☰

Windows 10 上托管的 MongoDB 数据库被盗了。我能找到连接的计算机的 IP 地址吗？

tag-icon • tag-icon networking
Windows 10 上托管的 MongoDB 数据库被盗了。我能找到连接的计算机的 IP 地址吗？

在此处输入图片描述 这是我在唤醒计算机后看到的消息

我能找出连接并窃取数据库的计算机的 IP 地址吗？Windows 10 是否保留最近连接的日志？

更新：我检查了路由器日志，这个 IP 地址在日志中重复了几次：82.211.191.129。我用 替换了我的 IP 地址$MY_IP_ADDRESS。

  5days, 10:22:28, DHCPC: Recv OFFER from server 82.211.191.129 with ip $MY_IP_ADDRESS.
  5days, 10:22:28, DHCPC: Send REQUEST to server 82.211.191.129 with request ip $MY_IP_ADDRESS.
  1days, 07:37:18, DHCPC: eth1 set ip $MY_IP_ADDRESS mask 255.255.255.192 gateway 82.211.191.129.

有人能简单解释一下这些日志是什么意思吗？我不知道我在看什么。

更新 #2：在mongod.log文件中，我发现这个 193.118.53.138 ip 地址已连接到数据库。我谷歌了一下，这个 ip 似乎是列入黑名单

{"t":{"$date":"2022-08-03T14:53:57.446+04:00"},"s":"I",  "c":"NETWORK",  "id":22943,   "ctx":"listener","msg":"Connection accepted","attr":{"remote":"193.118.53.138:60277","uuid":"14888a3e-9ed6-4ac8-81a9-c6a72302691e","connectionId":15,"connectionCount":14}}
{"t":{"$date":"2022-08-03T14:53:57.518+04:00"},"s":"I",  "c":"NETWORK",  "id":22944,   "ctx":"conn15","msg":"Connection ended","attr":{"remote":"193.118.53.138:60277","uuid":"14888a3e-9ed6-4ac8-81a9-c6a72302691e","connectionId":15,"connectionCount":13}}
{"t":{"$date":"2022-08-03T14:53:57.591+04:00"},"s":"I",  "c":"NETWORK",  "id":22943,   "ctx":"listener","msg":"Connection accepted","attr":{"remote":"193.118.53.138:60606","uuid":"c1a8d3d3-a248-4d00-9910-76eeef200fdc","connectionId":16,"connectionCount":14}}
{"t":{"$date":"2022-08-03T14:53:57.663+04:00"},"s":"I",  "c":"NETWORK",  "id":22944,   "ctx":"conn16","msg":"Connection ended","attr":{"remote":"193.118.53.138:60606","uuid":"c1a8d3d3-a248-4d00-9910-76eeef200fdc","connectionId":16,"connectionCount":13}}
{"t":{"$date":"2022-08-03T14:53:57.736+04:00"},"s":"I",  "c":"NETWORK",  "id":22943,   "ctx":"listener","msg":"Connection accepted","attr":{"remote":"193.118.53.138:60880","uuid":"8da8d4dd-a66e-4d4c-8937-4c8c429b6d4b","connectionId":17,"connectionCount":14}}
{"t":{"$date":"2022-08-03T14:53:57.970+04:00"},"s":"I",  "c":"NETWORK",  "id":22944,   "ctx":"conn17","msg":"Connection ended","attr":{"remote":"193.118.53.138:60880","uuid":"8da8d4dd-a66e-4d4c-8937-4c8c429b6d4b","connectionId":17,"connectionCount":13}}
{"t":{"$date":"2022-08-03T14:53:58.042+04:00"},"s":"I",  "c":"NETWORK",  "id":22943,   "ctx":"listener","msg":"Connection accepted","attr":{"remote":"193.118.53.138:33364","uuid":"37e844b4-1437-4f71-80ea-26426301af32","connectionId":18,"connectionCount":14}}
{"t":{"$date":"2022-08-03T14:53:58.112+04:00"},"s":"I",  "c":"NETWORK",  "id":22944,   "ctx":"conn18","msg":"Connection ended","attr":{"remote":"193.118.53.138:33364","uuid":"37e844b4-1437-4f71-80ea-26426301af32","connectionId":18,"connectionCount":13}}

167.248.133.63 也已连接。它也已已报告。

{"t":{"$date":"2022-08-03T14:05:54.033+04:00"},"s":"I",  "c":"NETWORK",  "id":22943,   "ctx":"listener","msg":"Connection accepted","attr":{"remote":"167.248.133.63:33704","uuid":"2a078c1d-c476-45ad-bfdb-4e4d8b4f353a","connectionId":14,"connectionCount":14}}
{"t":{"$date":"2022-08-03T14:05:54.356+04:00"},"s":"I",  "c":"NETWORK",  "id":22944,   "ctx":"conn14","msg":"Connection ended","attr":{"remote":"167.248.133.63:33704","uuid":"2a078c1d-c476-45ad-bfdb-4e4d8b4f353a","connectionId":14,"connectionCount":13}}

答案1

MongoDBmongod.log以 json 格式将其存储在您的数据库中。检查其中的NETWORK事件，包括接受连接等网络活动。

你的路由器DHCPC日志在这里可能毫无价值，忽略它们

请注意，拥有 MongoDB 不受限制访问权限的人可以执行该服务可以执行的任何操作，包括损坏或窃取您计算机上其他文件的数据。请勿将其公开到互联网上。

相关内容