I’ve already showed you, how to escalate privileges in Oracle Databases.
- https://blog.ora-600.pl/2013/04/02/privilege-escalation-in-oracle-11gr2-part1/
- https://blog.ora-600.pl/2014/12/23/simple-technics-of-privilege-escalation-part2-dbasysdba/
The question is – how to secure your database, if you don’t have EE or possibility to buy Oracle Database Vault or Oracle Advanced Security. Well – there’s always a DBA creativity 😉
For example – if you want to secure the system from creating unwanted DIRECTORY objects, you can create the following trigger as SYSDBA:
1 | create or replace trigger trc_sec_directories |
2 | before create on database |
3 | declare |
4 | v_dirs varchar2(32000):='/bin/,/dev/,/etc/,/sbin/,/home/oracle/,/home/oracle/.ssh/,/u01/app/oracle/product/11.2.0/dbhome_1/,/u01/app/oracle/product/11.2.0/dbhome_1/sqlplus/admin/,/u01/app/oracle/product/11.2.0/dbhome_1/lib/,/u01/app/oracle/product/11.2.0/dbhome_1/bin/,/u01/app/oracle/product/11.2.0/dbhome_1/dbs/,/u01/app/oracle/product/11.2.0/dbhome_1/rdbms/lib/,/u01/app/oracle/product/11.2.0/dbhome_1/rdbms/admin/'; |
5 | v_dir_name varchar2(30); |
6 | v_sql_list ora_name_list_t; |
7 | v_sql_text clob; |
8 | v_cnt number; |
9 | begin |
10 | if ora_dict_obj_type='DIRECTORY' then |
11 | v_cnt:=ora_sql_txt(v_sql_list); |
12 | for i in 1..v_cnt loop |
13 | v_sql_text:=v_sql_text || v_sql_list(i); |
14 | end loop; |
15 | if regexp_like(v_dirs,trim(replace(substr(v_sql_text,instr(lower(v_sql_text), 'as')+2),'''',''))) then |
16 | raise_application_error(-20666, 'Insufficient privileges'); |
17 | end if; |
18 | end if; |
19 | end; |
20 | / |
Each time, someone will try to create a directory, pointing to those, stored in V_DIRS variable, an exception will be thrown.