PostgreSQL

The offensive surface of PostgreSQL reached as a service: authenticating, executing operating-system commands through COPY FROM PROGRAM and untrusted procedural languages, reading and writing host files, and escalating to superuser.

ဖတ်ချိန် ၁ မိနစ်၂၀၂၆ အောက် ၇ တွင် ပြင်ဆင်ခဲ့သည်florianametteပါဝင်ကူညီသူ ၁ ဦး
သင့်လက်ထောက်တွင် မေးရန် (MCP)GitHub တွင် ပြင်ရန်

PostgreSQL (port 5432) is a frequent target because, as a superuser, it will run operating-system commands and read or write arbitrary files on the host, all through documented features. Even as a non-superuser there are file and function primitives worth reaching for, and several well-known paths promote an ordinary role to superuser.

What to reach for#

  • Access: default and weak credentials, trust authentication, and reaching a login.
  • Command execution: COPY ... FROM PROGRAM, untrusted languages (plpythonu, plperlu), and C extensions.
  • File access: COPY, large objects, and pg_read_file to read and write host files.

References#

ယခင်Coercion and relayနောက်တစ်ခု Access