PostgreSQL 9.x Remote Command Execution

During a recent penetration test I was able to gain access to a PostgreSQL 9.0 service. While the process for executing system commands from PostgreSQL 8.1 and before is straightforward and well documented – there is even a Metasploit module to make the process very simple – this was slightly more complex for PostgreSQL 9.x. For PostgreSQL 8.1 and earlier, something similar to the following will allow for command execution (from https://pentestmonkey.net/cheat-sheet/sql-injection/postgres-sql-injection-cheat-sheet):

This method requires knowledge of the location of libc on the system, though this is easy to obtain by enumerating through a small subset of likely locations, either in the above command, or in attempts to read libc into a table.

However, when attempted on PostgreSQL 9.0, the following error was shown:

This error is explained in the PostgreSQL documentation:

So for PostgreSQL versions since 8.2, an attacker either needs to take advantage of a library already present on the system, or upload their own library, which has been compiled against the right major version of PostgreSQL, and includes this magic block. This blog post goes through compiling a library which includes this magic block, uploading it to the server through SQL queries, and then obtaining command execution from this library. I have also released a script to simplify this process, along with precompiled libraries for all currently released major versions of PostgreSQL since 8.2 on the Dionach GitHub page. This script is discussed in more detail at the end of this post.

Compiling the library

To compile the library, a Linux machine with the same version of PostgreSQL as the target machine is required. The sources for PostgreSQL, with included installation instructions, can be found here (https://www.postgresql.org/ftp/source/). You can obtain the version of PostgreSQL running on the target machine using:

The major versions have to match, so in this case compiling a library using any 9.6.x should work. If they are running the latest version of PostgreSQL, then installing using your system’s package manager may be easier, though you will also have to install the necessary header files. On Debian, this can be achieved using:

After that, compile the library found on the GitHub repository using:

This assumes that you have installed PostgreSQL from source; if you have installed PostgreSQL using your system’s package manager then you will likely be able to replace “/usr/local/pgsql/bin/pg_config” with simply “pg_config” in the above command, depending on how the package manager installed PostgreSQL. This should create a library named “pg_exec.so” which can be uploaded to the target server to allow for command execution using the “pg_exec” function of the library.

Uploading the library

This file can be uploaded through the use of PostgreSQL’s “pg_largeobject” table. The process for doing this is to split the file into exactly 2048 byte chunks (excluding the last chunk which may be smaller), encode these chunks using base64, insert these chunks into the “pg_largeobject” table, then save the file to the system using PostgreSQL’s “lo_export”. Splitting the object into 2048 byte chunks can be achieved using:

This will create a series of alphabetically ordered files with names “xaa”, “xab”, “xac”, and so on. The contents of these files needs to be inserted into the “pg_largeobject” table before they can be exported to the server. For this, an “LOID” needs to be generated on the target server. Connect to the target server’s PostgreSQL service using the “psql” binary installed during the local PostgreSQL install, and issue the following query (note the lack of an “e” in “lo_creat”):

This LOID is then used to identify the object in the pg_largeobject table. Inserting chunks into the “pg_largeobject” table can be achieved using:

This needs to be repeated for each chunk, in order, incrementing the “pageno” parameter by 1 each time. Once this has been done, the library can be saved to the server using:

Command Execution

The library should now be present at “/tmp/pg_exec.so”. The pg_exec method of this library can now be called through PostgreSQL using a similar method to that mentioned at the start of this blog post:

Commands can then be run on the target system using the created “sys” command. For instance, to send a reverse shell to 10.0.0.1:4444 using netcat, issue the query:

pgexec.sh

I have provided a script which somewhat automates this process. PostgreSQL will still need to be installed from source, though everything else can be done through running the pgexec.sh script at the mention repository. This script will also clean up after itself, removing the uploaded library from the system, deleting any values inserted into the “pg_largeobject” table, and deleting the created PostgreSQL function. Further, the script allows you to specify which library to upload, or which source code to use to automatically compile the library.

The help text for the script is shown below:

Assuming that PostgreSQL was installed from source by following the included instructions, then you will have to add the PostgreSQL binaries to the path to call the script. Creating a reverse shell can be done as shown below: