Module: Msf::Exploit::ORACLE

Defined in:
lib/msf/core/exploit/oracle.rb

Instance Method Summary collapse

Instance Method Details

#check_dependencies ⇒ Object 



44
45
46
47
48
49
50
51
 
# File 'lib/msf/core/exploit/oracle.rb', line 44

def check_dependencies
  if not @oci8_loaded
    print_error("Failed to load the OCI library: #{@oci8_error}")
    print_error("Try 'gem install ruby-oci8'")
    return false
  end
  return true
end

#connect ⇒ Object 



53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
 
# File 'lib/msf/core/exploit/oracle.rb', line 53

def connect
  handle = nil

  if(not @oci8_loaded)
    raise RuntimeError, "Could not load the Oracle driver (oci8): #{@oci8_error}"
  end

  # Create a Connection to the Database
  if datastore['DBUSER'] == 'SYS' || datastore['DBUSER'] == 'SYSTEM'
    begin
      handle = OCI8.new(
        datastore['DBUSER'],
        datastore['DBPASS'],
        "//#{datastore['RHOST']}:#{datastore['RPORT']}/#{datastore['SID']}",
        :SYSDBA
      )
    rescue ::OCIError
      # Try again without a request for SYSDBA
      vprint_status('Insufficient privileges, trying without SYSDBA')
      handle = OCI8.new(
        datastore['DBUSER'],
        datastore['DBPASS'],
        "//#{datastore['RHOST']}:#{datastore['RPORT']}/#{datastore['SID']}"
      )
    end
  else
    handle = OCI8.new(
      datastore['DBUSER'],
      datastore['DBPASS'],
      "//#{datastore['RHOST']}:#{datastore['RPORT']}/#{datastore['SID']}"
    )
  end
  handle
end

#disconnect ⇒ Object 



88
89
90
 
# File 'lib/msf/core/exploit/oracle.rb', line 88

def disconnect
  connect.logoff
end

#initialize(info = {}) ⇒ Object 



19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
 
# File 'lib/msf/core/exploit/oracle.rb', line 19

def initialize(info = {})
  super

  register_options(
    [
      OptString.new('RHOST',  [ true, 'The Oracle host.',                   '']),
      OptPort.new('RPORT',  [ true, 'The TNS port.',                      1521]),
      OptString.new('SID',    [ true, 'The sid to authenticate with.',      'ORCL']),
      OptString.new('DBUSER', [ true, 'The username to authenticate with.', 'SCOTT']),
      OptString.new('DBPASS', [ true, 'The password to authenticate with.', 'TIGER']),
    ], Msf::Exploit::ORACLE
  )

  begin
    olang = ENV['NLS_LANG']
    ENV['NLS_LANG'] = 'AMERICAN_AMERICA.WE8ISO8859P1'
    require 'oci8'
    ENV['NLS_LANG'] = olang
    @oci8_loaded = true
  rescue ::Exception => e
    @oci8_loaded = false
    @oci8_error  = e
  end
end

#prepare_exec(sql) ⇒ Object 



92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
 
# File 'lib/msf/core/exploit/oracle.rb', line 92

def prepare_exec(sql)
  begin
    sploit = connect.parse(sql)
  rescue ::OCIError => e
    print_error("#{e.to_s}")
    return
  end
  # DEBUG
  # print_status("did the parse sploit type is " + sploit.type.to_s)
  begin
    sploit.exec
  rescue ::OCIError => e
    if ( e.to_s =~ /ORA-00942: table or view does not exist/ )
      print_status("ORA-00942: table or view does not exist")
      raise RuntimeError, "ORA-00942: table or view does not exist"
    end
  print_status e.to_s
  end

  # The Handling is a little different for certain types of query
  # Mainly Select needs a fetch statement to get the data
  # Also return types are a little different (some return rows changed so we can used that)
  # The case statement could probably be collapsed a bit but leaving it as is for the moment
  # in case it's useful later...

  # Select Queries
  case sploit.type
  when 1, :select_stmt
    # Create an array to return to the calling function
    results = Array.new
    while r = sploit.fetch()
      str = r.join(',')
      # Removed this as it should really be down to the exploit to decide what to print
      # eg leaving this in messes up oraenum.
      # print_status(str)
      results << str
    end

    return results

  # Update Queries
  when 2, :update_stmt
    connect.commit

    # If we were successful our return should be a Integer with the number of rows updated
    result = ['UPDATE Successful ' + sploit.row_count.to_s + ' Rows Updated']
    return result
  # Delete Queries
  when 3, :delete_stmt
    connect.commit
    # If we were successful our return should be a Integer with the number of rows updated
    result = ['DELETE Successful ' + sploit.row_count.to_s + ' Rows Deleted']
    return result
  # Insert Queries
  when 4, :insert_stmt
    connect.commit
    # If we were successful our return should be a Integer with the number of rows updated
    result = ['INSERT Successful ' + sploit.row_count.to_s + ' Rows Inserted']
    return result
  # Create Queries
  when 5, :create_stmt
    connect.commit
    if sploit
      print_status('CREATE successful')
    end
  when 6, :drop_stmt
    connect.commit
    if sploit
      print_status('DROP successful')
    end
  when 7, :alter_stmt
    connect.commit
    if sploit
      print_status('Alter successful')
    end
  when 8, :begin_stmt
    connect.commit
  when 9, :declare_stmt
    connect.commit
  else
    print_status("Didn't match Query Type!")
    print_status("Query type passed was " + sploit.type.to_s)
  end
end