Perl - Script to run OS commands via Oracle based Web Apps released

Sumit Siddarth from www.notsosecure.com has released a small perl script to run OS commands via Oracle based Web Apps. Sumit is using the bug in dbms_export_extension. This problem was fixed with CPU July 2006 but all databases without this (or higher CPU or patchset) are affected (Oracle 8.1.7.4, 9.2.0.1 - 9.2.0.7, 10.1.0.2 - 10.1.0.4, 10.2.0.1-10.2.0.2, XE) . More details are available in my updated tutorial.

I tested the script together with him against several of my test database.

The script is easy to use. Under MacOS I had to install p5-libwww-perl to run it.

At the moment the script does not work against Oracle databases without java but I am sure sooner or later this will be changed. In my opinion the most generic way to run OS commands (as user Oracle) is PL/SQL native (Oracle 9i, Oracle 10g/11g).

Dieser Eintrag wurde am 1 Mai 2009 um 15:55 verfasst und befindet sich in Tools, Exploit, SQL Injection. Sie können alle Antworten zu diesem Eintrag über den Feed RSS 2.0 mitverfolgen. Hinterlassen Sie eine Antwort oder einen Trackback-Link zu Ihrer eigenen Homepage.

| Drucken