Oracle DB SQL Injection in MDSYS.SDO_TOPO_DROP_FTBL Trigger - Metasploit


This page contains detailed information about how to use the auxiliary/sqli/oracle/droptable_trigger metasploit module. For list of all metasploit modules, visit the Metasploit Module Library.

Table Of Contents
hide

Module Overview

Name: Oracle DB SQL Injection in MDSYS.SDO_TOPO_DROP_FTBL Trigger
Module: auxiliary/sqli/oracle/droptable_trigger
Source code: modules/auxiliary/sqli/oracle/droptable_trigger.rb
Disclosure date: 2009-01-13
Last modification time: 2020-10-02 17:38:06 +0000
Supported architecture(s): -
Supported platform(s): -
Target service / protocol: -
Target network port(s): -
List of CVEs: CVE-2008-3979

This module will escalate an Oracle DB user to MDSYS by exploiting a sql injection bug in the MDSYS.SDO_TOPO_DROP_FTBL trigger. After that exploit escalate user to DBA using "CREATE ANY TRIGGER" privilege given to MDSYS user by creating evil trigger in system scheme (2-stage attack).

Module Ranking and Traits

Module Ranking:

  • normal: The exploit is otherwise reliable, but depends on a specific version and can't (or doesn't) reliably autodetect. More information about ranking can be found here.

Basic Usage

msf > use auxiliary/sqli/oracle/droptable_trigger
msf auxiliary(droptable_trigger) > show targets
    ... a list of targets ...
msf auxiliary(droptable_trigger) > set TARGET target-id
msf auxiliary(droptable_trigger) > show options
    ... show and set options ...
msf auxiliary(droptable_trigger) > exploit

Go back to menu.

Msfconsole Usage

Here is how the sqli/oracle/droptable_trigger auxiliary module looks in the msfconsole:

msf6 > use auxiliary/sqli/oracle/droptable_trigger

msf6 auxiliary(sqli/oracle/droptable_trigger) > show info

       Name: Oracle DB SQL Injection in MDSYS.SDO_TOPO_DROP_FTBL Trigger
     Module: auxiliary/sqli/oracle/droptable_trigger
    License: Metasploit Framework License (BSD)
       Rank: Normal
  Disclosed: 2009-01-13

Provided by:
  Sh2kerr <research[ad]dsec.ru>

Check supported:
  No

Basic options:
  Name      Current Setting     Required  Description
  ----      ---------------     --------  -----------
  FILENAME  msf.sql             no        The file name.
  SQL       GRANT DBA TO SCOTT  no        The SQL to execute.
  USER      SCOTT               no        The current user.

Description:
  This module will escalate an Oracle DB user to MDSYS by exploiting a 
  sql injection bug in the MDSYS.SDO_TOPO_DROP_FTBL trigger. After 
  that exploit escalate user to DBA using "CREATE ANY TRIGGER" 
  privilege given to MDSYS user by creating evil trigger in system 
  scheme (2-stage attack).

References:
  https://nvd.nist.gov/vuln/detail/CVE-2008-3979
  OSVDB (51354)
  http://www.securityfocus.com/archive/1/500061
  http://www.ngssoftware.com/

Module Options

This is a complete list of options available in the sqli/oracle/droptable_trigger auxiliary module:

msf6 auxiliary(sqli/oracle/droptable_trigger) > show options

Module options (auxiliary/sqli/oracle/droptable_trigger):

   Name      Current Setting     Required  Description
   ----      ---------------     --------  -----------
   FILENAME  msf.sql             no        The file name.
   SQL       GRANT DBA TO SCOTT  no        The SQL to execute.
   USER      SCOTT               no        The current user.

Advanced Options

Here is a complete list of advanced options supported by the sqli/oracle/droptable_trigger auxiliary module:

msf6 auxiliary(sqli/oracle/droptable_trigger) > show advanced

Module advanced options (auxiliary/sqli/oracle/droptable_trigger):

   Name                   Current Setting  Required  Description
   ----                   ---------------  --------  -----------
   DisablePayloadHandler  true             no        Disable the handler code for the selected payload
   VERBOSE                false            no        Enable detailed status messages
   WORKSPACE                               no        Specify the workspace for this module

Auxiliary Actions

This is a list of all auxiliary actions that the sqli/oracle/droptable_trigger module can do:

msf6 auxiliary(sqli/oracle/droptable_trigger) > show actions

Auxiliary actions:

   Name  Description
   ----  -----------

Evasion Options

Here is the full list of possible evasion options supported by the sqli/oracle/droptable_trigger auxiliary module in order to evade defenses (e.g. Antivirus, EDR, Firewall, NIDS etc.):

msf6 auxiliary(sqli/oracle/droptable_trigger) > show evasion

Module evasion options:

   Name  Current Setting  Required  Description
   ----  ---------------  --------  -----------

Go back to menu.

References

See Also

Check also the following modules related to this module:

Authors

  • Sh2kerr <research[ad]dsec.ru>

Version

This page has been produced using Metasploit Framework version 6.1.24-dev. For more modules, visit the Metasploit Module Library.

Go back to menu.