Un-Hacking the Oracle Database

“This is a video that I created for the Palsit security conference in Ljubljana recently. It would have been nice to go to Slovenia and present in person or even have done it live over webex but due to the pandemic i was asked to pre-record so that it was easier for the organisers. So here it is. This is a talk that is an overview of Oracle security and securing an Oracle database in the current age.” (Pete Finnigan)
Source: https://www.youtube.com/watch?v=Ia80xehOuyY
© PeteFinnigan.com Limited

VirtualBox vm USB passthrough issues ?

Since a while I ran into the problem where my VirtualBox vms weren’t able to mount external USB devices (which were available on the host system). After spending a night puzzling and many many reboots, I found a working solution.

Problem

Host:                                      Microsoft Windows 10 Enterprise, Version 1809

VirtualBox version:             6.0.4

  • Oracle VM VirtualBox Extension Pack 6.0.4

Virtual machines:             Microsoft Windows 10 Enterprise, Version 1803

  • Oracle VM VirtualBox Guest Additions Version 6.0.4

Ubuntu 18.04.2 LTS

  • Oracle VM VirtualBox Guest Additions Version 6.0.4

Whenever I wanted to mount an USB device in a vm I got no response at all. Trying it a second time got me this message:

USB device ‘SanDisk Ultra Fit’ with UUID {c851d433-3939-4170-a131-b5a2e6016da1} is busy with a previous request. Please try again later.

Result code:E_INVALIDARG (0x80070057)

Solution

This was consistent behaviour for both vms. So I shifted my focus towards the host.

Ater monitoring USB with USBDeview, working through several logfiles (Get-Content “C:\Users\<user>\VirtualBox VMs\Linux\Logs\*.log” -Wait -Tail 30), many discussions on IRC and following several suggestions for different forums I came to the conclusion that the solution is, either deleting the (host) registry key UpperFilters in HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{36FC9E60-C456-12CF-8078-44455443540000} or manually (re)installing the VirtualBox USB driver (rightmouse-click on C:\Program Files\Oracle\VirtualBox\drivers\USB\filter\VboxUSBMon.inf and choose Install). (Reboots required).

Source:      https://forums.virtualbox.org/viewtopic.php?f=6&t=39104#p176270

After this I got an error when trying to mount an USB device:

ERROR [COM]: aRC=E_FAIL (0x80004005) aIID={872da645-4a9b-1727-bee2-5585105b9eed} aComponent={ConsoleWrap} aText={Failed to create a proxy device for the USB device. (Error: VERR_PDM_NO_USB_PORTS)}, preserve=false aResultDetail=-2861

Solution, enable USB 3.0 (note, requires Extenstion Pack); for testing purposes I changed this to a lower version

I wasn’t able to determine the root cause; it would take more time and more thorough testing to come up with that. This workaround, however, seems to be consistent, too 🙂

Forensic SGA capture

This script can help you in gathering artifacts for an Oracle SGA and deliver it in such a way that its integrity can be verified (written for Oracle Database Server on Linux). Please find a demo video below the code.

