CoCalc provides the best real-time collaborative environment for Jupyter Notebooks, LaTeX documents, and SageMath, scalable from individual users to large groups and classes!

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Auxiliary
7
  include Msf::Auxiliary::Report
8
  include Msf::Exploit::ORACLE
9

10
  def initialize(info = {})
11
    super(update_info(info,
12
      'Name'           => 'Oracle Database Enumeration',
13
      'Description'    => %q{
14
        This module provides a simple way to scan an Oracle database server
15
        for configuration parameters that may be useful during a penetration
16
        test. Valid database credentials must be provided for this module to
17
        run.
18
      },
19
      'Author'         => [ 'Carlos Perez <carlos_perez[at]darkoperator.com>' ],
20
      'License'        => MSF_LICENSE
21
    ))
22

23
  end
24

25
  def run
26
    return if not check_dependencies
27

28
    begin
29
      # Get all values from v$parameter
30
      query = 'select name,value from v$parameter'
31
      vparm = {}
32
      params = prepare_exec(query)
33
      params.each do |l|
34
        name,value = l.split(",")
35
        vparm["#{name}"] = value
36
      end
37
    rescue => e
38
      if e.to_s =~ /ORA-00942: table or view does not exist/
39
        print_error("It appears you do not have sufficient rights to perform the check")
40
      else
41
        raise e
42
      end
43
    end
44

45
    print_status("Running Oracle Enumeration....")
46

47
    # Version Check
48
    query =  'select * from v$version'
49
    ver = prepare_exec(query)
50
    print_status("The versions of the Components are:")
51
    ver.each do |v|
52
      print_status("\t#{v.chomp}")
53
      report_note(
54
        :host => datastore['RHOST'],
55
        :proto => 'tcp',
56
        :sname => 'oracle',
57
        :port => datastore['RPORT'],
58
        :type => 'ORA_ENUM',
59
        :data => "Component Version: #{v.chomp}",
60
        :update => :unique_data
61
      )
62
    end
63

64
    # Saving Major Release Number for other checks
65
    majorrel = ver[0].scan(/Edition Release (\d*)./)
66

67
    #-------------------------------------------------------
68
    # Audit Check
69
    print_status("Auditing:")
70
    begin
71
      if vparm["audit_trail"] == "NONE"
72
        print_status("\tDatabase Auditing is not enabled!")
73
        report_note(
74
          :host => datastore['RHOST'],
75
          :proto => 'tcp',
76
          :sname => 'oracle',
77
          :port => datastore['RPORT'],
78
          :type => 'ORA_ENUM',
79
          :data => "Audit Trail: Disabled",
80
          :update => :unique_data
81
        )
82
      else
83
        print_status("\tDatabase Auditing is enabled!")
84
        report_note(
85
          :host => datastore['RHOST'],
86
          :proto => 'tcp',
87
          :sname => 'oracle',
88
          :port => datastore['RPORT'],
89
          :type => 'ORA_ENUM',
90
          :data => "Audit Trail: Enabled",
91
          :update => :unique_data
92
        )
93
      end
94

95
      if vparm["audit_sys_operations"] == "FALSE"
96
        print_status("\tAuditing of SYS Operations is not enabled!")
97
        report_note(
98
          :host => datastore['RHOST'],
99
          :proto => 'tcp',
100
          :sname => 'oracle',
101
          :port => datastore['RPORT'],
102
          :type => 'ORA_ENUM',
103
          :data => "Audit SYS Ops: Disabled",
104
          :update => :unique_data
105
        )
106
      else
107
        print_status("\tAuditing of SYS Operations is enabled!")
108
        report_note(
109
          :host => datastore['RHOST'],
110
          :proto => 'tcp',
111
          :sname => 'oracle',
112
          :port => datastore['RPORT'],
113
          :type => 'ORA_ENUM',
114
          :data => "Audit SYS Ops: Enabled",
115
          :update => :unique_data
116
        )
117
      end
118

