Using libc.so.6

Context

This article focuses on exploiting command execution in PostgreSQL using the shared library libc.so.6 for advanced post-exploitation. The reader is expected to have knowledge of dynamic linking, shared libraries, the Linux system call interface, and PostgreSQL command execution techniques.

Theory

Dynamic Linking in Linux

Dynamic linking is a mechanism that allows programs to use functions from shared libraries at runtime, rather than statically linking these functions at compile-time. Shared libraries like libc.so.6 contain frequently used functions that can be utilized by multiple programs, reducing redundancy and memory usage.

Exploiting Shared Libraries

The exploitation of shared libraries involves manipulating the way a program interacts with these libraries to achieve unintended behavior, such as arbitrary code execution. This typically involves injecting SQL payloads that exploit PostgreSQL's ability to call external C functions through shared libraries like libc.so.6.

System Call Interface

System calls serve as the interface between user applications and the operating system kernel, providing necessary services such as file operations, process control, networking, and more. The libc.so.6 library provides C standard library functions that act as convenient wrappers for these syscalls, enabling user applications to perform complex operations with simple function calls.

Practice

Exploiting PostgreSQL with libc.so.6

This section describes the steps needed to exploit PostgreSQL using the libc.so.6 library to achieve command execution on the host system.

• Exporting the Shared Object: Use the following SQL command to export a shared object to the filesystem. This command will create a file on the server that can be used for executing arbitrary commands.

  SELECT lo_export(0, '/tmp/exploit.so');
  

• Creating a Custom Function: Create a PostgreSQL function using the exported shared object to execute arbitrary commands. This function will allow you to interact with the system's command line.

  CREATE OR REPLACE FUNCTION exec(text) RETURNS int AS '/tmp/exploit.so', 'exec' LANGUAGE C STRICT;
  

• Executing a Shell Command: Finally, invoke the custom function to execute a shell command. In this example, the command opens a shell:

  SELECT exec('system("/bin/sh")');
  

By following these steps, you achieve command execution on the PostgreSQL host by leveraging the functionality provided by libc.so.6.

Tools

• PostgreSQL
• libc.so.6