ITPub博客

首页 > 数据库 > Oracle > Hijacking user's password

Hijacking user's password

原创 Oracle 作者:warmbreeze 时间:2016-10-18 13:56:45 0 删除 编辑
在不知道数据库账号密码的情况下,如果需要以此账号登录,有两个方法:


1.临时修改密码
SYS@db1>select * from v$version;
BANNER
--------------------------------------------------------------------------------
Oracle Database 11g Enterprise Edition Release 11.2.0.4.0 - 64bit Production
PL/SQL Release 11.2.0.4.0 - Production
CORE    11.2.0.4.0      Production
TNS for Linux: Version 11.2.0.4.0 - Production
NLSRTL Version 11.2.0.4.0 - Production


SYS@db1>select password from user$ where name='TEST1';
PASSWORD
------------------------------
22F2E341BF4B8764




SYS@db1>alter user test1 identified by temppwd;


User altered.


SYS@db1>conn test1/temppwd
Connected.
TEST1@db1>conn / as sysdba
Connected.


SYS@db1>alter user test1 identified by values '22F2E341BF4B8764';


User altered.


SYS@db1>conn test1/test1
Connected.


2.proxy user
SYS@db1>alter user test1 grant connect through test;
User altered.
SYS@db1>conn test[test1]/test
Connected.
TEST1@db1>show user
USER is "TEST1"


TEST1@db1>SELECT * FROM proxy_users where proxy='TEST';


PROXY                          CLIENT                         AUT
------------------------------ ------------------------------ ---
FLAGS
-----------------------------------
TEST                           TEST1                          NO
PROXY MAY ACTIVATE ALL CLIENT ROLES


TEST1@db1>conn / as sysdba
Connected.
SYS@db1>alter user test1 revoke connect through test;


User altered.


SYS@db1>SELECT * FROM proxy_users where proxy='TEST';


no rows selected


SYS@db1>conn test[test1]/test
ERROR:
ORA-01017: invalid username/password; logon denied




Warning: You are no longer connected to ORACLE.

来自 “ ITPUB博客 ” ,链接:https://blog.itpub.net/37279/viewspace-2126646/ ,如需转载,请注明出处,否则将追究法律责任。

请登录后发表评论 登录
全部评论

注册时间:2012-02-15

  • 博文量
    45
  • 访问量
    53181