
* 你在一家**网络安全公司**工作吗？想要在HackTricks中看到你的**公司广告**吗？或者你想要**获取PEASS的最新版本或下载HackTricks的PDF**吗？请查看[**订阅计划**](https://github.com/sponsors/carlospolop)！
|
||
* 发现我们的独家[**NFTs**](https://opensea.io/collection/the-peass-family)收藏品——[**The PEASS Family**](https://opensea.io/collection/the-peass-family)
|
||
* 获取[**官方PEASS和HackTricks周边产品**](https://peass.creator-spring.com)
|
||
* **加入**[**💬**](https://emojipedia.org/speech-balloon/) [**Discord群组**](https://discord.gg/hRep4RUj7f)或[**电报群组**](https://t.me/peass)，或者**关注**我在**Twitter**上的[**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/hacktricks\_live)**。**
|
||
* **通过向**[**hacktricks repo**](https://github.com/carlospolop/hacktricks) **和**[**hacktricks-cloud repo**](https://github.com/carlospolop/hacktricks-cloud) **提交PR来分享你的黑客技巧。**
|
||
|
||
</details>
|
||
|
||
<figure><img src="../.gitbook/assets/image (1) (3) (1).png" alt=""><figcaption></figcaption></figure>
|
||
|
||
**HackenProof是所有加密漏洞赏金的家园。**
|
||
|
||
**无需等待即可获得奖励**\
|
||
HackenProof的赏金只有在客户存入奖励预算后才会启动。在漏洞验证后，您将获得奖励。
|
||
|
||
**在web3渗透测试中积累经验**\
|
||
区块链协议和智能合约是新的互联网！在其兴起的时代掌握web3安全。
|
||
|
||
**成为web3黑客传奇**\
|
||
每次验证的漏洞都会获得声望积分，并占据每周排行榜的榜首。
|
||
|
||
[**在HackenProof上注册**](https://hackenproof.com/register)开始从您的黑客攻击中获利！
|
||
|
||
{% embed url="https://hackenproof.com/register" %}
|
||
|
||
## 基本信息
|
||
|
||
MongoDB是一个使用面向文档的数据库模型的[开源](https://whatis.techtarget.com/definition/open-source)数据库管理系统（DBMS），支持各种形式的数据。（来自[这里](https://searchdatamanagement.techtarget.com/definition/MongoDB)）
|
||
|
||
**默认端口：** 27017, 27018
|
||
```
|
||
PORT STATE SERVICE VERSION
|
||
27017/tcp open mongodb MongoDB 2.6.9 2.6.9
|
||
```
|
||
## 枚举
|
||
|
||
### 手动枚举
|
||
|
||
MongoDB默认情况下不会绑定到特定的IP地址，因此可以通过连接到目标IP地址的27017和27018端口来尝试访问MongoDB实例。
|
||
|
||
使用以下命令连接到MongoDB实例：
|
||
|
||
```bash
|
||
mongo --host <target_ip> --port <port>
|
||
```
|
||
|
||
如果成功连接到MongoDB实例，您将看到一个提示符，可以在其中执行MongoDB命令。
|
||
|
||
### 自动化枚举
|
||
|
||
可以使用自动化工具来枚举MongoDB实例。以下是一些常用的工具：
|
||
|
||
- **MongoDB Compass**：官方提供的图形化界面工具，可用于连接和管理MongoDB实例。
|
||
- **Nmap**：使用Nmap的脚本扫描功能，可以发现MongoDB实例并提供有关实例的信息。
|
||
- **Metasploit**：Metasploit框架中的MongoDB模块可用于枚举和攻击MongoDB实例。
|
||
|
||
使用这些工具之一，可以自动发现和枚举MongoDB实例，以获取有关目标系统的更多信息。
|
||
```python
|
||
from pymongo import MongoClient
|
||
client = MongoClient(host, port, username=username, password=password)
|
||
client.server_info() #Basic info
|
||
#If you have admin access you can obtain more info
|
||
admin = client.admin
|
||
admin_info = admin.command("serverStatus")
|
||
cursor = client.list_databases()
|
||
for db in cursor:
|
||
print(db)
|
||
print(client[db["name"]].list_collection_names())
|
||
#If admin access, you could dump the database also
|
||
```
|
||
**一些MongoDB命令：**
|
||
|
||
```bash
|
||
# Show all databases
|
||
show dbs
|
||
|
||
# Switch to a specific database
|
||
use <database_name>
|
||
|
||
# Show all collections in the current database
|
||
show collections
|
||
|
||
# Show all documents in a collection
|
||
db.<collection_name>.find()
|
||
|
||
# Insert a document into a collection
|
||
db.<collection_name>.insertOne({<document>})
|
||
|
||
# Update a document in a collection
|
||
db.<collection_name>.updateOne({<filter>}, {$set: {<update>}})
|
||
|
||
# Delete a document from a collection
|
||
db.<collection_name>.deleteOne({<filter>})
|
||
```
|
||
|
||
**Note:** Replace `<database_name>` with the name of the desired database, `<collection_name>` with the name of the desired collection, `<document>` with the document to be inserted, `<filter>` with the filter to identify the document to be updated or deleted, and `<update>` with the fields to be updated in the document.