119
    end
120

121
    #-------------------------------------------------------
122
    # Security Settings
123
    print_status("Security Settings:")
124
    begin
125

126
      if vparm["sql92_security"] == "FALSE"
127
        print_status("\tSQL92 Security restriction on SELECT is not Enabled")
128
        report_note(
129
          :host => datastore['RHOST'],
130
          :proto => 'tcp',
131
          :sname => 'oracle',
132
          :port => datastore['RPORT'],
133
          :type => 'ORA_ENUM',
134
          :data => "SQL92: Disabled",
135
          :update => :unique_data
136
        )
137
      else
138
        print_status("\tSQL92 Security restriction on SELECT is Enabled")
139
        report_note(
140
          :host => datastore['RHOST'],
141
          :proto => 'tcp',
142
          :sname => 'oracle',
143
          :port => datastore['RPORT'],
144
          :type => 'ORA_ENUM',
145
          :data => "SQL92: Enabled",
146
          :update => :unique_data
147
        )
148
      end
149

150
      # check for encryption of logins on version before 10g
151

152
      if majorrel.join.to_i < 10
153
        if vparm["dblink_encrypt_login"] == "FALSE"
154
          print_status("\tLink Encryption for Logins is not Enabled")
155
          report_note(
156
            :host => datastore['RHOST'],
157
            :proto => 'tcp',
158
            :sname => 'oracle',
159
            :port => datastore['RPORT'],
160
            :type => 'ORA_ENUM',
161
            :data => "Link Encryption: Disabled",
162
            :update => :unique_data
163
          )
164
        else
165
          print_status("\tLink Encryption for Logins is Enabled")
166
          report_note(
167
            :host => datastore['RHOST'],
168
            :proto => 'tcp',
169
            :sname => 'oracle',
170
            :port => datastore['RPORT'],
171
            :type => 'ORA_ENUM',
172
            :data => "Link Encryption: Enabled",
173
            :update => :unique_data
174
          )
175
        end
176
      end
177

178
      print_status("\tUTL Directory Access is set to #{vparm["utl_file_dir"]}") if vparm["utl_file_dir"] != " "
179
      report_note(
180
        :host => datastore['RHOST'],
181
        :proto => 'tcp',
182
        :sname => 'oracle',
183
        :port => datastore['RPORT'],
184
        :type => 'ORA_ENUM',
185
        :data => "UTL_DIR: #{ vparm["utl_file_dir"]}"
186
      ) if not vparm["utl_file_dir"]#.empty?
187

188
      print_status("\tAudit log is saved at #{vparm["audit_file_dest"]}")
189
      report_note(
190
        :host => datastore['RHOST'],
191
        :proto => 'tcp',
192
        :sname => 'oracle',
193
        :port => datastore['RPORT'],
194
        :type => 'ORA_ENUM',
195
        :data => "Audit Log Location: #{ vparm["audit_file_dest"]}"
196
      ) if not vparm["audit_file_dest"]#.empty?
197

198
    end
199

200
    #-------------------------------------------------------
201
    # Password Policy
202
    print_status("Password Policy:")
203
    begin
204
      query = %Q|
205
        SELECT limit
206
        FROM dba_profiles
207
        WHERE resource_name = 'PASSWORD_LOCK_TIME'
208
        AND profile         = 'DEFAULT'
209
      |
210
      lockout = prepare_exec(query)
211
      print_status("\tCurrent Account Lockout Time is set to #{lockout[0].chomp}")
212
      report_note(
213
        :host => datastore['RHOST'],
214
        :proto => 'tcp',
215
        :sname => 'oracle',
216
        :port => datastore['RPORT'],
217
        :type => 'ORA_ENUM',
218
        :data => "Account Lockout Time: #{lockout[0].chomp}",
219
        :update => :unique_data
220
      )
221

222
    rescue => e
223
      if e.to_s =~ /ORA-00942: table or view does not exist/
224
        print_error("It appears you do not have sufficient rights to perform the check")
225
      else
226
        raise e
227
      end
228
    end
229

230
    begin
231
      query = %Q|
232
        SELECT limit
233
        FROM dba_profiles
234
        WHERE resource_name = 'FAILED_LOGIN_ATTEMPTS'
235
        AND profile         = 'DEFAULT'
236
      |
237
      failed_logins = prepare_exec(query)
238
      print_status("\tThe Number of Failed Logins before an account is locked is set to #{failed_logins[0].chomp}")
239
      report_note(
240
        :host => datastore['RHOST'],
241
        :proto => 'tcp',
242
        :sname => 'oracle',
243
        :port => datastore['RPORT'],
244
        :type => 'ORA_ENUM',
245
        :data => "Account Fail Logins Permitted: #{failed_logins[0].chomp}",
246
        :update => :unique_data
247
      )
248

249
    rescue => e
250
      if e.to_s =~ /ORA-00942: table or view does not exist/
251
        print_error("It appears you do not have sufficient rights to perform the check")
252
      else
253
        raise e
254
      end
255
    end
256

257
    begin
258
      query = %Q|
259
        SELECT limit
260
        FROM dba_profiles
261
        WHERE resource_name = 'PASSWORD_GRACE_TIME'
262
        AND profile         = 'DEFAULT'
263
      |
264
      grace_time = prepare_exec(query)
265
      print_status("\tThe Password Grace Time is set to #{grace_time[0].chomp}")
266
      report_note(
267
        :host => datastore['RHOST'],
268
        :proto => 'tcp',
269
        :sname => 'oracle',
270
        :port => datastore['RPORT'],
271
        :type => 'ORA_ENUM',
272
        :data => "Account Password Grace Time: #{grace_time[0].chomp}",
273
        :update => :unique_data
274
      )
275

276
    rescue => e
277
      if e.to_s =~ /ORA-00942: table or view does not exist/
278
        print_error("It appears you do not have sufficient rights to perform the check")
279
      else
280
        raise e
281
      end
282
    end
283

284
    begin
285
      query = %Q|
286
        SELECT limit
287
        FROM dba_profiles
288
        WHERE resource_name = 'PASSWORD_LIFE_TIME'
289
        AND profile         = 'DEFAULT'
290
      |
291
      passlife_time = prepare_exec(query)
292
      print_status("\tThe Lifetime of Passwords is set to #{passlife_time[0].chomp}")
293
      report_note(
294
        :host => datastore['RHOST'],
295
        :proto => 'tcp',
296
        :sname => 'oracle',
297
        :port => datastore['RPORT'],
298
        :type => 'ORA_ENUM',
299
        :data => "Password Life Time: #{passlife_time[0].chomp}",
300
        :update => :unique_data
301
      )
302

303
    rescue => e
304
      if e.to_s =~ /ORA-00942: table or view does not exist/
305
        print_error("It appears you do not have sufficient rights to perform the check")
306
      else
307
        raise e
308
      end
309
    end
310

311
    begin
312
      query = %Q|
313
        SELECT limit
314
        FROM dba_profiles
315
        WHERE resource_name = 'PASSWORD_REUSE_TIME'
316
        AND profile         = 'DEFAULT'
317
      |
318
      passreuse = prepare_exec(query)
319
      print_status("\tThe Number of Times a Password can be reused is set to #{passreuse[0].chomp}")
320
      report_note(
321
        :host => datastore['RHOST'],
322
        :proto => 'tcp',
323
        :sname => 'oracle',
324
        :port => datastore['RPORT'],
325
        :type => 'ORA_ENUM',
326
        :data => "Password Reuse Time: #{passreuse[0].chomp}",
327
        :update => :unique_data
328
      )
329

330
    rescue => e
331
      if e.to_s =~ /ORA-00942: table or view does not exist/
332
        print_error("It appears you do not have sufficient rights to perform the check")
333
      else
334
        raise e
335
      end
336
    end
337