#!/bin/bash
if [ $# -ne 2 ]; then
echo &amp;amp;amp;amp;amp;quot;Usage: $0 &amp;amp;amp;amp;amp;amp;amp;amp;amp;lt;output filename&amp;amp;amp;amp;amp;amp;amp;amp;amp;gt; &amp;amp;amp;amp;amp;amp;amp;amp;amp;lt;seconds to read (first thousand characters) from shared SQL area&amp;amp;amp;amp;amp;amp;amp;amp;amp;gt;&amp;amp;amp;amp;amp;quot;
exit 1
fi
if [[ &amp;amp;amp;amp;amp;quot;$2&amp;amp;amp;amp;amp;quot; != +([0-9]) ]]
then
echo &amp;amp;amp;amp;amp;quot;Usage:       $0 &amp;amp;amp;amp;amp;amp;amp;amp;amp;lt;output filename&amp;amp;amp;amp;amp;amp;amp;amp;amp;gt; &amp;amp;amp;amp;amp;amp;amp;amp;amp;lt;seconds to read (first thousand characters) from shared SQL area&amp;amp;amp;amp;amp;amp;amp;amp;amp;gt;&amp;amp;amp;amp;amp;quot;
echo &amp;amp;amp;amp;amp;quot;For example: $0 case_suspicion 120&amp;amp;amp;amp;amp;quot;
exit 1
fi
STARTTIME=$(date +'%Y%m%d %H:%M:%S.%N')
FILE=$1
echo &amp;amp;amp;amp;amp;quot;**************************************************************&amp;amp;amp;amp;amp;quot; &amp;amp;amp;amp;amp;amp;amp;amp;amp;gt; &amp;amp;amp;amp;amp;quot;$FILE.log&amp;amp;amp;amp;amp;quot;
echo &amp;amp;amp;amp;amp;quot;&amp;amp;amp;amp;amp;quot; &amp;amp;amp;amp;amp;amp;amp;amp;amp;gt;&amp;amp;amp;amp;amp;amp;amp;amp;amp;gt; &amp;amp;amp;amp;amp;quot;$FILE.log&amp;amp;amp;amp;amp;quot;
echo &amp;amp;amp;amp;amp;quot;- Start at $STARTTIME &amp;amp;amp;amp;amp;quot; &amp;amp;amp;amp;amp;amp;amp;amp;amp;gt;&amp;amp;amp;amp;amp;amp;amp;amp;amp;gt; &amp;amp;amp;amp;amp;quot;$FILE.log&amp;amp;amp;amp;amp;quot;
STARTRUN=$(date +'%Y%m%d %H:%M:%S.%N')
STARTTOTAL=`date +%s`
SECS=$2
SECONDS=0
while (( $SECONDS &amp;amp;amp;amp;amp;amp;amp;amp;amp;lt; $SECS )); do
sqlplus -s /nolog  &amp;amp;amp;amp;amp;amp;amp;amp;amp;lt;&amp;amp;amp;amp;amp;amp;amp;amp;amp;lt;EOF connect / as sysdba alter session set nls_date_format='YYYYMMDDHH24MISS'; alter session set nls_timestamp_format='YYYYMMDDHH24MISSFF'; spool $FILE.dsv append -- ----------------------------------------------------------------------------- -- WWW.PETEFINNIGAN.COM LIMITED -- ----------------------------------------------------------------------------- -- Script Name : sga.sql -- Author : Pete Finnigan -- Date : September 2017 -- ----------------------------------------------------------------------------- -- Description : get SQL Text from the SGA -- ----------------------------------------------------------------------------- -- Maintainer : Pete Finnigan (http://www.petefinnigan.com) -- Copyright : Copyright (C) 2007 to 2017 PeteFinnigan.com Limited. All rights -- reserved. All registered trademarks are the property of their -- respective owners and are hereby acknowledged. -- ----------------------------------------------------------------------------- -- License : This software is licensed to you by PeteFinnigan.com Limited. All -- rights and ownership and copyright in the software are retained by -- PeteFinnigan.com Limited in all possible cases. Posession of this -- software does not infer any additonal rights. If you receive this -- software without these copyright notices and license text, this text, -- license and copyright still applies. This text, copyright and license -- must not be removed under any circumstances. This applies to all -- text displayed as comments up until and including the version history, -- This text also applies to any copyright, banner or other text -- refering to PeteFinnigan.com Limited ownership that is output by -- the program. -- -- This software is free to use BUT it is NOT open source and NOT GPL -- or any similar license and it is NOT in the public domain. -- -- You are permitted to use this software commercially or privately -- provided