# Mongod (Tier 0)

## <mark style="color:blue;">Description</mark>

* **Tier&#x20;**<mark style="color:green;">**->**</mark> 0
* **Difficult** <mark style="color:green;">**->**</mark> Very Easy
* **OS** <mark style="color:green;">**->**</mark> Linux
* **Tags&#x20;**<mark style="color:green;">**->**</mark> MongoDB / Databases / Reconnaissance Misconfiguration / Anonymous-Guest Access

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FTQdBt1VzVG1ujOeHo8Cg%2Fimage.png?alt=media&#x26;token=9371faf4-385b-46b4-8b2e-b95bb4cb20d3" alt=""><figcaption><p><a href="https://app.hackthebox.com/starting-point?tier=0">https://app.hackthebox.com/starting-point?tier=0</a></p></figcaption></figure>

## <mark style="color:blue;">Write-up</mark>

* I started doing an initial port scan of the machine using [_Nmap_](../../../networks/tools-and-utilities#nmap)

{% code lineNumbers="true" %}
```bash
nmap 10.129.1.138 -p- -Pn --min-rate 2500 -oN scan.txt
```
{% endcode %}

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2F9qrEgQFUPzM1piyROwa7%2Fimage.png?alt=media&#x26;token=13a216ee-1892-4bb9-a2ac-b2f8b91d4d89" alt=""><figcaption></figcaption></figure>

***

* With this, I answered the first question

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FMMMNbvTf1X4Ne9W7Shb3%2Fimage.png?alt=media&#x26;token=2047d2c9-a4bf-4eb6-a9e6-302616437326" alt=""><figcaption></figcaption></figure>

> Answer: _**2**_

***

* Then I did an exhaustive scan of the ports we found to get information about the running services

{% code lineNumbers="true" %}
```bash
nmap 10.129.1.138 -p22,27017 -sVC -oN serv_scan.txt
```
{% endcode %}

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FUqI2A6onJsCtAiU29S5f%2Fimage.png?alt=media&#x26;token=c688903f-1ebf-4d4d-bdcc-452ff41b5ca6" alt=""><figcaption></figcaption></figure>

***

* With this and a little research, I answered the next questions

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FsmAhwS5IhtiVL61VZkWo%2Fimage.png?alt=media&#x26;token=53a23157-e59c-4da8-b1ac-40037e040d1e" alt=""><figcaption></figcaption></figure>

> Answer: _**MongoDB 3.6.8**_

***

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2F2KAqfTxzeMuD0FHAamGx%2Fimage.png?alt=media&#x26;token=ae70b690-d214-417b-b2ff-8229a2eb2ffe" alt=""><figcaption></figcaption></figure>

> Answer: _**NoSQL**_

***

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FTw1mnoWgiRXcKYWWFGi3%2Fimage.png?alt=media&#x26;token=d948f897-baef-432a-a12e-a0c58e5e1522" alt=""><figcaption></figcaption></figure>

> Answer: _**mongosh**_

***

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FS0pMDzykXJi5Jips72uD%2Fimage.png?alt=media&#x26;token=4be4652d-8350-4ff4-9102-5d5f5df37a5f" alt=""><figcaption></figcaption></figure>

> Answer: _**show dbs**_

***

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FGbTozs4YKILHcLKk7vTM%2Fimage.png?alt=media&#x26;token=40da8303-6f98-4a1a-b01c-fae264c71986" alt=""><figcaption></figcaption></figure>

> Answer: _**show collections**_

***

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FegrR6hFkpA4qdeIDWC5Z%2Fimage.png?alt=media&#x26;token=8afd2903-cf7d-4543-9634-856f346e28e0" alt=""><figcaption></figcaption></figure>

> Answer: _**db.flag.find().pretty()**_

***

* As we found a [_MongoDB_](https://www.mongodb.com/) database service running on port 27017, I tried connecting to the service using the utility [_mongosh_](../../../database-attacks/tools-and-utilities#mongosh)_,_ and it worked successfully

{% code overflow="wrap" lineNumbers="true" %}
```bash
mongosh mongodb://10.129.1.138:27017
```
{% endcode %}

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2F4PXAEQpaZnesefXFmq1X%2Fimage.png?alt=media&#x26;token=f833b3f1-debf-4cf5-9861-cf7b5168dd3b" alt=""><figcaption></figcaption></figure>

***

* Once inside, I checked for the existing databases and noticed a suspicious database named _sensitive\_information._ I accessed it and filtered the information it contained using the keyword _flag_ and got an object that contained this parameter, letting me know the root flag

<pre class="language-mongodb" data-overflow="wrap" data-line-numbers><code class="lang-mongodb"><strong>test> show dbs
</strong><strong>test> use sensitive_information
</strong>sensitive_information> db.flag.find().pretty()
</code></pre>

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FcWS04BJ9uYr1oYaiKnOS%2Fimage.png?alt=media&#x26;token=bba90647-3732-411f-b8e1-d861465303a0" alt=""><figcaption></figcaption></figure>

***

* With this, I got the root flag and pwned the machine

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FAJNJA9zQa10PurMdoG1I%2Fimage.png?alt=media&#x26;token=4807d32b-9f75-4295-9941-054c33325e9e" alt=""><figcaption></figcaption></figure>

> Answer: _**1b6e6fb359e7c40241b6d431427ba6ea**_
