Advanced Exploitation of Oracle PL/SQL Flaws

Source: www.blackhat.com
Topic: Oracle Programming

Short Desciption:
NGS Consulting Next Generation Security Software Ltd. What is PL/SQL? What is PL/SQL? • Procedural Language / Structured Query Language • Oracles extension to standard SQL Programmable like T-SQL ...

 

Content Inside:
NGS Consulting Next Generation Security Software Ltd. Advanced Exploitation of Oracle PL/SQL Flaws David Litchfield (davidl@ngssoftware. com) NGS Consulting Next Generation Security Software Ltd. Objectives Objectives • Discuss current "threat landscape" • Introduce a new class of vulnerability • Introduce a new method of attack • Show practical demonstrations • Look at some defences NGS Consulting Next Generation Security Software Ltd. Agenda Agenda • PL/SQL Risks • SQL Injection • "Dangling" Cursor Snarfing • Cursor Injection • Demonstrations • Grant DBA Privileges • Indirect Privilege Escalation NGS Consulting Next Generation Security Software Ltd. What is PL/SQL? What is PL/SQL? • Procedural Language / Structured Query Language • Oracles extension to standard SQL Programmable like T-SQL in the Microsoft world. • Used to create • Stored Procedures • Functions • Packages (collections of procedures and functions) • Triggers • Objects • Extends functionality with External Procedures and Java NGS Consulting Next Generation Security Software Ltd. Privileges - Definer vs. Invoker rights Privileges - Definer vs. Invoker rights • PL/SQL executes with the privileges of the definer • A procedure owned by SYS executes with SYS privileges • AUTHID CURRENT_USER keyword • PL/SQL created using the AUTHID CURRENT_USER keyword executes with the privileges of the invoker • A procedure owned by SYS but called by SCOTT executes with the privileges of SCOTT • Analogous to Suid programs in the *nix world. NGS Consulting Next Generation Security Software Ltd. Running SQL from PL/SQL Running SQL from PL/SQL • EXECUTE IMMEDIATE … • OPEN • DBMS_SQL • Key to Cursor Snarfing and Cursor Injection NGS Consulting Next Generation Security Software Ltd. DBMS_SQL DBMS_SQL DECLARE MY_CURSOR NUMBER; MY_RESULT NUMBE ...

 

 

execute immediate pl sql like t sql, sony kdl 46vl130 vs panasonic th 50pe700u