1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Auxiliary
7
  include Msf::Auxiliary::Report
8
  include Msf::Exploit::ORACLE
9

10
  def initialize(info = {})
11
    super(
12
      update_info(
13
        info,
14
        'Name' => 'Oracle Database Enumeration',
15
        'Description' => %q{
16
          This module provides a simple way to scan an Oracle database server
17
          for configuration parameters that may be useful during a penetration
18
          test. Valid database credentials must be provided for this module to
19
          run.
20
        },
21
        'Author' => [ 'Carlos Perez <carlos_perez[at]darkoperator.com>' ],
22
        'License' => MSF_LICENSE,
23
        'Notes' => {
24
          'Stability' => [CRASH_SAFE],
25
          'SideEffects' => [IOC_IN_LOGS],
26
          'Reliability' => []
27
        }
28
      )
29
    )
30
  end
31

32
  def report_ora_enum_note(note_data)
33
    report_note(
34
      host: datastore['RHOST'],
35
      proto: 'tcp',
36
      sname: 'oracle',
37
      port: datastore['RPORT'],
38
      type: 'ORA_ENUM',
39
      data: note_data,
40
      update: :unique_data
41
    )
42
  end
43

44
  # rubocop:disable Metrics/MethodLength
45
  def run
46
    return if !check_dependencies
47

48
    begin
49
      # Get all values from v$parameter
50
      query = 'select name,value from v$parameter'
51
      vparm = {}
52
      params = prepare_exec(query)
53
      params.each do |l|
54
        name, value = l.split(',')
55
        vparm[name.to_s] = value
56
      end
57
    rescue StandardError => e
58
      if e.to_s =~ /ORA-00942: table or view does not exist/
59
        print_error('It appears you do not have sufficient rights to perform the check')
60
      else
61
        raise e
62
      end
63
    end
64

65
    print_status('Running Oracle Enumeration....')
66

67
    # Version Check
68
    query = 'select * from v$version'
69
    ver = prepare_exec(query)
70
    print_status('The versions of the Components are:')
71
    ver.each do |v|
72
      print_status("\t#{v.chomp}")
73
      report_ora_enum_note(
74
        { :component_version => v.chomp }
75
      )
76
    end
77

78
    # Saving Major Release Number for other checks
79
    majorrel = ver[0].scan(/Edition Release (\d*)./)
80

81
    #-------------------------------------------------------
82
    # Audit Check
83
    print_status('Auditing:')
84
    begin
85
      if vparm['audit_trail'] == 'NONE'
86
        print_status("\tDatabase Auditing is not enabled!")
87
        report_ora_enum_note(
88
          { :audit_trail => 'Disabled' }
89
        )
90
      else
91
        print_status("\tDatabase Auditing is enabled!")
92
        report_ora_enum_note(
93
          { :audit_trail => 'Enabled' }
94
        )
95
      end
96

97
      if vparm['audit_sys_operations'] == 'FALSE'
98
        print_status("\tAuditing of SYS Operations is not enabled!")
99
        report_ora_enum_note(
100
          { :audit_sys_ops => 'Disabled' }
101
        )
102
      else
103
        print_status("\tAuditing of SYS Operations is enabled!")
104
        report_ora_enum_note(
105
          { :audit_sys_ops => 'Enabled' }
106
        )
107
      end
108
    end
109

110
    #-------------------------------------------------------
111
    # Security Settings
112
    print_status('Security Settings:')
113
    begin
114
      if vparm['sql92_security'] == 'FALSE'
115
        print_status("\tSQL92 Security restriction on SELECT is not Enabled")
116
        report_ora_enum_note(
117
          'SQL92: Disabled'
118
        )
119
      else
120
        print_status("\tSQL92 Security restriction on SELECT is Enabled")
121
        report_ora_enum_note(
122
          'SQL92: Enabled'
123
        )
124
      end
125

126
      # check for encryption of logins on version before 10g
127

128
      if majorrel.join.to_i < 10
129
        if vparm['dblink_encrypt_login'] == 'FALSE'
130
          print_status("\tLink Encryption for Logins is not Enabled")
131
          report_ora_enum_note(
132
            'Link Encryption: Disabled'
133
          )
134
        else
135
          print_status("\tLink Encryption for Logins is Enabled")
136
          report_ora_enum_note(
137
            'Link Encryption: Enabled'
138
          )
139
        end
140
      end
141

