Oracle PL/SQL Injection

Source: www.blackhat.com
Topic: Oracle Programming

Short Desciption:
NGS Consulting Next Generation Security Software Ltd. What is PL/SQL? What is PL/SQL? • Procedural Language / Structured Query Language • Oracles extension to standard SQL Programmable like T-SQL ...

 

Content Inside:
NGS Consulting Next Generation Security Software Ltd. Oracle PL/SQL Injection David Litchfield NGS Consulting Next Generation Security Software Ltd. What is PL/SQL? What is PL/SQL? • Procedural Language / Structured Query Language • Oracles extension to standard SQL Programmable like T-SQL in the Microsoft world. • Used to create • Stored Procedures • Functions • Packages (collections of procedures and functions) • Triggers • Objects • Extends functionality with External Procedures NGS Consulting Next Generation Security Software Ltd. Privileges - Definer vs. Invoker rights Privileges - Definer vs. Invoker rights • PL/SQL executes with the privileges of the definer • A procedure owned by SYS executes with SYS privileges • AUTHID CURRENT_USER keyword • PL/SQL created using the AUTHID CURRENT_USER keyword executes with the privileges of the invoker • A procedure owned by SYS but called by SCOTT executes with the privileges of SCOTT • Analogous to Suid programs in the *nix world. NGS Consulting Next Generation Security Software Ltd. PL/SQL over the Web PL/SQL over the Web • Oracle Application Server / Web Portal • http://server/pls/dad/pkg.proc?p_in=foobar • Acts as a proxy, passes request to the database server and the PL/SQL executes inside the database server - not the front end. NGS Consulting Next Generation Security Software Ltd. PL/SQL Injection PL/SQL Injection • SELECT statements • DML - UPDATE, DELETE, INSERT • Anonymous PL/SQL Blocks in Procedures NGS Consulting Next Generation Security Software Ltd. PL/SQL SELECT Example PL/SQL SELECT Example CREATE OR REPLACE PROCEDURE LIST_LIBRARIES(P_OWNER VARCHAR2) AS TYPE C_TYPE IS REF CURSOR; CV C_TYPE; BUFFER VARCHAR2(200); BEGIN DBMS_OUTPUT.ENABLE(1000000); OPEN CV FOR SELECT OBJECT_NAME FROM ALL_OBJECTS WHERE OWNER = || P_OWNER || AND OBJECT_TYPE=LIBRARY; LOOP FE ...

 

 

oracle discoverer sql injection