|
||
```bash
|
||
show dbs
|
||
use <db>
|
||
show collections
|
||
db.<collection>.find() #Dump the collection
|
||
db.<collection>.count() #Number of records of the collection
|
||
db.current.find({"username":"admin"}) #Find in current db the username admin
|
||
```
|
||
### 自动化
|
||
|
||
MongoDB is a popular NoSQL database that is widely used in web applications. It uses a binary protocol for communication, which makes it vulnerable to attacks if not properly secured. In this section, we will discuss some automated techniques that can be used to exploit MongoDB.
|
||
|
||
#### Enumeration
|
||
|
||
Enumeration is the process of gathering information about the target system. In the case of MongoDB, we can use automated tools like **mongo** and **mongoaudit** to enumerate the databases, collections, and documents present in the database.
|
||
|
||
```bash
|
||
mongo --host <target_ip> --port <target_port>
|
||
show dbs
|
||
use <database_name>
|
||
show collections
|
||
db.<collection_name>.find()
|
||
```
|
||
|
||
#### Brute-forcing
|
||
|
||
Brute-forcing is a technique used to guess the correct username and password combination. In the case of MongoDB, we can use automated tools like **Hydra** and **Nmap** to perform brute-force attacks.
|
||
|
||
```bash
|
||
hydra -l <username> -P <password_list> <target_ip> mongodb
|
||
nmap -p <target_port> --script mongodb-brute <target_ip>
|
||
```
|
||
|
||
#### Exploiting Weak Configuration
|
||
|
||
Weak configuration settings can make a MongoDB database vulnerable to attacks. Automated tools like **mongoaudit** can be used to identify weak configuration settings and suggest remediation steps.
|
||
|
||
```bash
|
||
mongoaudit --host <target_ip> --port <target_port>
|
||
```
|
||
|
||
#### Exploiting Default Credentials
|
||
|
||
MongoDB comes with default credentials that are often left unchanged by administrators. Automated tools like **mongo** and **mongoaudit** can be used to check if the default credentials are still in use.
|
||
|
||
```bash
|
||
mongo --host <target_ip> --port <target_port> -u <username> -p <password> --authenticationDatabase admin
|
||
mongoaudit --host <target_ip> --port <target_port> --username <username> --password <password> --authenticationDatabase admin
|
||
```
|
||
|
||
#### Exploiting Injection Vulnerabilities
|
||
|
||
Injection vulnerabilities in MongoDB can allow an attacker to execute arbitrary commands on the database. Automated tools like **NoSQLMap** can be used to exploit these vulnerabilities.
|
||
|
||
```bash
|
||
nosqlmap -u "mongodb://<target_ip>:<target_port>/<database_name>" --passwords <password_list> --dbs
|
||
```
|
||
|
||
#### Conclusion
|
||
|
||
Automated techniques can greatly simplify the process of exploiting MongoDB. However, it is important to note that these techniques should only be used for ethical purposes, such as penetration testing or securing your own systems.
