# Exploitation

> RCE via COPY TO PROGRAM, UDF, file read, and privesc methods

- **URL:** https://hackindex.io/services/postgresql/exploitation
- **Service:** [PostgreSQL](https://hackindex.io/services/postgresql.md)
- **Tags:** initial-access, execution
- **Published:** 2026-05-06
- **Updated:** 2026-05-06

PostgreSQL exploitation leverages the database's powerful built-in features for file system access and code execution. COPY TO and COPY FROM read and write files as the postgres OS user, letting you grab /etc/passwd or drop a webshell into a writable web root. Large object functions (lo_import, lo_export) provide an alternative file I/O path that sometimes bypasses restrictions on COPY.

For direct code execution, PL/pgSQL and other procedural languages (PL/Python, PL/Perl) execute arbitrary code when enabled. The CREATE FUNCTION approach gives you a shell as the postgres user. Credential brute-forcing with Hydra or Medusa works well against PostgreSQL since default configurations often lack connection rate limiting.

On older versions, the libc trick using CREATE FUNCTION with a shared library loads attacker-controlled code directly. Newer PostgreSQL versions restrict this, but misconfigurations in shared_preload_libraries or local file write combined with a server restart still get you there.

## Guides

- [PostgreSQL RCE and Exploitation](https://hackindex.io/services/postgresql/exploitation/postgresql-rce-and-exploitation.md): Exploit PostgreSQL for RCE via COPY TO/FROM PROGRAM, UDF injection, and privilege escalation techniques targeting misconfigured or authenticated database instances.