小M-Quartz

【弱密码】MongoDB

7分钟阅读

概述：MongoDB 及其弱密码研究整理

0x02下载安装

下载地址：Install MongoDB Community Kubernetes Operator | MongoDB

安装文档：Install MongoDB Community Edition on Windows — MongoDB Manual

从二进制文件安装

For command line options invoke:

$ ./mongod --help

To run a single server database:

$ sudo mkdir -p /data/db
$ ./mongod
$
$ # The mongo javascript shell connects to localhost and test database by default:
$ ./mongo
> help

安装为 windows 服务

  1. 创建数据目录和日志目录

  2. 安装为服务

    # 安装服务
mongod --dbpath C:\MongoDB\mongodb-win32-x86_64-windows-7.0.4\bin\data\db --logpath C:\MongoDB\mongodb-win32-x86_64-windows-7.0.4\bin\log\mongod.log --install --serviceName "MongoDB 7.0.4"
 
# 启动服务
net start "MongoDB 7.0.4"

shell

MongoDB 的 shell 执行需要单独下载 Monogosh 。只要安装了 MongoDB 服务就可以运行 Monogosh 中 bin目录下的 monogosh.exe 连接即可。

# 直接运行 mongosh 会连接到默认的数据库
 
# 查看数据库
show dbs
 
# 登录
db.auth('admin','123456')

0x02 用户密码相关

参考文章：MongoDB设置登录账号和密码_mongodb创建用户名和密码-CSDN博客

0x03 创建数据库及用户

# 创建集合
use shiyanlou
 
# 插入数据
db.test1.insertOne(
... {name: 'Kobe', age: 39, addr: ['Los', 'Tor']}
... )
 
# 创建用户
use shiyanlou  // 跳转到需要添加用户的数据库
 
db.createUser({
  user: 'tao',          // 用户名
  pwd: 'Abc123++',      // 密码
  roles:[{
    role: 'readWrite',  // 读写权限角色
    db: 'myMongoDB'     // 数据库名
  }]
})
 
 
# 查询数据
> show dbs
admin      0.000GB
config     0.000GB
local      0.000GB
shiyanlou  0.000GB
> show collections
player
> db.player.find()
{ "_id" : ObjectId("5e4b6d358b5daaaae4d74f88"), "name" : "James", "age" : 33, "addr" : [ "Mim", "Cle" ] }
{ "_id" : ObjectId("5e4b6d358b5daaaae4d74f89"), "name" : "Wade", "age" : 34, "addr" : [ "Mim", "Chi" ] }
{ "_id" : ObjectId("5e4b6d358b5daaaae4d74f8a"), "name" : "Curry", "age" : 35, "addr" : [ "Gsw" ] }
>

用户角色

角色描述角色标识
数据库用户角色read、readWrite
数据库管理角色dbAdmin、dbOwner、userAdmin
集群管理角色clusterAdmin、clusterManager、clusterMonitor、hostManager
备份恢复角色backup、restore
所有数据库角色readAnyDatabase、readWriteAnyDatabase、userAdminAnyDatabase、 dbAdminAnyDatabase
超级用户角色root

查看用户

MongoDB 查看所有用户账号信息_mongodb查看用户-CSDN博客

  1. 查看全局所有用户

    >  use admin
switched to db admin
> db.auth('admin','123456')
1
> db.system.users.find().pretty()

  2. 查看当前数据库

    > use admin
switched to db admin
> show users

  3. 注销当前用户

    db.runCommand( { logout: 1 } )

