Many times during Penetration Tests, we found a limited account for the Oracle database server. The next step would be to find a SQL injection vulnerability to obtain DBA privileges. There are a number of Metasploit modules that we can use to escalate to DBA privileges. The Metasploit modules scripts below are for different varying versions of Oracle database servers. I cant remember which Metasploit modules are for which versions.
To speed things up, I wrote a script that does the below
(1) Check if the account specified has access to the database
(2) Check if the account has DBA privileges
(3) If no, check the version of the Oracle database server
(4) Select the relevant Oracle SQL injection modules for that version of Oracle database and write a Metasploit resource script to disk
(5) Run the Metasploit resource script and attempt to gain DBA privileges
(6) Check permissions of account and verifies if DBA privileges have been obtained.
The script is still a work in progress. You can download the script via the below link.
I converted the original WordPress Plugin NextGEN Gallery 1.9.12 Arbitrary File Upload exploit from Perl to Python for fun.
The original exploit can be found at http://downloads.securityfocus.com/vulnerabilities/exploits/60533.pl
Below is the python script for CVE-2013-3684
I have been working with ManageEngine support team on getting the issue fixed and also informing the customers to patch their system with the latest service pack release version 8012 for over a month plus.
The vulnerability has been published in the below sites.
Below are the details of the vulnerability.
Google Dork: ie: intitle:ManageEngine ServiceDesk Plus”
Author: Keith Lee (firstname.lastname@example.org
Software Link: http://www.manageengine.com/products/service-desk/91677414/ManageEngine_ServiceDesk_Plus.exe
Directory traversal vulnerabilities has been found in ManageEngine
ServiceDesk Plus 8.0 a web
based helpdesk system written in Java.
The vulnerability can be exploited to access local files by entering
special characters in variables used to create file paths. The attackers
use �../� sequences to move up to root directory, thus permitting
navigation through the file system.
The issue is fixed with Service Pack Build 8012 found in the below link.