killchain-compendium/Exploits/Databases/MongoDB.md

40 lines
742 B
Markdown

# MongoDB
* The cli tool is `mongo`, there is also `mongo-sh` as an alternative
* [List Databases of the DBMS](https://www.mongodb.com/docs/manual/reference/command/listDatabases/)
## List Databases
```sh
show dbs
```
## List Collections
```sh
show collections
```
## List Content of a Collection
```sh
db.<collection>.find().pretty()
```
## List users
```sh
mongo --port <port> <database_name> --eval "db.admin.find().forEach(printjson);"
```
## Update User Password
* Generate new password via
```sh
mkpasswd -m <hash_algo> SecretPassword123
```
* Use the generated password to update a user
```sh
mongo --port <port> <database_name> --eval 'db.admin.update({"_id": ObjectID("4711")},{$set:{"x_shadow":"<generated_hash>"}})'
```