Databases are the core pivot point of internal network penetration—almost every application has a database backend, and databases usually have operating-system-level capabilities.
⛔ In-depth reference (required reading)
- Redis attacks (unauthorized/write file/master-slave replication RCE) → references/redis-attack.md
- MSSQL attacks (xp_cmdshell/CLR/privilege escalation) → references/mssql-attack.md
- PostgreSQL attacks (command execution/file read/write/privilege escalation) → references/postgresql-attack.md
Phase 1: Database identification
| Port | Service | Attack priority |
|---|---|---|
| 6379 | Redis | ⭐⭐⭐ High probability of unauthorized access |
| 1433 | MSSQL | ⭐⭐⭐ xp_cmdshell direct RCE |
| 5432 | PostgreSQL | ⭐⭐ Strong command execution capability |
| 3306 | MySQL | ⭐⭐ UDF privilege escalation |
| 27017 | MongoDB | ⭐⭐ High probability of unauthorized access |
| 1521 | Oracle | ⭐ Complex exploitation |
Phase 2: General attack flow
发现数据库端口？
├─ 1. 尝试未授权访问（空密码/匿名）
├─ 2. 弱口令爆破（默认账号 + top100）
├─ 3. 已知漏洞利用
├─ 4. 进入数据库后：
│ ├─ 搜索敏感数据（用户表/配置表/flag）
│ ├─ 尝试命令执行
│ └─ 尝试文件读写
└─ 5. 操作系统提权
Phase 3: Quick unauthorized detection
# Redis
redis-cli -h TARGET ping
# 返回 PONG → 未授权
# MSSQL（默认 sa 账号）
netexec mssql TARGET -u sa -p '' --local-auth
netexec mssql TARGET -u sa -p 'sa' --local-auth
# PostgreSQL
psql -h TARGET -U postgres -w
# 空密码测试
# MySQL
mysql -h TARGET -u root --skip-password
# MongoDB
mongosh --host TARGET --eval "db.adminCommand('listDatabases')"
Phase 4: Weak password brute forcing
# 通用爆破（netexec 支持多种协议）
netexec mssql TARGET -u userlist.txt -p passlist.txt --local-auth
netexec ssh TARGET -u userlist.txt -p passlist.txt
# 常见默认账号
# Redis: 无认证 / requirepass 常为弱密码
# MSSQL: sa / sa, sa / 空, sa / 123456
# PostgreSQL: postgres / postgres, postgres / 空
# MySQL: root / root, root / 空, root / 123456
# MongoDB: admin / admin, 无认证
Redis quick reference (most common)
# 未授权连接
redis-cli -h TARGET
# 信息收集
INFO server
CONFIG GET dir
CONFIG GET dbfilename
Redis key exploitation paths:
- Write Webshell / SSH key / Crontab
- Master-slave replication RCE
- Lua sandbox escape
→ Password brute forcing / Cluster / Sentinel details → references/redis-attack.md
MSSQL quick reference
# 连接
impacket-mssqlclient DOMAIN/sa:PASSWORD@TARGET -windows-auth
MSSQL key exploitation paths:
- xp_cmdshell / OLE / Agent Job RCE
- CLR Assembly attack
- File read/write
- NTLM Hash theft
→ Information gathering / Privilege escalation methodology → references/mssql-attack.md
MySQL quick reference
MySQL key exploitation paths:
- UDF privilege escalation / File read/write