|
||
```bash
|
||
nmap -sV --script "mongo* and default" -p 27017 <IP> #By default all the nmap mongo enumerate scripts are used
|
||
```
|
||
### Shodan
|
||
|
||
* 所有的mongodb: `"mongodb服务器信息"`
|
||
* 搜索完全开放的mongodb服务器: `"mongodb服务器信息" -"部分启用"`
|
||
* 只部分启用身份验证: `"mongodb服务器信息" "部分启用"`
|
||
|
||
## 登录
|
||
|
||
默认情况下，mongo不需要密码。\
|
||
**Admin** 是一个常见的mongo数据库。
|
||
```bash
|
||
mongo <HOST>
|
||
mongo <HOST>:<PORT>
|
||
mongo <HOST>:<PORT>/<DB>
|
||
mongo <database> -u <username> -p '<password>'
|
||
```
|
||
nmap脚本：_**mongodb-brute**_ 将检查是否需要凭据。
|
||
```bash
|
||
nmap -n -sV --script mongodb-brute -p 27017 <ip>
|
||
```
|
||
### [**暴力破解**](../generic-methodologies-and-resources/brute-force.md#mongo)
|
||
|
||
查看 _/opt/bitnami/mongodb/mongodb.conf_ 文件以确定是否需要凭据：
|
||
```bash
|
||
grep "noauth.*true" /opt/bitnami/mongodb/mongodb.conf | grep -v "^#" #Not needed
|
||
grep "auth.*true" /opt/bitnami/mongodb/mongodb.conf | grep -v "^#\|noauth" #Not needed
|
||
```
|
||
## Mongo Objectid 预测
|
||
|
||
Mongo Object ID 是**12字节的十六进制**字符串：
|
||
|
||
|
||
|
||
例如，这是一个实际应用返回的 Object ID 的解析示例：5f2459ac9fa6dc2500314019
|
||
|
||
1. 5f2459ac：1596217772 的十进制表示 = 2020年7月31日星期五 17:49:32
|
||
2. 9fa6dc：机器标识符
|
||
3. 2500：进程 ID
|
||
4. 314019：递增计数器
|
||
|
||
在上述元素中，机器标识符在数据库运行相同的物理/虚拟机的时间内保持不变。只有在 MongoDB 进程重新启动时，进程 ID 才会更改。时间戳每秒更新一次。通过简单地递增计数器和时间戳值来猜测 Object ID 的唯一挑战在于，Mongo DB 生成 Object ID 并在系统级别分配 Object ID。
|
||
|
||
工具 [https://github.com/andresriancho/mongo-objectid-predict](https://github.com/andresriancho/mongo-objectid-predict) 可以根据一个起始 Object ID（您可以创建一个帐户并获取一个起始 ID），返回大约 1000 个可能已分配给下一个对象的 Object ID，因此您只需要使用暴力破解来尝试它们。
|
||
|
||
## 发布
|
||
|
||
如果您是 root 用户，可以**修改** **mongodb.conf** 文件，以便不需要凭据（_noauth = true_）并**无需凭据登录**。
|
||
|
||
<figure><img src="../.gitbook/assets/image (1) (3) (1).png" alt=""><figcaption></figcaption></figure>
|
||
|
||
**HackenProof 是所有加密漏洞赏金的家园。**
|
||
|
||
**即时获得奖励**\
|
||
HackenProof 的赏金只有在客户存入奖励预算后才会启动。在漏洞验证后，您将获得奖励。
|
||
|
||
**在 web3 渗透测试中积累经验**\
|
||
区块链协议和智能合约是新的互联网！在它崛起的时代掌握 web3 安全。
|
||
|
||
**成为 web3 黑客传奇**\
|
||
每次验证的漏洞都会获得声望积分，并占据每周排行榜的榜首。
|
||
|
||
[**在 HackenProof 上注册**](https://hackenproof.com/register) 开始从您的黑客行动中获利！
|
||
|
||
{% embed url="https://hackenproof.com/register" %}
|
||
|
||
<details>
|
||
|
||
<summary><a href="https://cloud.hacktricks.xyz/pentesting-cloud/pentesting-cloud-methodology"><strong>☁️ HackTricks 云 ☁️</strong></a> -<a href="https://twitter.com/hacktricks_live"><strong>🐦 Twitter 🐦</strong></a> - <a href="https://www.twitch.tv/hacktricks_live/schedule"><strong>🎙️ Twitch 🎙️</strong></a> - <a href="https://www.youtube.com/@hacktricks_LIVE"><strong>🎥 Youtube 🎥</strong></a></summary>
|
||
|
||
* 您在**网络安全公司**工作吗？您想在 HackTricks 中看到您的公司广告吗？或者您想获得最新版本的 PEASS 或下载 PDF 格式的 HackTricks 吗？请查看[**订阅计划**](https://github.com/sponsors/carlospolop)！
|
||
* 发现我们的独家 [**NFTs**](https://opensea.io/collection/the-peass-family) 集合 [**The PEASS Family**](https://opensea.io/collection/the-peass-family)
|
||
* 获得[**官方 PEASS & HackTricks 商品**](https://peass.creator-spring.com)
|
||
* **加入** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord 群组**](https://discord.gg/hRep4RUj7f) 或 [**Telegram 群组**](https://t.me/peass)，或在 **Twitter** 上 **关注**我 [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/hacktricks\_live)**。**
|
||
* **通过向** [**hacktricks 仓库**](https://github.com/carlospolop/hacktricks) **和** [**hacktricks-cloud 仓库**](https://github.com/carlospolop/hacktricks-cloud) **提交 PR 来分享您的黑客技巧。**
|
||
|
||
</details>
|