登录流程

[0x0]   mongod!mongo::AuthCounter::getMechanismCounter   0x8c032fca08   0x7ff7c058c2a6   
[0x1]   mongod!mongo::AuthenticationSession::setMechanismName+0x1f6   0x8c032fca10   0x7ff7bfd143d2   
[0x2]   mongod!mongo::auth::`anonymous namespace'::runSaslStart+0x1f2   0x8c032fcc30   0x7ff7bfd1281a   
[0x3]   mongod!mongo::doSpeculativeSaslStart::__l3::<lambda_1>::operator()+0x93   0x8c032fcd90   0x7ff7bfd1407f   
[0x4]   mongod!mongo::AuthenticationSession::doStep<`mongo::doSpeculativeSaslStart'::`3'::<lambda_1> >+0xda   0x8c032fcd90   0x7ff7bfd1407f   
[0x5]   mongod!mongo::doSpeculativeSaslStart+0x46f   0x8c032fcfa0   0x7ff7bfc639d2   
[0x6]   mongod!mongo::handleHelloAuth+0x312   0x8c032fd0b0   0x7ff7bfc60b4d   
[0x7]   mongod!mongo::repl::`anonymous namespace'::CmdHello::runWithReplyBuilder+0x118d   0x8c032fd200   0x7ff7c18acf57   
[0x8]   mongod!mongo::BasicCommandWithReplyBuilderInterface::Invocation::run+0x107   0x8c032fde70   0x7ff7c18a57e5   
[0x9]   mongod!mongo::CommandHelpers::runCommandInvocation+0x3e   0x8c032fdfa0   0x7ff7c18ad888   
[0xa]   mongod!mongo::CommandHelpers::runCommandInvocation::__l4::<lambda_1>::operator()+0xc9   0x8c032fdfa0   0x7ff7c18ad888   
[0xb]   mongod!mongo::makeReadyFutureWith<`mongo::CommandHelpers::runCommandInvocation'::`4'::<lambda_1> >+0xe5   0x8c032fdfa0   0x7ff7c18ad888   
[0xc]   mongod!mongo::CommandHelpers::runCommandInvocation+0x68   0x8c032fe020   0x7ff7bfbe6bfe   
[0xd]   mongod!mongo::`anonymous namespace'::runCommandInvocation+0xae   0x8c032fe0b0   0x7ff7bfbd3836   
[0xe]   mongod!`mongo::`anonymous namespace'::InvokeCommand::run'::`2'::<lambda_1>::operator()+0x2a6   0x8c032fe130   0x7ff7bfbcbd2b   
[0xf]   mongod!mongo::makeReadyFutureWith<`mongo::`anonymous namespace'::InvokeCommand::run'::`2'::<lambda_1> >+0x1b   0x8c032fe260   0x7ff7bfbe6816   
[0x10]   mongod!mongo::`anonymous namespace'::InvokeCommand::run+0x46   0x8c032fe2a0   0x7ff7bfbcbb07   
[0x11]   mongod!mongo::`anonymous-namespace'::RunCommandImpl::_runCommand::__l7::<lambda_2>::operator()+0x10   0x8c032fe350   0x7ff7bfbdef39   
[0x12]   mongod!mongo::future_util::AsyncState<mongo::`anonymous namespace'::InvokeCommand>::thenWithState::__l2::<lambda_1>::operator()+0x14   0x8c032fe350   0x7ff7bfbdef39   
[0x13]   mongod!mongo::makeReadyFutureWith<`mongo::future_util::AsyncState<mongo::`anonymous namespace'::InvokeCommand>::thenWithState<`mongo::`anonymous namespace'::RunCommandImpl::_runCommand'::`7'::<lambda_2> >'::`2'::<lambda_1> >+0x47   0x8c032fe350   0x7ff7bfbdef39   
[0x14]   mongod!mongo::future_util::AsyncState<mongo::`anonymous namespace'::InvokeCommand>::thenWithState+0x4c   0x8c032fe450   0x7ff7bfbdf86d   
[0x15]   mongod!mongo::`anonymous namespace'::RunCommandImpl::_runCommand+0x179   0x8c032fe450   0x7ff7bfbdf86d   
[0x16]   mongod!mongo::`anonymous namespace'::RunCommandImpl::_runImpl+0x7d   0x8c032fe530   0x7ff7bfbcbd69   
[0x17]   mongod!mongo::`anonymous-namespace'::RunCommandImpl::run::__l2::<lambda_1>::operator()+0x14   0x8c032fe590   0x7ff7bfbe69b5   
[0x18]   mongod!mongo::makeReadyFutureWith<`mongo::`anonymous namespace'::RunCommandImpl::run'::`2'::<lambda_1> >+0x29   0x8c032fe590   0x7ff7bfbe69b5   