these notices or banners as described are not removed. You -- may modify the software and use it internally but this does not -- infer any additonal rights in the software. i.e. if you delete -- some of our code or change variable names or add features that does -- not make it your code and does not give you the right to remove -- our ownership in this software shown in these notices. This software must -- not be made available or published in anyway, any language, any -- modified form or original form except by PeteFinnigan.com Limited. -- You must not incorporate this software into any free or commercial -- product or software and you must not sell or give away any software that -- includes this sofware. -- -- -- In short this text is not written by a lawyer so please respect the -- intent that you can use or modify it freely but not give it away -- yourself or take away our right to attribution. -- If someone else needs a copy please ask them to come to PeteFinnigan.com -- Limited and we will happily let them also have a free copy. Also -- as you may expect freely use does not include adding this software to -- a commercial or free product (without our permission) but you -- can use it internally in projects. We put our time into the free scripts -- on our website or training courses and give these tools away for free and -- in return we expect our copyright and ownership to always remain. -- We like to help people but we also want to benefit from the fact -- our name becomes known through these scripts and tools and software -- that we make. We hope this makes sense. -- -- -- ----------------------------------------------------------------------------- -- Version History -- =============== -- -- Who version Date Description -- === ======= ====== ====================== -- P.Finnigan 1.0 Sep 2017 First Issue. set pages 0 set lines 2000 select sql_id ||'|'||sql_text ||'|'||first_load_time ||'|'||parsing_user_id ||'|'||parsing_schema_id ||'|'||service ||'|'||module ||'|'||action ||'|'||last_load_time ||'|'||last_active_time from gv$sql; exit EOF done ENDTIME=$(date +'%Y%m%d %H:%M:%S.%N') ENDTOTAL=`date +%s` RUNTIME=$((ENDTOTAL-STARTTOTAL)) echo &amp;amp;amp;amp;amp;quot;- End at $ENDTIME &amp;amp;amp;amp;amp;quot; &amp;amp;amp;amp;amp;amp;amp;amp;amp;gt;&amp;amp;amp;amp;amp;amp;amp;amp;amp;gt; &amp;amp;amp;amp;amp;quot;$FILE.log&amp;amp;amp;amp;amp;quot;
echo &amp;amp;amp;amp;amp;quot;&amp;amp;amp;amp;amp;quot; &amp;amp;amp;amp;amp;amp;amp;amp;amp;gt;&amp;amp;amp;amp;amp;amp;amp;amp;amp;gt; &amp;amp;amp;amp;amp;quot;$FILE.log&amp;amp;amp;amp;amp;quot;
echo &amp;amp;amp;amp;amp;quot;SHA512 message digest:&amp;amp;amp;amp;amp;quot; &amp;amp;amp;amp;amp;amp;amp;amp;amp;gt;&amp;amp;amp;amp;amp;amp;amp;amp;amp;gt; &amp;amp;amp;amp;amp;quot;$FILE.log&amp;amp;amp;amp;amp;quot;
/usr/bin/sha512sum $FILE.dsv &amp;amp;amp;amp;amp;amp;amp;amp;amp;gt;&amp;amp;amp;amp;amp;amp;amp;amp;amp;gt; &amp;amp;amp;amp;amp;quot;$FILE.log&amp;amp;amp;amp;amp;quot;
echo &amp;amp;amp;amp;amp;quot;&amp;amp;amp;amp;amp;quot; &amp;amp;amp;amp;amp;amp;amp;amp;amp;gt;&amp;amp;amp;amp;amp;amp;amp;amp;amp;gt; &amp;amp;amp;amp;amp;quot;$FILE.log&amp;amp;amp;amp;amp;quot;
echo &amp;amp;amp;amp;amp;quot;User defined seconds to read (first thousand characters) from shared SQL area was $SECS seconds&amp;amp;amp;amp;amp;quot; &amp;amp;amp;amp;amp;amp;amp;amp;amp;gt;&amp;amp;amp;amp;amp;amp;amp;amp;amp;gt;&amp;amp;amp;amp;amp;quot;$FILE.log&amp;amp;amp;amp;amp;quot;
echo &amp;amp;amp;amp;amp;quot;Script runtime duration was $RUNTIME seconds&amp;amp;amp;amp;amp;quot; &amp;amp;amp;amp;amp;amp;amp;amp;amp;gt;&amp;amp;amp;amp;amp;amp;amp;amp;amp;gt;&amp;amp;amp;amp;amp;quot;$FILE.log&amp;amp;amp;amp;amp;quot;
