ODAT
ODAT (Oracle Database Attacking Tool) is an open source penetration testing tool that tests the security of Oracle Databases remotely.
Usage examples of ODAT:
- You have an Oracle database listening remotely and want to find valid SIDs and credentials in order to connect to the database
- You have a valid Oracle account on a database and want to escalate your privileges to become DBA or SYSDBA
- You have a Oracle account and you want to execute system commands (e.g. reverse shell) in order to move forward on the operating system hosting the database
Tested on Oracle Database 10g, 11g, 12c, 18c and 19c.
ODAT linux standalone version at https://github.com/quentinhardy/odat/releases/. Notice it is recommended to use the development version (git clone), master-python3 branch (python 3 version).
Changelog
- Version 5.1.1 (27/04/2022):
- print a warning message when an "ORA-12519 - TNS:no appropriate service handler found" occured. This error can be triggered by the database server (listener) when too many connections have been established (when bruteforcing credentials for example). In this case, --sleep option should be used (e.g. --sleep 0.2).
- Version 5.1 (12/03/2021):
- new option in all module: --nmap-file for loading all Oracle databases from a nmap XML outpout file
- new option in all module: -l for loading all targets from a text file (ip:port or ip on each line)
- In all module, a TCP connection is tested on each target before to start ODAT tests now. --timeout-tcp-check can be used to manage timeout value.
- In all module, a test is done on each target now for checking if the TNS listener is well configured. This test is done after TCP connection test.
- new global option: --client-driver. Allows to set the client name for database connection (client_driver from V$SESSION_CONNECT_INFO).
Useful for applications whose end-users are not aware cx_Oracle is being. used. By default, 'sql*plus' now.
- ODAT accepts a sqlnet.ora file now. A default file is in conf/. The timeout TCP & OUTBOUND (TNS) connection is set to 60 seconds by default now.
- Version 5.0 (08/02/2021):
- Important new module: Service Name Guesser, for searching valid Service Names. Specific module named snguesser and integrated in all module too. By default, all module searches all valid Service Names now after searching SIDs. SIDs can be identical to Service Name. When a Service Name is found but not a SID, Service Name can be used as a SID for connection.
- --basic-info option in search module for getting some basic technical information about the database/instance. It gets Service Name, SID, databases, Oracle Database Vault status, Java status, hostname, ip address of the server, password policy, current system pivileges, current roles, pathches (when >= 12c and user is privileged), etc. Requires high pivileges for very interesting information (e.g. password policy & lock status).
- Reverse shell implemented in DbmsScheduler module when the target is Windows. Starts a minimal http server, makes the Oracle Database download the powershell code and executes it remotely. The user has an interactive PS shell. Downloaded file is removed automatically.
- --make-download option implemented in DbmsScheduler in order to make download a Windows target a script/binary file.
- Bug fix in output in DbmsScheduler module (printOSCmdOutput()).
- Better explanations in DbmsScheduler module (options).
- Version 4.3 (28/06/2020):
- new option: --both-ul. Try each password in lower case and upper case if it is not done in credential file(s)
- new option: --random-order. Test accounts in random order. By default, it uses the text file order
- all passwords are tested in lower case now by default (account files modified from upper to lower case)
- some new accounts
- Version 4.2 (04/02/2020):
- minimal interactive SQL shell in search module
- new feature for downloading files with DBMS_XSLPROCESSOR.read2clob in DbmsXslprocessor module
- improvement for having remote OS after authentication
- bug fix (e.g. terminal size)
- Version 4.1 (01/15/2020):
- Option for connection with SERVICE NAME instead of SID
- Encoding set to UTF-8 by default for some operations (e.g. NVARCHAR2 and NCLOB, VARCHAR2 and CLOB)
- Multiple bug fixes (encoding problems)
- Version 4.0 (08/10/2019):
- Odat with python 3, stable version
- Version 3.0 (01/09/2019):
- Compatible with Oracle Database 18c
- New option in Java module for setting the path to shell (e.g. /usr/bin/sh when CentOS)
- Version 2.3.2 (16/07/2019):
- Bug fixes:
- external table and false negative
- Version 2.3.1 (10/08/2018):
- Version 2.3 (06/03/2018):
- Bug fixes:
- Some database credentials could not be detected in passwordguesser module (when it tries to connect as SYSDBA/SYSOPER before). Important bug fix!
- PPoutput missing in smb module (thx to dirkjanm)
- False positive in tnspoison module
- Sometimes, impossible to get version from VSNNUM
- Improvements:
- Performence improvements when you bruteforce accounts.
- Option for connection with a TNS Connection String
- New trivial credentials in accounts file
- Better read file method in dbmsLob module (thx to omair2084)
- Version 2.2.1 (12/04/2017):
- Bug fixes:
- Version in tnscmd (info)
- External module (Catch an Oracle error)
- Catch error when "connection to server failed"
- Tnscmd: "The server SID must be given with the '-d SID' option
- TypeError Bug Fix in tnspoison module
- TNS poisoning module when port!=1521 (Integer bug)
- Improvements:
- Version 2.2 (25/03/2016):
- A new module (tnspoison) for exploiting the TNS listener poisoning attack (CVE-2012-1675). Big thanks to Joxean Koret and donctl.
- Some bug fixes
- Better help menu
- WIKI pages in the ODAT repository
- Version 2.1 (04/03/2016) :
- A new module (cve) for exploiting some CVE (Common Vulnerabilities and Exposures). CVE-2012-3137 (perhaps this number, I'm not sure...) implemented at the moment: A user authenticated can modify all tables who can select even if he can't modify them normally (no ALTER privilege).
- new option (--accounts-files) for remote authentication attack which uses 2 distinct files: a login list and password list.
- Print 10g passwords for oclHashcat compatibility.
- bug fixes (listening with nc).
- Version 2.0 (21/02/2016) :
- A new module (privesc) for using system privileges of an Oracle user (e.g. CREATE ANY PROCEDURE) in order to gain privileged access (i.e. DBA). System privileges that can be used by ODAT in this version:
- CREATE ANY PROCEDURE: execution of arbitrary requests with APEX_040200's privileges (e.g. modification of Oracle users' passwords)
- CREATE PROCEDURE and EXECUTE ANY PROCEDURE: execution of arbitrary requests as SYS (e.g. gives DBA role to a user)
quentinhardy/odat