[0x19]   mongod!mongo::`anonymous namespace'::RunCommandImpl::run+0x45   0x8c032fe5d0   0x7ff7bfbcb927   
[0x1a]   mongod!mongo::`anonymous-namespace'::ExecCommandDatabase::_commandExec::__l2::<lambda_1>::()::__l7::<lambda_2>::operator()+0x10   0x8c032fe6c0   0x7ff7bfbd240f   
[0x1b]   mongod!mongo::future_util::AsyncState<mongo::`anonymous namespace'::RunCommandImpl>::thenWithState::__l2::<lambda_1>::operator()+0x14   0x8c032fe6c0   0x7ff7bfbd240f   
[0x1c]   mongod!mongo::makeReadyFutureWith<`mongo::future_util::AsyncState<mongo::`anonymous namespace'::RunCommandImpl>::thenWithState<``mongo::`anonymous namespace'::ExecCommandDatabase::_commandExec'::`2'::<lambda_1>::operator()'::`7'::<lambda_2> >'::`2'::<lambda_1> >+0x47   0x8c032fe6c0   0x7ff7bfbd240f   
[0x1d]   mongod!mongo::future_util::AsyncState<mongo::`anonymous namespace'::RunCommandImpl>::thenWithState+0x48   0x8c032fe7c0   0x7ff7bfbda36f   
[0x1e]   mongod!`mongo::`anonymous namespace'::ExecCommandDatabase::_commandExec'::`2'::<lambda_1>::operator()+0x21f   0x8c032fe7c0   0x7ff7bfbda36f   
[0x1f]   mongod!mongo::`anonymous namespace'::ExecCommandDatabase::_commandExec+0x15f   0x8c032fe8b0   0x7ff7bfbcbcf8   
[0x20]   mongod!mongo::`anonymous-namespace'::ExecCommandDatabase::run::__l2::<lambda_1>::operator()+0x13   0x8c032fea20   0x7ff7bfbd15d9   
[0x21]   mongod!mongo::makeReadyFutureWith<`mongo::`anonymous namespace'::ExecCommandDatabase::run'::`2'::<lambda_1> >+0x28   0x8c032fea20   0x7ff7bfbd15d9   
[0x22]   mongod!mongo::`anonymous-namespace'::ExecCommandDatabase::run+0x17   0x8c032fea60   0x7ff7bfbcb50b   
[0x23]   mongod!mongo::`anonymous-namespace'::executeCommand::__l2::<lambda_2>::()::__l2::<lambda_1>::operator()+0x17   0x8c032fea60   0x7ff7bfbcb50b   
[0x24]   mongod!`mongo::future_util::AsyncState<mongo::`anonymous namespace'::ExecCommandDatabase>::thenWithState<``mongo::`anonymous namespace'::executeCommand'::`2'::<lambda_2>::operator()'::`2'::<lambda_1> >'::`2'::<lambda_1>::operator()+0x49   0x8c032fea60   0x7ff7bfbcb50b   
[0x25]   mongod!mongo::makeReadyFutureWith<`mongo::future_util::AsyncState<mongo::`anonymous namespace'::ExecCommandDatabase>::thenWithState<``mongo::`anonymous namespace'::executeCommand'::`2'::<lambda_2>::operator()'::`2'::<lambda_1> >'::`2'::<lambda_1> >+0x1b   0x8c032feb90   0x7ff7bfbcc4b6   
[0x26]   mongod!mongo::future_util::AsyncState<mongo::`anonymous namespace'::ExecCommandDatabase>::thenWithState+0x59   0x8c032febd0   0x7ff7bfbd208f   
[0x27]   mongod!mongo::`anonymous-namespace'::executeCommand::__l2::<lambda_2>::operator()+0x64   0x8c032febd0   0x7ff7bfbd208f   
[0x28]   mongod!mongo::future_details::call+0x64   0x8c032febd0   0x7ff7bfbd208f   
[0x29]   mongod!mongo::future_details::throwingCall<`mongo::`anonymous namespace'::executeCommand'::`2'::<lambda_2> &,mongo::future_details::FakeVoid>+0x76   0x8c032febd0   0x7ff7bfbd208f   
[0x2a]   mongod!``mongo::future_details::FutureImpl<mongo::future_details::FakeVoid>::then<mongo::CleanupFuturePolicy<0>,`mongo::`anonymous namespace'::executeCommand'::`2'::<lambda_2> >'::`7'::<lambda_3>::operator()'::`2'::<lambda_1>::operator()+0x5f   0x8c032fec30   0x7ff7bfbb191a   
