[20230508]crack oracle执行文件.txt
--//昨天看了链接:https://www.xifenfei.com/2023/04/ora-07445-kglsget.html
--//提到open阶段执行如下:
----- Current SQL Statement for this session (sql_id=gtf6tgc2ycgxx) -----
select count(*) from XDB.XDB$SCHEMA s where s.xmldata.schema_url = 'http://xmlns.oracle.com/xdb/XDBSchema.xsd'
--//报ORA-07445 kglsget错误处理.这个不是启动必须的,可以规避掉该sql执行.
--//自己从来没有做过这样的事情,测试看看,千万不要在生产系统做这类测试!!
1.环境:
SCOTT@book> @ver1
PORT_STRING VERSION BANNER
------------------------------ -------------- --------------------------------------------------------------------------------
x86_64/Linux 2.4.xx 11.2.0.4.0 Oracle Database 11g Enterprise Edition Release 11.2.0.4.0 - 64bit Production
--//启动数据库,马上执行如下,看看共享池是否存在该语句.最好启动马上看,不然可能执行次数少已经不在共享池了.
SYS@book> @sql_id gtf6tgc2ycgxx
--SQL_ID = gtf6tgc2ycgxx
select count(*) from XDB.XDB$SCHEMA s where s.xmldata.schema_url = 'http://xmlns.oracle.com/xdb/XDBSchema.xsd';
SYS@book> select count(*) from XDB.XDB$SCHEMA s where s.xmldata.schema_url = 'http://xmlns.oracle.com/xdb/XDBSchema.xsd';
COUNT(*)
----------
1
--//关闭数据库略,开始crack,安全起见做一个oracle执行文件的备份在关闭数据库的情况下.
$ which oracle
/u01/app/oracle/product/11.2.0.4/dbhome_1/bin/oracle
$ cd /u01/app/oracle/product/11.2.0.4/dbhome_1/bin
$ cp oracle oracle_20230508
$ ll oracle*
-rwsr-s--x 1 oracle oinstall 239627073 2021-07-21 10:16:30 oracle
-rwxr-x--x 1 oracle oinstall 239627073 2023-05-08 09:00:57 oracle_20230508
-rwsr-s--x 1 oracle oinstall 239627073 2021-07-21 09:50:16 oracleO
2.测试:
$ strings -t d oracle | grep 'select count(\*) from XDB.XDB$SCHEMA s where s.xmldata.schema_url ='
165404960 select count(*) from XDB.XDB$SCHEMA s where s.xmldata.schema_url = 'http://xmlns.oracle.com/xdb/XDBSchema.xsd'
$ strings oracle | grep 'select count(\*) from XDB.XDB$SCHEMA s where s.xmldata.schema_url =' |wc -c
111
$ bvi -b 165404960 -s 111 oracle
09DBE120 73 65 6C 65 63 74 20 63 6F 75 6E 74 28 2A 29 20 66 72 6F 6D 20 58 44 42 2E 58 44 42 24 53 43 48 select count(*) from XDB.XDB$SCH
09DBE140 45 4D 41 20 73 20 77 68 65 72 65 20 73 2E 78 6D 6C 64 61 74 61 2E 73 63 68 65 6D 61 5F 75 72 6C EMA s where s.xmldata.schema_url
09DBE160 20 3D 20 27 68 74 74 70 3A 2F 2F 78 6D 6C 6E 73 2E 6F 72 61 63 6C 65 2E 63 6F 6D 2F 78 64 62 2F = 'http://xmlns.oracle.com/xdb/
09DBE180 58 44 42 53 63 68 65 6D 61 2E 78 73 64 27 00 XDBSchema.xsd'.
--//修改如下:
select count(*) from sys.dual
--//注意后面字符都使用空格代替.实际上我还多显示了1个字符结尾的0x00.
09DBE120 73 65 6C 65 63 74 20 63 6F 75 6E 74 28 2A 29 20 66 72 6F 6D 20 73 79 73 2E 64 75 61 6C 20 20 20 select count(*) from sys.dual
09DBE140 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
09DBE160 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
09DBE180 20 20 20 20 20 20 20 20 20 20 20 20 20 20 00
3.尝试启动数据库看看.
SYS@book> startup
ORACLE instance started.
Total System Global Area 643084288 bytes
Fixed Size 2255872 bytes
Variable Size 205521920 bytes
Database Buffers 427819008 bytes
Redo Buffers 7487488 bytes
Database mounted.
Database opened.
SYS@book> @sql_id gtf6tgc2ycgxx
--SQL_ID = gtf6tgc2ycgxx
--//检查alert日志没有任何问题.使用一小段时间没有任何问题.
4.收尾还原.
--//关闭数据库略.
$ cp oracle_20230508 oracle
$ ll oracle*
-rwxr-x--x 1 oracle oinstall 239627073 2023-05-08 09:21:49 oracle
-rwxr-x--x 1 oracle oinstall 239627073 2023-05-08 09:00:57 oracle_20230508
-rwsr-s--x 1 oracle oinstall 239627073 2021-07-21 09:50:16 oracleO
--//再次使用bvi检查看看内容,输出略.
$ bvi -b 165404960 -s 111 oracle