echo &amp;amp;amp;amp;amp;quot;&amp;amp;amp;amp;amp;quot; &amp;amp;amp;amp;amp;amp;amp;amp;amp;gt;&amp;amp;amp;amp;amp;amp;amp;amp;amp;gt; &amp;amp;amp;amp;amp;quot;$FILE.log&amp;amp;amp;amp;amp;quot;
echo &amp;amp;amp;amp;amp;quot;- Make a working copy of $FILE.dsv and store the original, including &amp;amp;amp;amp;amp;quot;$FILE.log&amp;amp;amp;amp;amp;quot;, as evidence. &amp;amp;amp;amp;amp;quot;&amp;amp;amp;amp;amp;amp;amp;amp;amp;gt;&amp;amp;amp;amp;amp;amp;amp;amp;amp;gt; &amp;amp;amp;amp;amp;quot;$FILE.log&amp;amp;amp;amp;amp;quot;
echo &amp;amp;amp;amp;amp;quot;- Use e.g. Elastic Stack or Splunk to import $FILE.dsv&amp;amp;amp;amp;amp;quot;&amp;amp;amp;amp;amp;amp;amp;amp;amp;gt;&amp;amp;amp;amp;amp;amp;amp;amp;amp;gt; &amp;amp;amp;amp;amp;quot;$FILE.log&amp;amp;amp;amp;amp;quot;
echo &amp;amp;amp;amp;amp;quot;- Or use spreadsheet tool to import $FILE.dsv with delimiter sign '|'&amp;amp;amp;amp;amp;quot;&amp;amp;amp;amp;amp;amp;amp;amp;amp;gt;&amp;amp;amp;amp;amp;amp;amp;amp;amp;gt; &amp;amp;amp;amp;amp;quot;$FILE.log&amp;amp;amp;amp;amp;quot;
echo &amp;amp;amp;amp;amp;quot;   For example in Microsoft Excel 2010:&amp;amp;amp;amp;amp;quot;&amp;amp;amp;amp;amp;amp;amp;amp;amp;gt;&amp;amp;amp;amp;amp;amp;amp;amp;amp;gt; &amp;amp;amp;amp;amp;quot;$FILE.log&amp;amp;amp;amp;amp;quot;
echo &amp;amp;amp;amp;amp;quot;   Open Microsoft Excel.&amp;amp;amp;amp;amp;quot;&amp;amp;amp;amp;amp;amp;amp;amp;amp;gt;&amp;amp;amp;amp;amp;amp;amp;amp;amp;gt; &amp;amp;amp;amp;amp;quot;$FILE.log&amp;amp;amp;amp;amp;quot;
echo &amp;amp;amp;amp;amp;quot;   Click on the Data tab.&amp;amp;amp;amp;amp;quot;&amp;amp;amp;amp;amp;amp;amp;amp;amp;gt;&amp;amp;amp;amp;amp;amp;amp;amp;amp;gt; &amp;amp;amp;amp;amp;quot;$FILE.log&amp;amp;amp;amp;amp;quot;
echo &amp;amp;amp;amp;amp;quot;   In the Get External Data group, click From Text.&amp;amp;amp;amp;amp;quot;&amp;amp;amp;amp;amp;amp;amp;amp;amp;gt;&amp;amp;amp;amp;amp;amp;amp;amp;amp;gt; &amp;amp;amp;amp;amp;quot;$FILE.log&amp;amp;amp;amp;amp;quot;
echo &amp;amp;amp;amp;amp;quot;   Double-click $FILE.dsv in the Import Text File dialogue box.&amp;amp;amp;amp;amp;quot;&amp;amp;amp;amp;amp;amp;amp;amp;amp;gt;&amp;amp;amp;amp;amp;amp;amp;amp;amp;gt; &amp;amp;amp;amp;amp;quot;$FILE.log&amp;amp;amp;amp;amp;quot;
echo &amp;amp;amp;amp;amp;quot;   Click Import.&amp;amp;amp;amp;amp;quot;&amp;amp;amp;amp;amp;amp;amp;amp;amp;gt;&amp;amp;amp;amp;amp;amp;amp;amp;amp;gt; &amp;amp;amp;amp;amp;quot;$FILE.log&amp;amp;amp;amp;amp;quot;
echo &amp;amp;amp;amp;amp;quot;   Select Delimited and click Next.&amp;amp;amp;amp;amp;quot;&amp;amp;amp;amp;amp;amp;amp;amp;amp;gt;&amp;amp;amp;amp;amp;amp;amp;amp;amp;gt; &amp;amp;amp;amp;amp;quot;$FILE.log&amp;amp;amp;amp;amp;quot;
echo &amp;amp;amp;amp;amp;quot;   Uncheck all and select Other and enter '|'&amp;amp;amp;amp;amp;quot;&amp;amp;amp;amp;amp;amp;amp;amp;amp;gt;&amp;amp;amp;amp;amp;amp;amp;amp;amp;gt; &amp;amp;amp;amp;amp;quot;$FILE.log&amp;amp;amp;amp;amp;quot;
echo &amp;amp;amp;amp;amp;quot;   Click Next.&amp;amp;amp;amp;amp;quot;&amp;amp;amp;amp;amp;amp;amp;amp;amp;gt;&amp;amp;amp;amp;amp;amp;amp;amp;amp;gt; &amp;amp;amp;amp;amp;quot;$FILE.log&amp;amp;amp;amp;amp;quot;
echo &amp;amp;amp;amp;amp;quot;**************************************************************&amp;amp;amp;amp;amp;quot;&amp;amp;amp;amp;amp;amp;amp;amp;amp;gt;&amp;amp;amp;amp;amp;amp;amp;amp;amp;gt; &amp;amp;amp;amp;amp;quot;$FILE.log&amp;amp;amp;amp;amp;quot;
if [ -f &amp;amp;amp;amp;amp;quot;$FILE.log&amp;amp;amp;amp;amp;quot; ]
then
cat &amp;amp;amp;amp;amp;quot;$FILE.log&amp;amp;amp;amp;amp;quot;
else
echo &amp;amp;amp;amp;amp;quot;$FILE.log not found.&amp;amp;amp;amp;amp;quot;
fi

