Nibbles

Source: Proving Grounds OS: Linux Community Rating: Intermediate

Enumeration & Reconnaissance

  • Autorecon detected:

    • FTP (21)

    • SSH (22)

    • HTTP (80)

    • PostgreSQL (5437)

Service Analysis

  • The HTTP site was a static page with no functionality. FTP blocked anonymous logins, so PostgreSQL became the focus.

HTTP (80)

Gaining Initial Access

  • I tried the classic postgres:postgres combo, and it worked instantly:

psql -h 192.168.111.47 -p 5437 -U postgres
Postgres Connection

  • In a real engagement, I’d dig into databases for credentials or sensitive data, but since I had an easier path (RCE), I skipped it for now.

  • I grabbed a PostgreSQL RCE script from GitHub (postgresql_rce.py). My first reverse shell used a random port, 9911, but it failed, likely blocked by a firewall. Switching to port 5437 (same as PostgreSQL’s service port) worked, and the shell connected.

PostgreSQL RCE PoC

Privilege Escalation

  • Running linpeas.sh revealed that find had the SUID bit set.

find SUID

  • SUID means the command runs with the owner’s privileges (in this case, root). To test:

find test -exec whoami \;  # Output: root

  • Then, to spawn a root shell:

find test -exec /bin/bash -p \;

  • Boom, root access.

Root Access

Lessons Learned

  • Default Credentials Are Gold: postgres:postgres is still far too common.

  • SUID Misconfigurations: Always check binaries for SUID flags.

  • Port Mirroring: Firewalls often allow traffic on ports matching the open services (e.g., 5437 for PostgreSQL).

PreviousBratarinaNextWindows

Last updated