killchain-compendium/Exploits/Databases/MongoDB.md

MongoDB

• The cli tool is mongo, there is also mongo-sh as an alternative
• List Databases of the DBMS

List Databases

show dbs

List Collections

show collections

List Content of a Collection

db.<collection>.find().pretty()

List users

mongo --port <port> <database_name> --eval "db.admin.find().forEach(printjson);"

Update User Password

• Generate new password via

mkpasswd -m <hash_algo> SecretPassword123

• Use the generated password to update a user

mongo --port <port> <database_name> --eval 'db.admin.update({"_id": ObjectID("4711")},{$set:{"x_shadow":"<generated_hash>"}})'