[20230508]crack oracle執行檔案.txt

[20230508]crack oracle執行檔案.txt

--//昨天看了連結:
--//提到open階段執行如下:
----- Current SQL Statement for this session (sql_id=gtf6tgc2ycgxx) -----
select count(*) from XDB.XDB$SCHEMA s where s.xmldata.schema_url = '
--//報ORA-07445 kglsget錯誤處理.這個不是啟動必須的,可以規避掉該sql執行.
--//自己從來沒有做過這樣的事情,測試看看,千萬不要在生產系統做這類測試!!

1.環境:

SCOTT@book> @ver1
PORT_STRING                    VERSION        BANNER
------------------------------ -------------- --------------------------------------------------------------------------------
x86_64/Linux 2.4.xx            11.2.0.4.0     Oracle Database 11g Enterprise Edition Release 11.2.0.4.0 - 64bit Production

--//啟動資料庫,馬上執行如下,看看共享池是否存在該語句.最好啟動馬上看,不然可能執行次數少已經不在共享池了.
SYS@book> @sql_id gtf6tgc2ycgxx
--SQL_ID = gtf6tgc2ycgxx
select count(*) from XDB.XDB$SCHEMA s where s.xmldata.schema_url = ';

SYS@book> select count(*) from XDB.XDB$SCHEMA s where s.xmldata.schema_url = ';
  COUNT(*)
----------
         1

--//關閉資料庫略,開始crack,安全起見做一個oracle執行檔案的備份在關閉資料庫的情況下.

$ which oracle
/u01/app/oracle/product/11.2.0.4/dbhome_1/bin/oracle

$ cd /u01/app/oracle/product/11.2.0.4/dbhome_1/bin
$ cp oracle oracle_20230508

$ ll oracle*
-rwsr-s--x 1 oracle oinstall 239627073 2021-07-21 10:16:30 oracle
-rwxr-x--x 1 oracle oinstall 239627073 2023-05-08 09:00:57 oracle_20230508
-rwsr-s--x 1 oracle oinstall 239627073 2021-07-21 09:50:16 oracleO

2.測試:
$ strings -t d oracle | grep 'select count(\*) from XDB.XDB$SCHEMA s where s.xmldata.schema_url ='
165404960 select count(*) from XDB.XDB$SCHEMA s where s.xmldata.schema_url = '

$ strings oracle | grep 'select count(\*) from XDB.XDB$SCHEMA s where s.xmldata.schema_url =' |wc -c
111

$ bvi -b 165404960 -s 111 oracle

09DBE120  73 65 6C 65 63 74 20 63 6F 75 6E 74 28 2A 29 20 66 72 6F 6D 20 58 44 42 2E 58 44 42 24 53 43 48 select count(*) from XDB.XDB$SCH
09DBE140  45 4D 41 20 73 20 77 68 65 72 65 20 73 2E 78 6D 6C 64 61 74 61 2E 73 63 68 65 6D 61 5F 75 72 6C EMA s where s.xmldata.schema_url
09DBE160  20 3D 20 27 68 74 74 70 3A 2F 2F 78 6D 6C 6E 73 2E 6F 72 61 63 6C 65 2E 63 6F 6D 2F 78 64 62 2F  = '
09DBE180  58 44 42 53 63 68 65 6D 61 2E 78 73 64 27 00                                                    XDBSchema.xsd'.

--//修改如下:
select count(*) from sys.dual
--//注意後面字元都使用空格代替.實際上我還多顯示了1個字元結尾的0x00.

09DBE120  73 65 6C 65 63 74 20 63 6F 75 6E 74 28 2A 29 20 66 72 6F 6D 20 73 79 73 2E 64 75 61 6C 20 20 20 select count(*) from sys.dual
09DBE140  20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
09DBE160  20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
09DBE180  20 20 20 20 20 20 20 20 20 20 20 20 20 20 00

3.嘗試啟動資料庫看看.
SYS@book> startup
ORACLE instance started.
Total System Global Area  643084288 bytes
Fixed Size                  2255872 bytes
Variable Size             205521920 bytes
Database Buffers          427819008 bytes
Redo Buffers                7487488 bytes
Database mounted.
Database opened.

SYS@book> @sql_id gtf6tgc2ycgxx
--SQL_ID = gtf6tgc2ycgxx

--//檢查alert日誌沒有任何問題.使用一小段時間沒有任何問題.

4.收尾還原.
--//關閉資料庫略.
$ cp oracle_20230508 oracle

$ ll oracle*
-rwxr-x--x 1 oracle oinstall 239627073 2023-05-08 09:21:49 oracle
-rwxr-x--x 1 oracle oinstall 239627073 2023-05-08 09:00:57 oracle_20230508
-rwsr-s--x 1 oracle oinstall 239627073 2021-07-21 09:50:16 oracleO

--//再次使用bvi檢檢視看內容,輸出略.
$ bvi -b 165404960 -s 111 oracle