Oracle DB 11g R1/R2 DBMS_JVM_EXP_PERMS OS Code Execution
This module exploits a flaw (0 day) in DBMS_JVM_EXP_PERMS package that allows any user with create session privilege to grant themselves java IO privileges. Identified by David Litchfield. Works on 11g R1 and R2 (Windows only).
Rank
- Normal
Authors
- sid < sid [at] notsosecure.com >
Vulnerability References
- CVE-2010-0866
- OSVDB-62184
- http://blackhat.com/html/bh-dc-10/bh-dc-10-archives.html#Litchfield
- http://www.notsosecure.com/folder2/2010/02/04/hacking-oracle-11g/
Development
Similar Modules
- auxiliary/sqli/oracle/dbms_cdc_ipublish
- auxiliary/sqli/oracle/dbms_cdc_publish
- auxiliary/sqli/oracle/dbms_cdc_publish2
- auxiliary/sqli/oracle/dbms_cdc_publish3
- auxiliary/sqli/oracle/dbms_cdc_subscribe_activate_subscription
- auxiliary/sqli/oracle/dbms_export_extension
- auxiliary/sqli/oracle/dbms_metadata_get_granted_xml
- auxiliary/sqli/oracle/dbms_metadata_get_xml
- auxiliary/sqli/oracle/dbms_metadata_open
- auxiliary/sqli/oracle/droptable_trigger
Usage Information
$ msfconsole
## ### ## ##
## ## #### ###### #### ##### ##### ## #### ######
####### ## ## ## ## ## ## ## ## ## ## ### ##
####### ###### ## ##### #### ## ## ## ## ## ## ##
## # ## ## ## ## ## ## ##### ## ## ## ## ##
## ## #### ### ##### ##### ## #### #### #### ###
##
msf > use auxiliary/sqli/oracle/jvm_os_code_11g
msf auxiliary(jvm_os_code_11g) > set RHOST [TARGET IP]
msf auxiliary(jvm_os_code_11g) > run
## ### ## ##
## ## #### ###### #### ##### ##### ## #### ######
####### ## ## ## ## ## ## ## ## ## ## ### ##
####### ###### ## ##### #### ## ## ## ## ## ## ##
## # ## ## ## ## ## ## ##### ## ## ## ## ##
## ## #### ### ##### ##### ## #### #### #### ###
##
msf > use auxiliary/sqli/oracle/jvm_os_code_11g
msf auxiliary(jvm_os_code_11g) > set RHOST [TARGET IP]
msf auxiliary(jvm_os_code_11g) > run
Module Options
| CMD | CMD to execute. (default: echo metasploit >> %SYSTEMDRIVE%\\unbreakable.txt) |
| DBPASS | The password to authenticate with. (default: TIGER) |
| DBUSER | The username to authenticate with. (default: SCOTT) |
| RHOST | The Oracle host. (default: ) |
| RPORT | The TNS port. (default: 1521) |
| SID | The sid to authenticate with. (default: ORCL) |
| VERBOSE | Enable detailed status messages |
| WORKSPACE | Specify the workspace for this module |
