PostgreSQL:
Exploitation
RCE via COPY TO PROGRAM, UDF, file read, and privesc methods
PostgreSQL RCE and Exploitation
Exploit PostgreSQL for RCE via COPY TO/FROM PROGRAM, UDF injection, and privilege escalation techniques targeting misconfigured or authenticated database instances.
PostgreSQL exploitation leverages the database's powerful built-in features for file system access and code execution. COPY TO and COPY FROM read and write files as the postgres OS user, letting you grab /etc/passwd or drop a webshell into a writable web root. Large object functions (lo_import, lo_export) provide an alternative file I/O path that sometimes bypasses restrictions on COPY.
For direct code execution, PL/pgSQL and other procedural languages (PL/Python, PL/Perl) execute arbitrary code when enabled. The CREATE FUNCTION approach gives you a shell as the postgres user. Credential brute-forcing with Hydra or Medusa works well against PostgreSQL since default configurations often lack connection rate limiting.
On older versions, the libc trick using CREATE FUNCTION with a shared library loads attacker-controlled code directly. Newer PostgreSQL versions restrict this, but misconfigurations in shared_preload_libraries or local file write combined with a server restart still get you there.