TryHackMe - Poster

Room Link: <https://tryhackme.com/room/poster>
Introduction
RDBMS - relational database management system. RDBMSs have been a common option for the storage of information in databases used for financial records, manufacturing and logistical information, personnel data, and other applications since the 1980s. Relational databases have often replaced legacy hierarchical databases and network databases, because RDBMS were easier to implement and administer.
PostgreSQL is a free and open-source relational database management system (RDBMS) emphasizing extensibility and SQL compliance.
Recon
First, add poster.thm to your /etc/hosts file for ease of operation.
As always, start with the simple RustScan scan.
From the scan above we can easily identify both port (Q2) and the rdms name (Q1).
Metasploit Enumaration
Launch metasploit and search for postgresql-related modules using:
search postgresql
First of all, let's look at the login module. It check the rdbms for weak/standard login credentials and allows us to get initial access.
auxiliary/scanner/postgres/postgres_login
Bingo! We got the credentials. Now we can use them to dump password hashes, read files and achieve an RCE.
Let's dump password hashes using another module
auxiliary/scanner/postgres/postgres_hashdump
Don't forget to plug both username and password into the module.
Metasploit Exploitation
auxiliary/admin/postgres/postgres_readfile
Let's use this module to read the contents of /etc/passwd file to get some initial information about the machine.
After reading the /etc/passwd file we have a direct clue about all user accounts on the box.
Now it's time to finally get the box access and escalate our priviliges.
exploit/multi/postgres/postgres_copy_from_program_cmd_exec
Above module will allow you to achieve RCE on the system using just the RDBMS username and password.
​
It is important to set a proper payload for this payload
Once the command was executed, use python3 -c 'import pty; pty.spawn("/bin/bash")' to get a tty shell.
Remember, while reading the /etc/passwd file, we have identified one user? Take a look at his home directory at retrieve credentials.
​
Black: Credentials; White: User
Once on the system, we may notice that the user cannot run any commands as sudo which usually indicates that we need to find something ourselves.
Turns out there was a conf file in the /var/html/www that contained both username and password for out last step of privilege escalation. Read it and login as the new user.
Root
After getting on the second account, it becomes relatively easy to escalate your privileges.
sudo -l
From this point, execute sudo su and get the root access :)
Thank you for reading!
Last modified 11mo ago