338
    begin
339
      query = %Q|
340
        SELECT limit
341
        FROM dba_profiles
342
        WHERE resource_name = 'PASSWORD_REUSE_MAX'
343
        AND profile         = 'DEFAULT'
344
      |
345
      passreusemax = prepare_exec(query)
346
      print_status("\tThe Maximum Number of Times a Password needs to be changed before it can be reused is set to #{passreusemax[0].chomp}")
347
      report_note(
348
        :host => datastore['RHOST'],
349
        :proto => 'tcp',
350
        :sname => 'oracle',
351
        :port => datastore['RPORT'],
352
        :type => 'ORA_ENUM',
353
        :data => "Password Maximum Reuse Time: #{passreusemax[0].chomp}",
354
        :update => :unique_data
355
      )
356
      print_status("\tThe Number of Times a Password can be reused is set to #{passreuse[0].chomp}")
357

358
    rescue => e
359
      if e.to_s =~ /ORA-00942: table or view does not exist/
360
        print_error("It appears you do not have sufficient rights to perform the check")
361
      else
362
        raise e
363
      end
364
    end
365

366
    begin
367
      query = %Q|
368
        SELECT limit
369
        FROM dba_profiles
370
        WHERE resource_name = 'PASSWORD_VERIFY_FUNCTION'
371
        AND profile         = 'DEFAULT'
372
      |
373
      passrand = prepare_exec(query)
374
      if passrand[0] =~ /NULL/
375
        print_status("\tPassword Complexity is not checked")
376
        report_note(
377
          :host => datastore['RHOST'],
378
          :proto => 'tcp',
379
          :sname => 'oracle',
380
          :port => datastore['RPORT'],
381
          :type => 'ORA_ENUM',
382
          :data => "Password Complexity is not being checked for new passwords",
383
          :update => :unique_data
384
        )
385
      else
386
        print_status("\tPassword Complexity is being checked")
387
        report_note(
388
          :host => datastore['RHOST'],
389
          :proto => 'tcp',
390
          :sname => 'oracle',
391
          :port => datastore['RPORT'],
392
          :type => 'ORA_ENUM',
393
          :data => "Password Complexity is being checked for new passwords",
394
          :update => :unique_data
395
        )
396
      end
397

398
    rescue => e
399
      if e.to_s =~ /ORA-00942: table or view does not exist/
400
        print_error("It appears you do not have sufficient rights to perform the check")
401
      else
402
        raise e
403
      end
404
    end
405

406
    #-------------------------------------------------------
407

408
    begin
409

410
      if majorrel.join.to_i < 11
411

412
        query = %Q|
413
          SELECT name, password
414
          FROM sys.user$
415
          where password != 'null' and  type# = 1 and astatus = 0
416
        |
417
        activeacc = prepare_exec(query)
418
        print_status("Active Accounts on the System in format Username,Hash are:")
419
        activeacc.each do |aa|
420
          print_status("\t#{aa.chomp}")
421
          report_note(
422
            :host => datastore['RHOST'],
423
            :proto => 'tcp',
424
            :sname => 'oracle',
425
            :port => datastore['RPORT'],
426
            :type => 'ORA_ENUM',
427
            :data => "Active Account #{aa.chomp}",
428
            :update => :unique_data
429
          )
430
        end
431
      else
432
        query = %Q|
433
          SELECT name, password, spare4
434
          FROM sys.user$
435
          where password != 'null' and  type# = 1 and astatus = 0
436
        |
437
        activeacc = prepare_exec(query)
438
        print_status("Active Accounts on the System in format Username,Password,Spare4 are:")
439
        activeacc.each do |aa|
440
          print_status("\t#{aa.chomp}")
441
          report_note(
442
            :host => datastore['RHOST'],
443
            :proto => 'tcp',
444
            :sname => 'oracle',
445
            :port => datastore['RPORT'],
446
            :type => 'ORA_ENUM',
447
            :data => "Active Account #{aa.chomp}",
448
            :update => :unique_data
449
          )
450
        end
451
      end
452