Upgrade your database to 12c with RMAN Duplicate

If you duplicate a database to a higher version, you would restore a RMAN backup and upgrade that. Using duplicate would fail (ORA-39700) since it shall open the auxiliary with resetlogs.

In RMAN 12c, the “NOOPEN” option is available, requesting RMAN to complete the duplicate activity but NOT open the auxiliary database (this would allow for the ‘open upgrade’ option to be manually executed when going between versions).

Source: https://support.oracle.com/epmos/faces/DocumentDisplay?id=2022820.1

RMAN duplicate fails to create BCT file despite fix of bug 11744544 ( RMAN-11003 ORA-19750 )

Remember https://oracle.powerbytes.nl/ever-ran-into-an-ora-19755-with-rman/ ?

RMAN duplicate fails to create BCT file despite fix of bug 11744544 !!

Bug 18371441 : RMAN DUPLICATE FAILS TO CREATE BCT FILE

Created 09-03-2014, fixed in version 12.2

ORA-00283: recovery session canceled due to errors
ORA-19755: could not open change tracking file
ORA-19750: change tracking file: '+DATA/rac2prd/changetracking/ctf.2646.835861329'
ORA-27037: unable to obtain file status
Linux-x86_64 Error: 2: No such file or directory
---
RMAN-00571: ===========================================================
RMAN-00569: =============== ERROR MESSAGE STACK FOLLOWS ===============
RMAN-00571: ===========================================================
RMAN-03002: failure of Duplicate Db command at 01/23/2016 21:44:21
RMAN-05501: aborting duplication of target database
RMAN-03015: error occurred in stored script Memory Script
ORA-00283: recovery session canceled due to errors
RMAN-11003: failure during parse/execution of SQL statement: alter database reco
ver logfile '+DATA2/oracle/AUX/archivelog/2016_01_23/o1_mf_1_98404_urqs4ef3_.
arc'
ORA-00283: recovery session canceled due to errors
ORA-19755: could not open change tracking file
ORA-19750: change tracking file: '+DATA/rac2prd/changetracking/ctf.2646.835861329'
ORA-27037: unable to obtain file status
Linux-x86_64 Error: 2: No such file or directory

Solve with Patch 18371441

A workaround would be to disable change tracking before duplicating.

Ever ran into an ORA-19755 with RMAN?

Ever ran into an ORA-19755 with RMAN duplicate from target? When your source database uses block change tracking?

Try patch 11744544; it fixes the bug which could might cause block change tracking recreation fail in combination with OMF newnames.

A workaround would be to disable change tracking before duplicating.