[0x2b]   mongod!mongo::unique_function<void __cdecl(mongo::future_details::SharedStateBase *)>::operator()+0x14   0x8c032fecc0   0x7ff7bfbc8870   
[0x2c]   mongod!mongo::future_details::SharedStateBase::transitionToFinished+0x3a   0x8c032fecc0   0x7ff7bfbc8870   
[0x2d]   mongod!mongo::future_details::FutureImpl<mongo::future_details::FakeVoid>::propagateResultTo::__l2::<lambda_1>::operator()+0x10   0x8c032fecf0   0x7ff7bfbd1eea   
[0x2e]   mongod!mongo::future_details::FutureImpl<mongo::future_details::FakeVoid>::generalImpl<`mongo::future_details::FutureImpl<mongo::future_details::FakeVoid>::propagateResultTo'::`2'::<lambda_1>,`mongo::future_details::FutureImpl<mongo::future_details::FakeVoid>::propagateResultTo'::`2'::<lambda_2>,`mongo::future_details::FutureImpl<mongo::future_details::FakeVoid>::propagateResultTo'::`2'::<lambda_3> >+0x30   0x8c032fecf0   0x7ff7bfbd1eea   
[0x2f]   mongod!mongo::future_details::FutureImpl<mongo::future_details::FakeVoid>::propagateResultTo+0x41   0x8c032fed30   0x7ff7bfbb191a   
[0x30]   mongod!mongo::SemiFuture<void>::propagateResultTo+0x46   0x8c032fed30   0x7ff7bfbb191a   
[0x31]   mongod!``mongo::future_details::FutureImpl<mongo::future_details::FakeVoid>::then<mongo::CleanupFuturePolicy<0>,`mongo::`anonymous namespace'::executeCommand'::`2'::<lambda_1> >'::`7'::<lambda_3>::operator()'::`2'::<lambda_1>::operator()+0x9a   0x8c032fed30   0x7ff7bfbb191a   
[0x32]   mongod!mongo::unique_function<void __cdecl(mongo::future_details::SharedStateBase *)>::operator()+0x14   0x8c032fedc0   0x7ff7bfbe2c93   
[0x33]   mongod!mongo::future_details::SharedStateBase::transitionToFinished+0x3a   0x8c032fedc0   0x7ff7bfbe2c93   
[0x34]   mongod!mongo::Promise<void>::emplaceValue::__l2::<lambda_1>::operator()+0x8   0x8c032fedf0   0x7ff7bfbd4219   
[0x35]   mongod!mongo::Promise<void>::setImpl+0x19   0x8c032fedf0   0x7ff7bfbd4219   
[0x36]   mongod!mongo::Promise<void>::emplaceValue+0x19   0x8c032fedf0   0x7ff7bfbd4219   
[0x37]   mongod!mongo::`anonymous namespace'::executeCommand+0x353   0x8c032fedf0   0x7ff7bfbd4219   
[0x38]   mongod!mongo::`anonymous-namespace'::receivedCommands::__l2::<lambda_1>::operator()+0x27   0x8c032fefc0   0x7ff7bfbca28b   
[0x39]   mongod!mongo::future_details::call+0x27   0x8c032fefc0   0x7ff7bfbca28b   
[0x3a]   mongod!mongo::future_details::throwingCall+0x27   0x8c032fefc0   0x7ff7bfbca28b   
[0x3b]   mongod!`mongo::future_details::FutureImpl<mongo::future_details::FakeVoid>::then<mongo::CleanupFuturePolicy<0>,`mongo::`anonymous namespace'::receivedCommands'::`2'::<lambda_1> >'::`7'::<lambda_1>::operator()+0x49   0x8c032fefc0   0x7ff7bfbca28b   
[0x3c]   mongod!mongo::future_details::FutureImpl<mongo::future_details::FakeVoid>::generalImpl<`mongo::future_details::FutureImpl<mongo::future_details::FakeVoid>::then<mongo::CleanupFuturePolicy<0>,`mongo::`anonymous namespace'::receivedCommands'::`2'::<lambda_1> >'::`7'::<lambda_1>,`mongo::future_details::FutureImpl<mongo::future_details::FakeVoid>::then<mongo::CleanupFuturePolicy<0>,`mongo::`anonymous namespace'::receivedCommands'::`2'::<lambda_1> >'::`7'::<lambda_2>,`mongo::future_details::FutureImpl<mongo::future_details::FakeVoid>::then<mongo::CleanupFuturePolicy<0>,`mongo::`anonymous namespace'::receivedCommands'::`2'::<lambda_1> >'::`7'::<lambda_3> >+0x3b   0x8c032ff040   0x7ff7bfbe5cf0   
