Disclaimer

This project was conducted in a controlled lab environment for educational purposes only.

PostgreSQL Local Penetration Test & Post-Exploitation

Overview

This project documents a local penetration testing assessment against a PostgreSQL instance running on a Linux system.

The objective of this assessment was to evaluate the security impact of misconfigured PostgreSQL permissions, OS-level trust relationships, and dangerous superuser features that may lead to full system compromise.

The assessment follows a structured attack chain from initial access to post-exploitation persistence.

---

Target Environment

• Database: PostgreSQL 17
• OS: Linux (Kali / Debian-based)
• Deployment: Local service (localhost / lab environment)
• Access type: Local shell access

---

Attack Chain Summary

1. Service Enumeration
2. Authentication Analysis
3. Local Privilege Escalation
4. Remote Code Execution
5. Post-Exploitation Persistence

Each phase is documented with evidence and proof-of-concept commands.

---

Findings Overview

Phase	Impact
Enumeration	PostgreSQL service identified
Authentication	SCRAM-SHA-256 enforced
Privilege Escalation	OS trust allows access as postgres
RCE	Arbitrary OS command execution
Persistence	Cron-based persistence

---

Disclaimer

This project was conducted in a controlled lab environment for educational and portfolio purposes only.