Pete Finnigan's Oracle Security Weblog

Argeniss have, as part of the download from Cesar Cerrudo's recent Blackhat presentation released a simple Oracle rootkit. https://www.blackhat.com/presentations/bh-eu-07/Cerrudo/Cerrudo-Additional-Materials.zip - (broken link) The code can be downloaded from here. This rootkit as i said is quite simple and includes an installer, a backdoor, some Java code to read and write the file system and a mechanism to run export from within the database and to transfer the data out of the database over a network port. The code also includes a clean up script. Its a long way from a complete kit that would hide a malicious user properly and would clean up after anything but its a start.