diff --git a/plugins/services/mongodb.go b/plugins/services/mongodb.go index 63d133e..8b43d4d 100644 --- a/plugins/services/mongodb.go +++ b/plugins/services/mongodb.go @@ -39,15 +39,15 @@ func (p *MongoDBPlugin) Scan(ctx context.Context, info *common.HostInfo) *ScanRe } } - for _, cred := range credentials { - if p.testCredential(ctx, info, cred) { - common.LogSuccess(fmt.Sprintf("MongoDB %s %s:%s", target, cred.Username, cred.Password)) - return &ScanResult{ - Success: true, - Service: "mongodb", - Username: cred.Username, - Password: cred.Password, - } + // 优化:只测试一次连接,检查是否允许无认证访问 + if p.testUnauthenticatedAccess(ctx, info) { + common.LogSuccess(fmt.Sprintf("MongoDB %s 无认证访问", target)) + return &ScanResult{ + Success: true, + Service: "mongodb", + Username: "", + Password: "", + Banner: "无认证访问", } } @@ -61,6 +61,11 @@ func (p *MongoDBPlugin) Scan(ctx context.Context, info *common.HostInfo) *ScanRe func (p *MongoDBPlugin) testCredential(ctx context.Context, info *common.HostInfo, cred Credential) bool { + // 这个方法现在不使用,保留以防向后兼容 + return p.testUnauthenticatedAccess(ctx, info) +} + +func (p *MongoDBPlugin) testUnauthenticatedAccess(ctx context.Context, info *common.HostInfo) bool { target := fmt.Sprintf("%s:%s", info.Host, info.Ports) timeout := time.Duration(common.Timeout) * time.Second @@ -147,6 +152,8 @@ func (p *MongoDBPlugin) identifyService(ctx context.Context, info *common.HostIn defer conn.Close() conn.SetDeadline(time.Now().Add(timeout)) + + // 简化识别逻辑:先尝试基础查询,失败则使用端口推断 if p.testBasicQuery(conn) { banner := "MongoDB" common.LogSuccess(fmt.Sprintf("MongoDB %s %s", target, banner)) @@ -156,11 +163,22 @@ func (p *MongoDBPlugin) identifyService(ctx context.Context, info *common.HostIn Banner: banner, } } + + // 如果查询失败但能建立TCP连接,且是MongoDB默认端口,推断为MongoDB + if info.Ports == "27017" || info.Ports == "27018" || info.Ports == "27019" { + banner := "MongoDB (端口推断)" + common.LogSuccess(fmt.Sprintf("MongoDB %s %s", target, banner)) + return &ScanResult{ + Success: true, + Service: "mongodb", + Banner: banner, + } + } return &ScanResult{ Success: false, Service: "mongodb", - Error: fmt.Errorf("无法识别为MongoDB服务"), + Error: fmt.Errorf("无法识别为MongoDB服务: 连接成功但协议查询失败"), } }