142
      print_status("\tUTL Directory Access is set to #{vparm['utl_file_dir']}") if vparm['utl_file_dir'] != ' '
143
      if !vparm['utl_file_dir']
144
        report_ora_enum_note(
145
          "UTL_DIR: #{vparm['utl_file_dir']}"
146
        )
147
      end
148

149
      print_status("\tAudit log is saved at #{vparm['audit_file_dest']}")
150
      if !vparm['audit_file_dest']
151
        report_ora_enum_note(
152
          "Audit Log Location: #{vparm['audit_file_dest']}"
153
        )
154
      end
155
    end
156

157
    #-------------------------------------------------------
158
    # Password Policy
159
    print_status('Password Policy:')
160
    begin
161
      query = %(
162
        SELECT limit
163
        FROM dba_profiles
164
        WHERE resource_name = 'PASSWORD_LOCK_TIME'
165
        AND profile         = 'DEFAULT'
166
      )
167
      lockout = prepare_exec(query)
168
      print_status("\tCurrent Account Lockout Time is set to #{lockout[0].chomp}")
169
      report_ora_enum_note(
170
        "Account Lockout Time: #{lockout[0].chomp}"
171
      )
172
    rescue StandardError => e
173
      if e.to_s =~ /ORA-00942: table or view does not exist/
174
        print_error('It appears you do not have sufficient rights to perform the check')
175
      else
176
        raise e
177
      end
178
    end
179

180
    begin
181
      query = %(
182
        SELECT limit
183
        FROM dba_profiles
184
        WHERE resource_name = 'FAILED_LOGIN_ATTEMPTS'
185
        AND profile         = 'DEFAULT'
186
      )
187
      failed_logins = prepare_exec(query)
188
      print_status("\tThe Number of Failed Logins before an account is locked is set to #{failed_logins[0].chomp}")
189
      report_ora_enum_note(
190
        "Account Fail Logins Permitted: #{failed_logins[0].chomp}"
191
      )
192
    rescue StandardError => e
193
      if e.to_s =~ /ORA-00942: table or view does not exist/
194
        print_error('It appears you do not have sufficient rights to perform the check')
195
      else
196
        raise e
197
      end
198
    end
199

200
    begin
201
      query = %(
202
        SELECT limit
203
        FROM dba_profiles
204
        WHERE resource_name = 'PASSWORD_GRACE_TIME'
205
        AND profile         = 'DEFAULT'
206
      )
207
      grace_time = prepare_exec(query)
208
      print_status("\tThe Password Grace Time is set to #{grace_time[0].chomp}")
209
      report_ora_enum_note(
210
        "Account Password Grace Time: #{grace_time[0].chomp}"
211
      )
212
    rescue StandardError => e
213
      if e.to_s =~ /ORA-00942: table or view does not exist/
214
        print_error('It appears you do not have sufficient rights to perform the check')
215
      else
216
        raise e
217
      end
218
    end
219

220
    begin
221
      query = %(
222
        SELECT limit
223
        FROM dba_profiles
224
        WHERE resource_name = 'PASSWORD_LIFE_TIME'
225
        AND profile         = 'DEFAULT'
226
      )
227
      passlife_time = prepare_exec(query)
228
      print_status("\tThe Lifetime of Passwords is set to #{passlife_time[0].chomp}")
229
      report_ora_enum_note(
230
        "Password Life Time: #{passlife_time[0].chomp}"
231
      )
232
    rescue StandardError => e
233
      if e.to_s =~ /ORA-00942: table or view does not exist/
234
        print_error('It appears you do not have sufficient rights to perform the check')
235
      else
236
        raise e
237
      end
238
    end
239

240
    begin
241
      query = %(
242
        SELECT limit
243
        FROM dba_profiles
244
        WHERE resource_name = 'PASSWORD_REUSE_TIME'
245
        AND profile         = 'DEFAULT'
246
      )
247
      passreuse = prepare_exec(query)
248
      print_status("\tThe Number of Times a Password can be reused is set to #{passreuse[0].chomp}")
249
      report_ora_enum_note(
250
        "Password Reuse Time: #{passreuse[0].chomp}"
251
      )
252
    rescue StandardError => e
253
      if e.to_s =~ /ORA-00942: table or view does not exist/
254
        print_error('It appears you do not have sufficient rights to perform the check')
255
      else
256
        raise e
257
      end
258
    end
259

