The Oracle® Hacker's Handbook: Hacking and Defending Oracle

11.4. Exploring Operating System Environment Variables

Oracle 10g introduced a procedure called GET_ENV in the DBMS_SYSTEM package. This procedure takes the name of an environment variable and returns its value. It will not return the value for the PATH environment variable, however:

CREATE OR REPLACE PROCEDURE DUMP_ENV AS
BUFFER VARCHAR2(260);

BEGIN -- SYS.DBMS_SYSTEM.GET_ENV WON'T GIVE BACK THE -- PATH ENVIRONMENT VARIABLE SYS.DBMS_SYSTEM.GET_ENV('ORACLE_HOME',BUFFER); DBMS_OUTPUT.PUT_LINE('ORACLE_HOME: ' || BUFFER); SYS.DBMS_SYSTEM.GET_ENV('ORACLE_SID',BUFFER); DBMS_OUTPUT.PUT_LINE('ORACLE_SID: ' || BUFFER); SYS.DBMS_SYSTEM.GET_ENV('COMPUTERNAME',BUFFER); DBMS_OUTPUT.PUT_LINE('COMPUTERNAME: ' || BUFFER); SYS.DBMS_SYSTEM.GET_ENV('OS',BUFFER); DBMS_OUTPUT.PUT_LINE('OS: ' || BUFFER); SYS.DBMS_SYSTEM.GET_ENV('TEMP',BUFFER); DBMS_OUTPUT.PUT_LINE('TEMP: ' || BUFFER); SYS.DBMS_SYSTEM.GET_ENV('WINDIR',BUFFER); DBMS_OUTPUT.PUT_LINE('WINDIR: ' || BUFFER); SYS.DBMS_SYSTEM.GET_ENV('SYSTEMROOT',BUFFER); DBMS_OUTPUT.PUT_LINE('SYSTEMROOT: ' || BUFFER); SYS.DBMS_SYSTEM.GET_ENV('PROGRAMFILES',BUFFER); DBMS_OUTPUT.PUT_LINE('PROGRAMFILES: ' || BUFFER); SYS.DBMS_SYSTEM.GET_ENV('COMSPEC',BUFFER); DBMS_OUTPUT.PUT_LINE('COMSPEC: ' || BUFFER); SYS.DBMS_SYSTEM.GET_ENV('PROCESSOR_ARCHITECTURE',BUFFER); DBMS_OUTPUT.PUT_LINE('PROCESSOR_ARCHITECTURE: ' || BUFFER); SYS.DBMS_SYSTEM.GET_ENV('PROCESSOR_IDENTIFIER',BUFFER); DBMS_OUTPUT.PUT_LINE('PROCESSOR_IDENTIFIER: ' || BUFFER); END DUMP_ENV; / EXEC DUMP_ENV; ...