Port and fix MongoDB scanner modules (version/login/schemadump/hashdump)

[prithvee07]

Thank you for contributing to Metasploit Framework!

Description

Ports and fixes the MongoDB auxiliary modules originally proposed in rapid7/metasploit-framework#21785 (h00die): mongodb_version (new), mongodb_login (updated for SCRAM-SHA-1 / MongoDB 3.0+, falling back to legacy MONGODB-CR), and the new mongodb_schemadump and mongodb_hashdump modules.

I don't have push access to that upstream PR's branch, so rather than leave the review findings unactioned, this recreates the same functionality in this fork with the issues found during review fixed:

• Crashing bug: all four modules had 'Reliability' => [UNKNOWN_RELIABILITY]. UNKNOWN_RELIABILITY is already ['unknown-reliability'], so the double-nesting crashed the info command with no implicit conversion of Array into String in dump_traits. Reproduced live in msfconsole before fixing to 'Reliability' => UNKNOWN_RELIABILITY.
• Dead code: mongodb_version.rb defined a parse_doc helper that was never called; get_version duplicated the same BSON-parsing logic inline instead.
• ~250 lines of duplication: build_cmd_packet/parse_doc/parse_docs/parse_scram_payload/have_auth_error? were copy-pasted near-verbatim across mongodb_login.rb and mongodb_hashdump.rb (with subsets duplicated in mongodb_version.rb and mongodb_schemadump.rb too). Extracted the wire-protocol primitives into a new Msf::Exploit::Remote::Mongodb mixin (lib/msf/core/exploit/remote/mongodb.rb). Each module keeps its own auth-flow/reporting logic on top of it, since those differ enough (SCRAM step counts, whether creds get reported, return value semantics) that unifying them risked changing tested behavior.
• Typo: "Sccuessfully tested" → "Successfully tested" in mongodb_schemadump.rb's description.
• Cracker-format gap: mongodb_hashdump.rb stores credentials with jtr_format 'mongodb-scram-sha1'/'mongodb-scram-sha256', but neither format is registered in cracker.rb's jtr_format_to_hashcat_format table or crack_databases.rb's format list, so Metasploit's own analyze modules won't select them for cracking despite the hashes being correctly formatted for external hashcat use (modes 24100/24200). Documented this limitation directly in the module description rather than attempting an unverified extension of the cracking pipeline.
• Missing trailing newlines in 3 of 4 documentation markdown files, which fails tools/dev/msftidy_docs.rb.

Breaking Changes

None.

Reviewer Notes

Start with lib/msf/core/exploit/remote/mongodb.rb — the shared mixin all four modules include. Then each module file mainly differs in its higher-level flow (dump_system_users/dump_app_users for hashdump, schema sampling for schemadump, brute-force login for login, single version lookup for version).

Verification Steps

1. • bundle exec rubocop lib/msf/core/exploit/remote/mongodb.rb modules/auxiliary/scanner/mongodb/mongodb_{version,login,schemadump,hashdump}.rb — expect no offenses.
2. • ruby tools/dev/msftidy.rb modules/auxiliary/scanner/mongodb/mongodb_{version,login,schemadump,hashdump}.rb — expect no offenses.
3. • ruby tools/dev/msftidy_docs.rb documentation/modules/auxiliary/scanner/mongodb/mongodb_{version,login,schemadump,hashdump}.md — expect no offenses.
4. • In msfconsole: use auxiliary/scanner/mongodb/mongodb_version (repeat for login, schemadump, hashdump) then info — expect no load errors and correct rendering of Module reliability/stability/side effects (this is the regression check for the Reliability crash).
5. • Against a MongoDB 3.6+ instance (see module docs for Docker Compose setup): mongodb_version reports the version; mongodb_login brute-forces/reports no-auth or valid creds; mongodb_schemadump dumps inferred schema to loot; mongodb_hashdump dumps system.users hashes and stores them as nonreplayable_hash credentials.

Test Evidence

Verified the new mixin's wire-protocol logic directly (packet header construction, single/multi BSON document parsing, SCRAM payload parsing, auth-error detection) with round-trip unit checks against synthetic MongoDB wire-protocol byte sequences — all passed.

Reproduced the Reliability crash before the fix:

[-] Error while running command info: no implicit conversion of Array into String
    .../lib/msf/base/serializer/readable_text.rb:258:in `+'
    .../lib/msf/base/serializer/readable_text.rb:258:in `block in dump_traits'

Confirmed clean after the fix — all four modules load and info renders correctly:

Module reliability:
 unknown-reliability

Environment

Field	Details
Operating System	Ubuntu 24.04 (container)
Target Software/Hardware	MongoDB 3.6.x (per module docs' Docker Compose setup)

AI Usage Disclosure

This PR was authored by Claude (Anthropic) working in Claude Code: reviewing the original upstream PR's diff, identifying the crashing bug and duplication, extracting the shared mixin, porting all four modules, and writing/running the verification above. A human directed and reviewed the work. The original module logic (wire protocol construction, SCRAM-SHA-1/MONGODB-CR auth flows) originates from h00die's upstream PR rapid7#21785, which itself disclosed AI assistance (Gemini for schemadump/login updates, GLM-4.7 for version/hashdump) with human verification.

Pre-Submission Checklist

• Included a corresponding documentation markdown file in documentation/modules for each module
• No sensitive information (IP addresses, credentials, API keys, hashes) in code or documentation
• Read the CONTRIBUTING.md and module acceptance guidelines