File and operating system takeover support for Oracle #26

Activity

1. ghost assigned

   bdamele

   on Jun 26, 2012
2. infodox commented on Jul 3, 2012

   

   infodox

   on Jul 3, 2012

   More actions

   We were looking at this: http://code.google.com/p/bsqlbf-v2/ as an example of how to do takeover on Oracle DB. Perhaps we will have a pull request ready soon <3
3. infodox commented on Jul 5, 2012

   

   infodox

   on Jul 5, 2012

   More actions

   @stamparm @sqlmapproject @inquisb this is possible, though you would have to provide multiple methods and bruteforce your way to the right one or use DBMS fingerprinting to figure out the right trick. Would certainly be a worthy addition to it! See my above link.
4. bdamele commented on Jul 6, 2012

   

   bdamele

   on Jul 6, 2012

   MemberAuthor

   More actions

   More details: http://kitkatsatonthemat.blogspot.com/2011/11/i-herd-you-like-oracle-dawg-so-i-put.html
5. firefart commented on Aug 30, 2012

   

   firefart

   on Aug 30, 2012

   More actions

   Maybe this helps:
   In Oracle there are 2 Function granted to PUBLIC by default:
   dbms_xmlquery.newcontext()
   dbms_xmlquery.getxml()

   These 2 functions allow execution of anonymous PLSQL blocks within an SQL Statement. Extremly helpful when injecting in Oracle Databases.
   Examples:
   select dbms_xmlquery.newcontext('declare pragma autonomous_transaction; begin execute immediate '' create synonym asdf for SCHEMA.TABLE ''; commit; end;') from dual

   select dbms_xmlquery.getxml('declare pragma autonomous_transaction; begin execute immediate '' create synonym asdf for SCHEMA.TABLE ''; commit; end;') from dual

   With this technique it would be possible to create a Java Package with Runtime.exec() to takeover the Databasehost (user needs the rights(grants) for this operation, but this can be checked via the oracle system tables).
6. bdamele commented on Dec 5, 2012

   

   bdamele

   on Dec 5, 2012

   MemberAuthor

   More actions

   @infodox where's your pull request? :)
7. stamparm commented on Oct 19, 2015

   

   stamparm

   on Oct 19, 2015

   Member

   More actions

   http://www.6code.net/2015/08/execute-os-command-in-oracle-database.html
8. steelbrain commented on Jul 28, 2016

   

   steelbrain

   on Jul 28, 2016

   More actions

   Bump

   👍React with 👍3Reacted by Alex Hagenah, Mitropoulos Konstantinos and Antonio
9. SebaNuss commented on Apr 12, 2018

   

   SebaNuss

   on Apr 12, 2018

   Last edited by SebaNuss

   More actions

   There seem to be a few methods to execute OS Commands and through the SYS.KUPP$PROC.CREATE_MASTER_PROCESS function in Oracle up to 11g2.

   For example if a URL is vulnerable to AND based SQLi, you could run <url>/id=2' and (Select SYS.KUPP$PROC.CREATE_MASTER_PROCESS('EXECUTE IMMEDIATE ''DECLARE PRAGMA AUTONOMOUS_TRANSACTION; BEGIN EXECUTE IMMEDIATE ''''GRANT dba TO user;''''; END;'';') from dual) is not null--

   I used this in a test scenario and was able to create a user and grant it DBA on Oracle 11g2.

   I came across this whitepaper that goes into alot more detail, including privilege escalation.
   I hope it might be helpfull.
   https://media.blackhat.com/bh-us-10/whitepapers/Siddharth/BlackHat-USA-2010-Siddharth-Hacking-Oracle-from-the-Web-wp.pdf

   👍React with 👍2Reacted by Miroslav Stampar and Antonio
10. stamparm

    added a commit that references this issue on Jun 3, 2019

    Implementing support for --file-read on Oracle (Issue #26)

    c00a642