260
    begin
261
      query = %(
262
        SELECT limit
263
        FROM dba_profiles
264
        WHERE resource_name = 'PASSWORD_REUSE_MAX'
265
        AND profile         = 'DEFAULT'
266
      )
267
      passreusemax = prepare_exec(query)
268
      print_status("\tThe Maximum Number of Times a Password needs to be changed before it can be reused is set to #{passreusemax[0].chomp}")
269
      report_ora_enum_note(
270
        "Password Maximum Reuse Time: #{passreusemax[0].chomp}"
271
      )
272
      print_status("\tThe Number of Times a Password can be reused is set to #{passreuse[0].chomp}")
273
    rescue StandardError => e
274
      if e.to_s =~ /ORA-00942: table or view does not exist/
275
        print_error('It appears you do not have sufficient rights to perform the check')
276
      else
277
        raise e
278
      end
279
    end
280

281
    begin
282
      query = %(
283
        SELECT limit
284
        FROM dba_profiles
285
        WHERE resource_name = 'PASSWORD_VERIFY_FUNCTION'
286
        AND profile         = 'DEFAULT'
287
      )
288
      passrand = prepare_exec(query)
289
      if passrand[0] =~ /NULL/
290
        print_status("\tPassword Complexity is not checked")
291
        report_ora_enum_note(
292
          'Password Complexity is not being checked for new passwords'
293
        )
294
      else
295
        print_status("\tPassword Complexity is being checked")
296
        report_ora_enum_note(
297
          'Password Complexity is being checked for new passwords'
298
        )
299
      end
300
    rescue StandardError => e
301
      if e.to_s =~ /ORA-00942: table or view does not exist/
302
        print_error('It appears you do not have sufficient rights to perform the check')
303
      else
304
        raise e
305
      end
306
    end
307

308
    #-------------------------------------------------------
309

310
    begin
311
      if majorrel.join.to_i < 11
312

313
        query = %(
314
          SELECT name, password
315
          FROM sys.user$
316
          where password != 'null' and  type# = 1 and astatus = 0
317
        )
318
        activeacc = prepare_exec(query)
319
        print_status('Active Accounts on the System in format Username,Hash are:')
320
      else
321
        query = %(
322
          SELECT name, password, spare4
323
          FROM sys.user$
324
          where password != 'null' and  type# = 1 and astatus = 0
325
        )
326
        activeacc = prepare_exec(query)
327
        print_status('Active Accounts on the System in format Username,Password,Spare4 are:')
328
      end
329
      activeacc.each do |aa|
330
        print_status("\t#{aa.chomp}")
331
        report_ora_enum_note(
332
          "Active Account #{aa.chomp}"
333
        )
334
      end
335
    rescue StandardError => e
336
      if e.to_s =~ /ORA-00942: table or view does not exist/
337
        print_error('It appears you do not have sufficient rights to perform the check')
338
      else
339
        raise e
340
      end
341
    end
342

343
    begin
344
      if majorrel.join.to_i < 11
345
        query = %(
346
          SELECT username, password
347
          FROM dba_users
348
          WHERE account_status = 'EXPIRED & LOCKED'
349
        )
350
        disabledacc = prepare_exec(query)
351
        print_status('Expired or Locked Accounts on the System in format Username,Hash are:')
352
      else
353
        query = %(
354
          SELECT name, password, spare4
355
          FROM sys.user$
356
          where password != 'null' and  type# = 1 and astatus = 8 or astatus = 9
357
        )
358
        disabledacc = prepare_exec(query)
359
        print_status('Expired or Locked Accounts on the System in format Username,Password,Spare4 are:')
360
      end
361
      disabledacc.each do |da|
362
        print_status("\t#{da.chomp}")
363
        report_ora_enum_note(
364
          "Disabled Account #{da.chomp}"
365
        )
366
      end
367
    rescue StandardError => e
368
      if e.to_s =~ /ORA-00942: table or view does not exist/
369
        print_error('It appears you do not have sufficient rights to perform the check')
370
      else
371
        raise e
372
      end
373
    end
374

