PostgreSQL:

Exploitation

RCE via COPY TO PROGRAM, UDF, file read, and privesc methods

1 guide • Created Dec 28, 2025 • Updated May 6, 2026

1 guide

PostgreSQL RCE and Exploitation

Exploit PostgreSQL for RCE via COPY TO/FROM PROGRAM, UDF injection, and privilege escalation techniques targeting misconfigured or authenticated database instances.

May 6, 2026 • 7 min read

PostgreSQL exploitation leverages the database's powerful built-in features for file system access and code execution. COPY TO and COPY FROM read and write files as the postgres OS user, letting you grab /etc/passwd or drop a webshell into a writable web root. Large object functions (lo_import, lo_export) provide an alternative file I/O path that sometimes bypasses restrictions on COPY.

For direct code execution, PL/pgSQL and other procedural languages (PL/Python, PL/Perl) execute arbitrary code when enabled. The CREATE FUNCTION approach gives you a shell as the postgres user. Credential brute-forcing with Hydra or Medusa works well against PostgreSQL since default configurations often lack connection rate limiting.

On older versions, the libc trick using CREATE FUNCTION with a shared library loads attacker-controlled code directly. Newer PostgreSQL versions restrict this, but misconfigurations in shared_preload_libraries or local file write combined with a server restart still get you there.