[0x3d]   mongod!mongo::future_details::FutureImpl<mongo::future_details::FakeVoid>::then+0x34   0x8c032ff0a0   0x7ff7bfbe67be   
[0x3e]   mongod!mongo::Future<void>::then+0x34   0x8c032ff0a0   0x7ff7bfbe67be   
[0x3f]   mongod!mongo::Future<void>::then+0x34   0x8c032ff0a0   0x7ff7bfbe67be   
[0x40]   mongod!mongo::`anonymous namespace'::receivedCommands+0x190   0x8c032ff0a0   0x7ff7bfbe67be   
[0x41]   mongod!mongo::`anonymous namespace'::CommandOpRunner::run+0x3e   0x8c032ff250   0x7ff7bfbe39df   
[0x42]   mongod!mongo::ServiceEntryPointCommon::handleRequest+0x2cf   0x8c032ff2a0   0x7ff7bfbc5c89   
[0x43]   mongod!mongo::ServiceEntryPointMongod::handleRequest+0x49   0x8c032ff4e0   0x7ff7c065fb9f   
[0x44]   mongod!mongo::transport::SessionWorkflow::Impl::_dispatchWork+0x21f   0x8c032ff510   0x7ff7c065de9a   
[0x45]   mongod!mongo::transport::SessionWorkflow::Impl::_doOneIteration::__l2::<lambda_1>::operator()+0x2d   0x8c032ff5a0   0x7ff7c065ebc4   
[0x46]   mongod!mongo::future_details::call+0x3f   0x8c032ff5a0   0x7ff7c065ebc4   
[0x47]   mongod!mongo::future_details::throwingCall<`mongo::transport::SessionWorkflow::Impl::_doOneIteration'::`2'::<lambda_1> &,std::unique_ptr<mongo::transport::SessionWorkflow::Impl::WorkItem,std::default_delete<mongo::transport::SessionWorkflow::Impl::WorkItem> > >+0x5a   0x8c032ff5a0   0x7ff7c065ebc4   
[0x48]   mongod!`mongo::future_details::FutureImpl<std::unique_ptr<mongo::transport::SessionWorkflow::Impl::WorkItem,std::default_delete<mongo::transport::SessionWorkflow::Impl::WorkItem> > >::then<mongo::CleanupFuturePolicy<0>,`mongo::transport::SessionWorkflow::Impl::_doOneIteration'::`2'::<lambda_1> >'::`7'::<lambda_1>::operator()+0x34   0x8c032ff5f0   0x7ff7c065d839   
[0x49]   mongod!mongo::future_details::FutureImpl<std::unique_ptr<mongo::transport::SessionWorkflow::Impl::WorkItem,std::default_delete<mongo::transport::SessionWorkflow::Impl::WorkItem> > >::generalImpl<`mongo::future_details::FutureImpl<std::unique_ptr<mongo::transport::SessionWorkflow::Impl::WorkItem,std::default_delete<mongo::transport::SessionWorkflow::Impl::WorkItem> > >::then<mongo::CleanupFuturePolicy<0>,`mongo::transport::SessionWorkflow::Impl::_doOneIteration'::`2'::<lambda_1> >'::`7'::<lambda_1>,`mongo::future_details::FutureImpl<std::unique_ptr<mongo::transport::SessionWorkflow::Impl::WorkItem,std::default_delete<mongo::transport::SessionWorkflow::Impl::WorkItem> > >::then<mongo::CleanupFuturePolicy<0>,`mongo::transport::SessionWorkflow::Impl::_doOneIteration'::`2'::<lambda_1> >'::`7'::<lambda_2>,`mongo::future_details::FutureImpl<std::unique_ptr<mongo::transport::SessionWorkflow::Impl::WorkItem,std::default_delete<mongo::transport::SessionWorkflow::Impl::WorkItem> > >::then<mongo::CleanupFuturePolicy<0>,`mongo::transport::SessionWorkflow::Impl::_doOneIteration'::`2'::<lambda_1> >'::`7'::<lambda_3> >+0x129   0x8c032ff690   0x7ff7c065fcbb   
[0x4a]   mongod!mongo::future_details::FutureImpl<std::unique_ptr<mongo::transport::SessionWorkflow::Impl::WorkItem,std::default_delete<mongo::transport::SessionWorkflow::Impl::WorkItem> > >::then+0x3e   0x8c032ff750   0x7ff7c065e8dd   
[0x4b]   mongod!mongo::Future<std::unique_ptr<mongo::transport::SessionWorkflow::Impl::WorkItem,std::default_delete<mongo::transport::SessionWorkflow::Impl::WorkItem> > >::then+0x3e   0x8c032ff750   0x7ff7c065e8dd   
[0x4c]   mongod!mongo::Future<std::unique_ptr<mongo::transport::SessionWorkflow::Impl::WorkItem,std::default_delete<mongo::transport::SessionWorkflow::Impl::WorkItem> > >::then+0x3e   0x8c032ff750   0x7ff7c065e8dd   
[0x4d]   mongod!mongo::transport::SessionWorkflow::Impl::_doOneIteration+0x7b   0x8c032ff750   0x7ff7c065e8dd   
[0x4e]   mongod!`mongo::transport::SessionWorkflow::Impl::_scheduleIteration'::`3'::<lambda_1>::operator()+0xad   0x8c032ff880   0x7ff7c0660ac1   
[0x4f]   mongod!`mongo::unique_function<void __cdecl(mongo::Status)>::makeImpl<`mongo::transport::SessionWorkflow::Impl::_scheduleIteration'::`3'::<lambda_1> >'::`2'::SpecificImpl::call+0x21   0x8c032ff930   0x7ff7c065e72d   
[0x50]   mongod!mongo::unique_function<void __cdecl(mongo::Status)>::operator()+0x18   0x8c032ff960   0x7ff7c06609d1   
[0x51]   mongod!mongo::transport::SessionWorkflow::Impl::_captureContext::__l2::<lambda_1>::()::__l2::<lambda_1>::operator()+0x39   0x8c032ff960   0x7ff7c06609d1   
[0x52]   mongod!mongo::ClientStrand::run+0x6f   0x8c032ff960   0x7ff7c06609d1   
[0x53]   mongod!`mongo::transport::SessionWorkflow::Impl::_captureContext'::`2'::<lambda_1>::operator()+0x8d   0x8c032ff960   0x7ff7c06609d1   
[0x54]   mongod!`mongo::unique_function<void __cdecl(mongo::Status)>::makeImpl<`mongo::transport::SessionWorkflow::Impl::_captureContext'::`2'::<lambda_1> >'::`2'::SpecificImpl::call+0x21   0x8c032ff9b0   0x7ff7c18b040a   
[0x55]   mongod!mongo::unique_function<void __cdecl(mongo::Status)>::operator()+0x18   0x8c032ff9e0   0x7ff7c18afa32   
[0x56]   mongod!mongo::transport::ServiceExecutorSynchronous::SharedState::WorkerThreadInfo::run+0x62   0x8c032ff9e0   0x7ff7c18afa32   
[0x57]   mongod!`mongo::transport::ServiceExecutorSynchronous::SharedState::schedule'::`2'::<lambda_2>::operator()+0xca   0x8c032ff9e0   0x7ff7c18afa32   
[0x58]   mongod!mongo::unique_function<void __cdecl(void)>::operator()+0xf   0x8c032ffa30   0x7ffc64bc9363   
[0x59]   mongod!mongo::transport::launchServiceWorkerThread::__l3::<lambda_1>::operator()+0xf   0x8c032ffa30   0x7ffc64bc9363   
[0x5a]   mongod!std::invoke+0xf   0x8c032ffa30   0x7ffc64bc9363   
[0x5b]   mongod!std::_Apply_impl+0xf   0x8c032ffa30   0x7ffc64bc9363   
[0x5c]   mongod!std::apply+0xf   0x8c032ffa30   0x7ffc64bc9363   
[0x5d]   mongod!mongo::stdx::thread::{ctor}::__l1::<lambda_4_>::operator()+0x29   0x8c032ffa30   0x7ffc64bc9363   
[0x5e]   mongod!std::invoke+0x29   0x8c032ffa30   0x7ffc64bc9363   
[0x5f]   mongod!std::thread::_Invoke<std::tuple<`mongo::stdx::thread::thread<`mongo::transport::launchServiceWorkerThread'::`3'::<lambda_1>,0>'::`1'::<lambda_4_> >,0>+0x32   0x8c032ffa30   0x7ffc64bc9363   
[0x60]   ucrtbase!thread_start<unsigned int (__cdecl*)(void *),1>+0x93   0x8c032ffa60   0x7ffc65a3257d   
[0x61]   KERNEL32!BaseThreadInitThunk+0x1d   0x8c032ffa90   0x7ffc66fcaa58   
[0x62]   ntdll!RtlUserThreadStart+0x28   0x8c032ffac0   0x0