375
    begin
376
      query = %(
377
        SELECT grantee
378
        FROM dba_role_privs
379
        WHERE granted_role = 'DBA'
380
      )
381
      dbaacc = prepare_exec(query)
382
      print_status('Accounts with DBA Privilege  in format Username,Hash on the System are:')
383
      dbaacc.each do |dba|
384
        print_status("\t#{dba.chomp}")
385
        report_ora_enum_note(
386
          "Account with DBA Priv  #{dba.chomp}"
387
        )
388
      end
389
    rescue StandardError => e
390
      if e.to_s =~ /ORA-00942: table or view does not exist/
391
        print_error('It appears you do not have sufficient rights to perform the check')
392
      else
393
        raise e
394
      end
395
    end
396

397
    begin
398
      query = %(
399
        SELECT grantee
400
        FROM dba_sys_privs
401
        WHERE privilege = 'ALTER SYSTEM'
402
      )
403
      altersys = prepare_exec(query)
404
      print_status('Accounts with Alter System Privilege on the System are:')
405
      altersys.each do |as|
406
        print_status("\t#{as.chomp}")
407
        report_ora_enum_note(
408
          "Account with ALTER SYSTEM Priv  #{as.chomp}"
409
        )
410
      end
411
    rescue StandardError => e
412
      if e.to_s =~ /ORA-00942: table or view does not exist/
413
        print_error('It appears you do not have sufficient rights to perform the check')
414
      else
415
        raise e
416
      end
417
    end
418

419
    begin
420
      query = %(
421
        SELECT grantee
422
        FROM dba_sys_privs
423
        WHERE privilege = 'JAVA ADMIN'
424
      )
425
      javaacc = prepare_exec(query)
426
      print_status('Accounts with JAVA ADMIN Privilege on the System are:')
427
      javaacc.each do |j|
428
        print_status("\t#{j.chomp}")
429
        report_ora_enum_note(
430
          "Account with JAVA ADMIN Priv  #{j.chomp}"
431
        )
432
      end
433
    rescue StandardError => e
434
      if e.to_s =~ /ORA-00942: table or view does not exist/
435
        print_error('It appears you do not have sufficient rights to perform the check')
436
      else
437
        raise e
438
      end
439
    end
440

441
    begin
442
      query = %(
443
        select grantee
444
        from dba_sys_privs
445
        where privilege = 'CREATE LIBRARY'
446
        or privilege = 'CREATE ANY'
447
      )
448
      libpriv = prepare_exec(query)
449
      print_status('Accounts that have CREATE LIBRARY Privilege on the System are:')
450
      libpriv.each do |lp|
451
        print_status("\t#{lp.chomp}")
452
        report_ora_enum_note(
453
          "Account with CREATE LIBRARY Priv  #{lp.chomp}"
454
        )
455
      end
456
    rescue StandardError => e
457
      if e.to_s =~ /ORA-00942: table or view does not exist/
458
        print_error('It appears you do not have sufficient rights to perform the check')
459
      else
460
        raise e
461
      end
462
    end
463

464
    # Default Password Check
465
    begin
466
      print_status('Default password check:')
467
      if majorrel.join.to_i == 11
468
        query = %(
469
          SELECT * FROM dba_users_with_defpwd
470
        )
471
        defpwd = prepare_exec(query)
472
        defpwd.each do |dp|
473
          print_status("\tThe account #{dp.chomp} has a default password.")
474
          report_ora_enum_note(
475
            "Account with Default Password #{dp.chomp}"
476
          )
477
        end
478

479
      else
480
        query = %(
481
          SELECT name, password
482
          FROM sys.user$
483
          where password != 'null' and  type# = 1
484
        )
485
        ordfltpss = File.join(Msf::Config.data_directory, 'wordlists', 'oracle_default_hashes.txt').to_s
486
        returnedstring = prepare_exec(query)
487
        accts = {}
488
        returnedstring.each do |record|
489
          user, pass = record.split(',')
490
          accts[pass.chomp.to_s] = user
491
        end
492
        ::File.open(ordfltpss, 'rb').each_line do |l|
493
          accrcrd = l.split(',')
494
          next unless accts.key?(accrcrd[2])
495

496
          print_status("\tDefault pass for account #{accrcrd[0]} is #{accrcrd[1]} ")
497
          report_ora_enum_note(
498
            "Account with Default Password #{accrcrd[0]} is #{accrcrd[1]}"
499
          )
500
        end
501
      end
502
    rescue StandardError => e
503
      if e.to_s =~ /ORA-00942: table or view does not exist/
504
        print_error('It appears you do not have sufficient rights to perform the check')
505
      else
506
        raise e
507
      end
508
    end
509
  end
510
  # rubocop:enable Metrics/MethodLength
511
end
512

513