Two papers on Oracle 11g Security
Hey all,
Since there seems to be a fair bit of disinformation, and utter nonsense,
floating around since my talk at the Black Hat Federal security conference
the other day, I have decided to publish the following papers.
http://www.databasesecurity.com/HackingAurora.pdf
http://www.databasesecurity.com/ExploitingPLSQLinOracle11g.pdf
Whilst the papers were written on the 14th and 21st of October respectively,
Oracle were informed on these issues discussed in these papers on the 11th
and 13th of October 2009.
The slides from the talk can be found here:
http://www.databasesecurity.com/bh-DC2010.pdf
Cheers,
David Litchfield
Ïà¹ØÎĵµ£º
¼ÙÉèÓÐÕÅ±í£¬½Ðtable1£¬ÀïÃæÓÐ5000ÍòÐÐÊý¾Ý£¬¼ÙÉèÔ¤¼ÆÈ«±íɨÃè1´ÎÐèÒª1¸öСʱ£¬ÎÒÃÇ´Ó¹ý³ÌÀ´¿´£º
1¡¢ÔÚ1µãÖÓ£¬ÓиöÓû§A·¢³öÁËselect * from table1;´Ëʱ²»¹Ü½«À´table1Ôõô±ä»¯£¬ÕýÈ·µÄ½á¹ûÓ¦¸ÃÊÇÓû§A»á¿´µ½ÔÚ1µãÖÓÕâ¸öʱ¿ÌµÄÄÚÈÝ¡£Õâ¸öÊÇûÓÐÒÉÎʵġ£
2¡¢ÔÚ1µã30·Ö£¬ÓиöÓû§BÖ´ÐÐÁËupdateÃüÁ¸üÐÂÁËtable1±íÖеĵ ......
oracle startupʱ ±¨´íORA-00600: ÄÚ²¿´íÎó´úÂ룬²ÎÊý: [kcratr1_lostwrt], [], [], [], [], [], [], []
ÔÒò¿ÉÄÜÊÇ·Ç·¨¹Ø»ú»òµôµçÔì³É,ÒÔÏÂÊdzöÏÖµÄÎÊÌâ¼°½â¾ö·½·¨:
C:\Documents and Settings\Administrator>sqlplus
ÇëÊäÈëÓû§Ãû: /as sysdba
SQL> startup
ORA-01081: ÎÞ·¨Æô¶¯ÒÑÔÚÔËÐÐµÄ ORACLE ......
¹¦ÄÜ£ºOracleÊý¾Ýµ¼Èëµ¼³öimp/exp¾ÍÏ൱ÓëoracleÊý¾Ý»¹ÔÓ뱸·Ý¡£´ó¶àÇé¿ö¶¼¿ÉÒÔÓÃOracleÊý¾Ýµ¼Èëµ¼³öÍê³ÉÊý¾ÝµÄ±¸·ÝºÍ»¹Ô£¨²»»áÔì³ÉÊý¾ÝµÄ¶ªÊ§£©¡£
¡¡¡¡OracleÓиöºÃ´¦£¬ËäÈ»ÄãµÄµçÄÔ²»ÊÇ·þÎñÆ÷£¬µ«ÊÇÄã×°ÁËoracle¿Í»§¶Ë£¬²¢½¨Á¢ÁËÁ¬½Ó £¨Í¨¹ýnet8 assistantÖб¾µØ——>·þÎñÃüÃû Ìí¼ÓÕýÈ·µÄ·þÎñÃüÃû
¡¡¡¡Æ ......
1.´´½¨Ñ§Éú±í£º
CREATE TABLE student (
xh number primary key,
Name varchar2(10) not null);
2. ´´½¨ÐòÁУº
CREATE SEQUENCE student_seq
START WITH 1
INCREMENT BY 1
NOCACHE;
°´»Ø³ ......
--ÈÕÆÚת»»ºÁÃë
SELECT TO_NUMBER(TO_DATE('2005-03-29 12:30:45', 'YYYY-MM-DD HH24:MI:SS') -
TO_DATE('1970-01-01 8:0:0', 'YYYY-MM-DD HH24:MI:SS')) * 24 * 60 * 60 * 1000
from DUAL;
--ºÁÃëת»»ÈÕÆÚ
SELECT TO_CHAR(1112070645000 / (1000 * 60 * 60 * 24) +
TO_ ......