Metasploit Penetration Testing Framework

SQL Injection in MDSYS.SDO_TOPO_DROP_FTBL Trigger.

This module will escalate a Oracle DB user to MDSYS by exploiting an sql injection bug in the MDSYS.SDO_TOPO_DROP_FTBL trigger. After that exploit escalate user to DBA using "CREATE ANY TRIGGER" privilege given to MDSYS user by creating evil trigger in system scheme (2-stage attack).

Rank

Normal

Authors

Sh2kerr < research[ad]dsec.ru >

References

Development

Similar Modules

Usage Information

$ msfconsole

                ##                          ###           ##    ##
##  ##  #### ###### ####  #####   #####    ##    ####        ######
####### ##  ##  ##  ##         ## ##  ##    ##   ##  ##   ###   ##
####### ######  ##  #####   ####  ##  ##    ##   ##  ##   ##    ##
## # ##     ##  ##  ##  ## ##      #####    ##   ##  ##   ##    ##
##   ##  #### ###   #####   #####     ##   ####   ####   #### ###
                                      ##

msf > use auxiliary/admin/oracle/droptable_trigger
msf auxiliary(droptable_trigger) > run

Module Options

FILENAME	The file name. (default: msf.sql)
OUTPUTPATH	The location of the file. (default: ./data/exploits/)
SQL	The SQL to execute. (default: GRANT DBA TO SCOTT)
USER	The current user. (default: SCOTT)
WORKSPACE	Specify the workspace for this module

OSVDB:	CVE:
BID:	MSB:
TEXT: