sqlmapproject / udfhack

Database takeover UDF repository

Database takeover user-defined functions for MySQL and PostgreSQL

Files in this folder can be compiled as shared libraries. These define some user-defined functions (UDF) for MySQL and PostgreSQL. They are licensed under the terms of the GNU Lesser General Public License and their compiled versions are available on the official sqlmap repository, https://github.com/sqlmapproject/sqlmap.

udfhack's Issues

Solution: No such file "postgres.h" when compiling

If you get this error on Kali or debian based systems:

lib_postgresqludf_sys.c:34:10: fatal error: postgres.h: No such file or directory
   34 | #include <postgres.h>
      |          ^~~~~~~~~~~~
compilation terminated.

Need to install postgres dev package.
Run the following where "XXX" is the version available to install from apt:

sudo apt-cache search postgresql-server-dev
sudo apt install postgresql-server-dev-XXX

Also run the following to locate where the file is after install
find / -name "postgres.h" -print 2>/dev/null

Running sys_exec/sys_eval without results under Ubuntu 64

I would like to understand what is going on here. I've compiled and created the functions inside my database but for my propose it is not working. I would like to trigger a function to run a php script but it won't work here. Running my php script over terminal it works but calling sys_eval or sys_exec not.

For example:

$ psql -h 127.0.0.1 -p 5432 -U root

root-# select sys_exec('/usr/bin/php5 -e "/var/www/html/project/web/do_jobs.php" "/bin/cp /home/cassiano/Desktop/index.html /home/cassiano/"');
 sys_exec 
----------
        0
(1 row)

And my test don't work, the php receive a parameter to run a system command and do others stuff. Running in shell the script works well.

When I run:

root=# select sys_eval('echo $UID');
 sys_eval 
----------

(1 row)

But in shell:

$ echo $UID
1000

It returns '1000'.

Another example: in shell and in sys_eval it returns the same result:

$ id
uid=1000(cassiano) gid=1000(cassiano) groups=1000(cassiano),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),108(lpadmin),124(sambashare)

root=# select sys_eval('id');
                                sys_eval                                
------------------------------------------------------------------------
 uid=118(postgres) gid=128(postgres) groups=128(postgres),107(ssl-cert)
(1 row)

Is it something that I'm doing wrong?