# 默认端口（27017）
python scanner.py -t 192.168.1.100

# 自定义端口
python scanner.py -t 192.168.1.100:27018

# 逗号分隔
python scanner.py -t 192.168.1.100,192.168.1.101:27018,db.example.com

# targets.txt（每行一个， # 表示注释）
# 192.168.1.100
# 192.168.1.101:27018
# mongodb.example.com

python scanner.py -f targets.txt

# 纯文本
python scanner.py -t 192.168.1.100 -o report.txt

# JSON（详细）
python scanner.py -t 192.168.1.100 -o report.json

# CSV（电子表格）
python scanner.py -t 192.168.1.100 -o report.csv

+================================================================+
|     MongoBleed Scanner v1.3.0                                  |
|     CVE-2025-14847 - MongoDB Memory Leak Vulnerability         |
+================================================================+
|  LEGAL: Authorized security testing only. Obtain permission    |
|         before scanning systems you do not own.                |
+================================================================+

[*] Loaded 4 target(s)

SCAN RESULTS:
----------------------------------------------------------------------
  [!] 192.168.1.100:27017       VULNERABLE  v8.0.16  zlib:ON  -> Update to 8.0.17
  [?!] 192.168.1.101:27018      POSSIBLY VULNERABLE  v~8.2.x  zlib:ON  -> Check version, update to 8.2.3
  [+] 192.168.1.102:27017       SAFE        v8.0.17  zlib:ON
  [~] 192.168.1.103:27017       MITIGATED   v8.0.16  zlib:OFF  (zlib disabled)

======================================================================
  SCAN SUMMARY
======================================================================
  Total targets scanned:  4
  Reachable:              4
  Unreachable:            0
----------------------------------------------------------------------
  [!]  VULNERABLE:        1
  [?!] POSSIBLY VULN:     1  (version estimated, needs verification)
  [+]  SAFE (patched):    1
  [~]  MITIGATED:         1  (vulnerable version but zlib disabled)
  [?]  UNKNOWN:           0
======================================================================

  VULNERABLE TARGETS REQUIRING IMMEDIATE ACTION:
----------------------------------------------------------------------
    192.168.1.100:27017  v8.0.16  zlib:ON  -> Upgrade to 8.0.17

1. TCP 连接
   └── 连接到 MongoDB 端口

2. 版本检测
   ├── 发送 'hello' 命令（获取线缆版本，无需认证）
   └── 发送 'buildInfo' 命令（获取确切版本，可能需要认证）

3. 压缩检查
   └── 发送 zlib 压缩的消息，检查服务器是否接受

4. 评估
   └── 将版本 + zlib 状态与漏洞数据库进行比较

VULNERABLE = (version in vulnerable range) AND (zlib enabled)
MITIGATED  = (version in vulnerable range) AND (zlib disabled)
SAFE       = (version >= fixed version)

# mongod.conf
net:
  compression:
    compressors: snappy,zstd  # 移除 'zlib'

mongod --networkMessageCompressors snappy,zstd

THIS TOOL IS PROVIDED FOR AUTHORIZED SECURITY TESTING ONLY.

You must obtain proper authorization before scanning any systems
you do not own or have explicit written permission to test.

Unauthorized access to computer systems is illegal.

The authors assume no liability for misuse of this tool.

python scanner.py -t mongodb.example.com
if [ $? -eq 2 ]; then
    echo "ALERT: Vulnerable MongoDB detected!"
fi