Oracle Forensics Book ~ Now Available
About time too! Copies available through Rampant Techpress. Author’s copies in the UK can be made available to reviewers by contacting reviewcopy@oracleforensics.com.
Cheers and Merry Christmas 2007
Archive for December, 2007
SYSDBA Backdoor without direct OS access
First half of SYSDBA BACKDOOR paper is easily done without OS access
————————————————————————–
Attacker brute forces a SYSDBA user and wishes to create a user that is hidden from SYS.USER$.
1. CREATE USER
2. GRANT SYSDBA TO USER
3. Rename password file via UTL_FILE.RENAME (requires CREATE DIRECTORY).
4. DROP USER via the DB to lose from SYS.USER$
5. Rename password file back
In [...]
Archives
- March 2010
- February 2010
- January 2010
- December 2009
- November 2009
- October 2009
- August 2009
- July 2009
- April 2009
- January 2009
- December 2008
- November 2008
- October 2008
- September 2008
- August 2008
- July 2008
- June 2008
- May 2008
- April 2008
- March 2008
- January 2008
- December 2007
- October 2007
- August 2007
- July 2007
- May 2007
- April 2007
- March 2007
- February 2007