二进制文件分析

数据库用户

二进制文件

_mdb_catalog.wt

该文件指明了系统的相关集合保存在哪个文件中，以 admin.system.users 为例，其保存的 Bson 转为 Json 的数据内容如下所示，ident 为保存的文件名。

{
    "ident": "collection-0--3024240359348764740",
    "idxIdent": {
        "_id_": "index-1--3024240359348764740",
        "user_1_db_1": "index-2--3024240359348764740"
    },
    "md": {
        "indexes": [
            {
                "backgroundSecondary": false,
                "head": 0,
                "multikey": false,
                "multikeyPaths": {
                    "_id": "00"
                },
                "ready": true,
                "spec": {
                    "key": {
                        "_id": 1
                    },
                    "name": "_id_",
                    "v": 2
                }
            },
            {
                "backgroundSecondary": false,
                "head": 0,
                "multikey": false,
                "multikeyPaths": {
                    "db": "00",
                    "user": "00"
                },
                "ready": true,
                "spec": {
                    "key": {
                        "db": 1,
                        "user": 1
                    },
                    "name": "user_1_db_1",
                    "unique": true,
                    "v": 2
                }
            }
        ],
        "ns": "admin.system.users",
        "options": {
            "uuid": "b39f471c8ebe4eae8af34222cd30515e"
        }
    },
    "ns": "admin.system.users"
}

collection-0—*.wt

  1. MongoDB 的 用户数据保存在 collection-0--*.wt 文件中，如果数据库没有用户，则不存在这个文件。
  2. collection-0--*.wt 文件的 0x1000 和 0x5000 偏移处保存了用户相关数据，别的文件也基本都是

关系图谱

反向链接