PostgreSQL Login Utility
This module attempts to authenticate against a PostgreSQL instance using username and password combinations indicated by the USER_FILE, PASS_FILE, and USERPASS_FILE options.
Rank
- Normal
Authors
- todb < todb [at] metasploit.com >
Vulnerability References
Development
Similar Modules
- auxiliary/scanner/postgres/postgres_hashdump
- auxiliary/scanner/postgres/postgres_schemadump
- auxiliary/scanner/postgres/postgres_version
Usage Information
$ msfconsole
## ### ## ##
## ## #### ###### #### ##### ##### ## #### ######
####### ## ## ## ## ## ## ## ## ## ## ### ##
####### ###### ## ##### #### ## ## ## ## ## ## ##
## # ## ## ## ## ## ## ##### ## ## ## ## ##
## ## #### ### ##### ##### ## #### #### #### ###
##
msf > use auxiliary/scanner/postgres/postgres_login
msf auxiliary(postgres_login) > set RHOSTS [TARGET HOST RANGE]
msf auxiliary(postgres_login) > run
## ### ## ##
## ## #### ###### #### ##### ##### ## #### ######
####### ## ## ## ## ## ## ## ## ## ## ### ##
####### ###### ## ##### #### ## ## ## ## ## ## ##
## # ## ## ## ## ## ## ##### ## ## ## ## ##
## ## #### ### ##### ##### ## #### #### #### ###
##
msf > use auxiliary/scanner/postgres/postgres_login
msf auxiliary(postgres_login) > set RHOSTS [TARGET HOST RANGE]
msf auxiliary(postgres_login) > run
Module Options
| BLANK_PASSWORDS | Try blank passwords for all users (default: true) |
| BRUTEFORCE_SPEED | How fast to bruteforce, from 0 to 5 (default: 5) |
| DATABASE | The database to authenticate against (default: template1) |
| PASSWORD | A specific password to authenticate with |
| PASS_FILE | File containing passwords, one per line (default: /home/svn/jobs/msf3/data/wordlists/postgres_default_pass.txt) |
| RETURN_ROWSET | Set to true to see query result sets (default: true) |
| RHOSTS | The target address range or CIDR identifier |
| RPORT | The target port (default: 5432) |
| STOP_ON_SUCCESS | Stop guessing when a credential works for a host |
| THREADS | The number of concurrent threads (default: 1) |
| USERNAME | A specific username to authenticate as |
| USERPASS_FILE | File containing (space-seperated) users and passwords, one pair per line (default: /home/svn/jobs/msf3/data/wordlists/postgres_default_userpass.txt) |
| USER_AS_PASS | Try the username as the password for all users (default: true) |
| USER_FILE | File containing users, one per line (default: /home/svn/jobs/msf3/data/wordlists/postgres_default_user.txt) |
| VERBOSE | Whether to print output for all attempts (default: true) |
| MaxGuessesPerService | Maximum number of credentials to try per service instance. If set to zero or a non-number, this option will not be used. |
| MaxGuessesPerUser | Maximum guesses for a particular username for the service instance. Note that users are considered unique among different services, so a user at 10.1.1.1:22 is different from one at 10.2.2.2:22, and both will be tried up to the MaxGuessesPerUser limit. If set to zero or a non-number, this option will not be used. |
| MaxMinutesPerService | Maximum time in minutes to bruteforce the service instance. If set to zero or a non-number, this option will not be used. |
| REMOVE_PASS_FILE | Automatically delete the PASS_FILE on module completion |
| REMOVE_USERPASS_FILE | Automatically delete the USERPASS_FILE on module completion |
| REMOVE_USER_FILE | Automatically delete the USER_FILE on module completion |
| ShowProgress | Display progress messages during a scan |
| ShowProgressPercent | The interval in percent that progress should be shown |
| WORKSPACE | Specify the workspace for this module |