What is the CVE ID designated to the MongoDB vulnerability explained in the scenario?

Una pequeña búsqueda en Google.

What is the version of MongoDB installed on the server that the CVE exploited?

Podemos ver los logs de mongodb para encontrar la versión.

grep -m 1 --color=auto version \[root\]/var/log/mongodb/mongod.log | jq -r '.attr | .buildInfo | .version'

Analyze the MongoDB logs to identify the attacker’s remote IP address used to exploit the CVE.

Podemos filtrar los logs por números de eventos de conexión aceptada (22943) y conexión cerrada (22944) y grepear las direcciones IP unicas.

grep -E "22943|22944" \[root\]/var/log/mongodb/mongod.log | grep -oE "([0-9]{1,3}\.){3}[0-9]{1,3}" | sort -u

Based on the MongoDB logs, determine the exact date and time the attacker’s exploitation activity began (the earliest confirmed malicious event)

Grepeamos los logs buscando el primer evento de conexión aceptada y obtenemos la key $date.

grep 22943 \[root\]/var/log/mongodb/mongod.log | head -n 1 | jq -r '.t | ."$date"'

Using the MongoDB logs, calculate the total number of malicious connections initiated by the attacker.

Se pide calcular el número total de conexiones maliciosas iniciadas por el atacante pero se tiene en cuenta todo el output que tiene la IP del atacante.

grep 65.0.76.43 \[root\]/var/log/mongodb/mongod.log | wc -l

The attacker gained remote access after a series of brute‑force attempts. The attack likely exposed sensitive information, which enabled them to gain remote access. Based on the logs, when did the attacker successfully gain interactive hands-on remote access?

Revisando el archivo /var/log/auth.log encontramos una conexión por ssh que dura unos 8 minutos.

grep --color=auto 65.0.76.43 \[root\]/var/log/auth.log

2025-12-29T05:40:03.475659+00:00 ip-172-31-38-170 sshd[39962]: Accepted keyboard-interactive/pam for mongoadmin from 65.0.76.43 port 46062 ssh2
2025-12-29T05:48:28.249844+00:00 ip-172-31-38-170 sshd[40027]: Received disconnect from 65.0.76.43 port 46062:11: disconnected by user

Identify the exact command line the attacker used to execute an in‑memory script as part of their privilege‑escalation attempt.

Para saber qué comandos ejecutó el atacante podemos revisar el archivo .bash_history.

cat \[root\]/home/mongoadmin/.bash_history

The attacker was interested in a specific directory and also opened a Python web server, likely for exfiltration purposes. Which directory was the target?

Revisando el archivo .bash_history encontramos el directorio en el que el atacante levantó un servidor con Python.

cat \[root\]/home/mongoadmin/.bash_history