453
    rescue => e
454
      if e.to_s =~ /ORA-00942: table or view does not exist/
455
        print_error("It appears you do not have sufficient rights to perform the check")
456
      else
457
        raise e
458
      end
459
    end
460

461
    begin
462
      if majorrel.join.to_i < 11
463
        query = %Q|
464
          SELECT username, password
465
          FROM dba_users
466
          WHERE account_status = 'EXPIRED & LOCKED'
467
        |
468
        disabledacc = prepare_exec(query)
469
        print_status("Expired or Locked Accounts on the System in format Username,Hash are:")
470
        disabledacc.each do |da|
471
          print_status("\t#{da.chomp}")
472
          report_note(
473
            :host => datastore['RHOST'],
474
            :proto => 'tcp',
475
            :sname => 'oracle',
476
            :port => datastore['RPORT'],
477
            :type => 'ORA_ENUM',
478
            :data => "Disabled Account #{da.chomp}",
479
            :update => :unique_data
480
          )
481
        end
482
      else
483
        query = %Q|
484
          SELECT name, password, spare4
485
          FROM sys.user$
486
          where password != 'null' and  type# = 1 and astatus = 8 or astatus = 9
487
        |
488
        disabledacc = prepare_exec(query)
489
        print_status("Expired or Locked Accounts on the System in format Username,Password,Spare4 are:")
490
        disabledacc.each do |da|
491
          print_status("\t#{da.chomp}")
492
          report_note(
493
            :host => datastore['RHOST'],
494
            :proto => 'tcp',
495
            :sname => 'oracle',
496
            :port => datastore['RPORT'],
497
            :type => 'ORA_ENUM',
498
            :data => "Disabled Account #{da.chomp}",
499
            :update => :unique_data
500
          )
501
        end
502
      end
503

504
    rescue => e
505
      if e.to_s =~ /ORA-00942: table or view does not exist/
506
        print_error("It appears you do not have sufficient rights to perform the check")
507
      else
508
        raise e
509
      end
510
    end
511

512
    begin
513
      query = %Q|
514
        SELECT grantee
515
        FROM dba_role_privs
516
        WHERE granted_role = 'DBA'
517
      |
518
      dbaacc = prepare_exec(query)
519
      print_status("Accounts with DBA Privilege  in format Username,Hash on the System are:")
520
      dbaacc.each do |dba|
521
        print_status("\t#{dba.chomp}")
522
        report_note(
523
          :host => datastore['RHOST'],
524
          :proto => 'tcp',
525
          :sname => 'oracle',
526
          :port => datastore['RPORT'],
527
          :type => 'ORA_ENUM',
528
          :data => "Account with DBA Priv  #{dba.chomp}",
529
          :update => :unique_data
530
        )
531
      end
532

533
    rescue => e
534
      if e.to_s =~ /ORA-00942: table or view does not exist/
535
        print_error("It appears you do not have sufficient rights to perform the check")
536
      else
537
        raise e
538
      end
539
    end
540

541
    begin
542
      query = %Q|
543
        SELECT grantee
544
        FROM dba_sys_privs
545
        WHERE privilege = 'ALTER SYSTEM'
546
      |
547
      altersys = prepare_exec(query)
548
      print_status("Accounts with Alter System Privilege on the System are:")
549
      altersys.each do |as|
550
        print_status("\t#{as.chomp}")
551
        report_note(
552
          :host => datastore['RHOST'],
553
          :proto => 'tcp',
554
          :sname => 'oracle',
555
          :port => datastore['RPORT'],
556
          :type => 'ORA_ENUM',
557
          :data => "Account with ALTER SYSTEM Priv  #{as.chomp}",
558
          :update => :unique_data)
559
      end
560

561
    rescue => e
562
      if e.to_s =~ /ORA-00942: table or view does not exist/
563
        print_error("It appears you do not have sufficient rights to perform the check")
564
      else
565
        raise e
566
      end
567
    end
568

569
    begin
570
      query = %Q|
571
        SELECT grantee
572
        FROM dba_sys_privs
573
        WHERE privilege = 'JAVA ADMIN'
574
      |
575
      javaacc = prepare_exec(query)
576
      print_status("Accounts with JAVA ADMIN Privilege on the System are:")
577
      javaacc.each do |j|
578
        print_status("\t#{j.chomp}")
579
        report_note(
580
          :host => datastore['RHOST'],
581
          :proto => 'tcp',
582
          :sname => 'oracle',
583
          :port => datastore['RPORT'],
584
          :type => 'ORA_ENUM',
585
          :data => "Account with JAVA ADMIN Priv  #{j.chomp}",
586
          :update => :unique_data
587
        )
588
      end
589

590
    rescue => e
591
      if e.to_s =~ /ORA-00942: table or view does not exist/
592
        print_error("It appears you do not have sufficient rights to perform the check")
593
      else
594
        raise e
595
      end
596
    end
597

598
    begin
599
      query = %Q|
600
        select grantee
601
        from dba_sys_privs
602
        where privilege = 'CREATE LIBRARY'
603
        or privilege = 'CREATE ANY'
604
      |
605
      libpriv = prepare_exec(query)
606
      print_status("Accounts that have CREATE LIBRARY Privilege on the System are:")
607
      libpriv.each do |lp|
608
        print_status("\t#{lp.chomp}")
609
        report_note(
610
          :host => datastore['RHOST'],
611
          :proto => 'tcp',
612
          :sname => 'oracle',
613
          :port => datastore['RPORT'],
614
          :type => 'ORA_ENUM',
615
          :data => "Account with CREATE LIBRARY Priv  #{lp.chomp}",
616
          :update => :unique_data
617
        )
618
      end
619

620
    rescue => e
621
      if e.to_s =~ /ORA-00942: table or view does not exist/
622
        print_error("It appears you do not have sufficient rights to perform the check")
623
      else
624
        raise e
625
      end
626
    end
627

628
    #Default Password Check
629
    begin
630
      print_status("Default password check:")
631
      if majorrel.join.to_i == 11
632
        query = %Q|
633
          SELECT * FROM dba_users_with_defpwd
634
        |
635
        defpwd = prepare_exec(query)
636
        defpwd.each do |dp|
637
          print_status("\tThe account #{dp.chomp} has a default password.")
638
          report_note(
639
            :host => datastore['RHOST'],
640
            :proto => 'tcp',
641
            :sname => 'oracle',
642
            :port => datastore['RPORT'],
643
            :type => 'ORA_ENUM',
644
            :data => "Account with Default Password #{dp.chomp}",
645
            :update => :unique_data
646
          )
647
        end
648

649
      else
650
        query = %Q|
651
          SELECT name, password
652
          FROM sys.user$
653
          where password != 'null' and  type# = 1
654
        |
655
        ordfltpss = "#{File.join(Msf::Config.data_directory, "wordlists", "oracle_default_hashes.txt")}"
656
        returnedstring = prepare_exec(query)
657
        accts = {}
658
        returnedstring.each do |record|
659
          user,pass = record.split(",")
660
          accts["#{pass.chomp}"] = user
661
        end
662
        ::File.open(ordfltpss, "rb").each_line do  |l|
663
          accrcrd =  l.split(",")
664
          if accts.has_key?(accrcrd[2])
665
            print_status("\tDefault pass for account #{accrcrd[0]} is #{accrcrd[1]} ")
666
            report_note(
667
              :host => datastore['RHOST'],
668
              :proto => 'tcp',
669
              :sname => 'oracle',
670
              :port => datastore['RPORT'],
671
              :type => 'ORA_ENUM',
672
              :data => "Account with Default Password #{accrcrd[0]} is #{accrcrd[1]}",
673
              :update => :unique_data
674
            )
675
          end
676
        end
677
      end
678
    rescue => e
679
      if e.to_s =~ /ORA-00942: table or view does not exist/
680
        print_error("It appears you do not have sufficient rights to perform the check")
681
      else
682
        raise e
683
      end
684
    end
685
  end
686
end
687

688