ODAT - Oracle Database Attack Tool

ODAT – Oracle Database Attack Tool

February 25, 2018February 25, 2018 Comments Off

ODAT (Oracle Database Attacking Tool) is an open source penetration testing tool that tests the security of Oracle Databases remotely.

Usage examples of ODAT:

You have an Oracle database listening remotely and want to find valid SIDs and credentials in order to connect to the database
You have a valid Oracle account on a database and want to escalate your privileges to become DBA or SYSDBA
You have a Oracle account and you want to execute system commands (e.g. reverse shell) in order to move forward on the operating system hosting the database

Tested on Oracle Database 10g, 11g and 12c (12.1.0.2.0).

Features

Thanks to ODAT, you can:

search valid SID on a remote Oracle Database listener via:
a dictionary attack
a brute force attack
ALIAS of the listener
search Oracle accounts using:
a dictionary attack
each Oracle user like the password (need an account before to use this attack)
execute system commands on the database server using:
DBMS_SCHEDULER
JAVA
external tables
oradbg
download files stored on the database server using:
UTL_FILE
external tables
CTXSYS
DBMS_LOB
upload files on the database server using:
UTL_FILE
DBMS_XSLPROCESSOR
DBMS_ADVISOR
delete files using:
UTL_FILE
gain privileged access using these following system privileges combinations (see help for privesc module commands): (NEW : 2016/02/21)
CREATE ANY PROCEDURE
CREATE PROCEDURE and EXECUTE ANY PROCEDURE
CREATE ANY TRIGER (and CREATE PROCEDURE)
ANALYZE ANY (and CREATE PROCEDURE)
CREATE ANY INDEX (and CREATE PROCEDURE)
send/reveive HTTP requests from the database server using:
UTL_HTTP
HttpUriType
scan ports of the local server or a remote server using:
UTL_HTTP
HttpUriType
UTL_TCP
capture a SMB authentication through:
an index in order trigger a SMB connection
exploit some CVE:
the CVE-2012-3137
- pickup the session key and salt for arbitrary users
- attack by dictionary on sessions
the CVE-2012-????: A user authenticated can modify all tables who can select even if he can’t modify them normally (no ALTER privilege).
the CVE-2012-1675 (aka TNS poisoning attack) (NEW : 25/03/2016)
search in column names thanks to the search module:
search a pattern (ex: password) in column names
unwrap PL/SQL source code (10g/11g and 12c)
get system privileges and roles granted. It is possible to get privileges and roles of roles granted also (NEW : 21/02/2016)

Supported Platforms and dependencies

ODAT is compatible with Linux only.

Standalone versions exist in order to don’t have need to install dependencies and slqplus (see https://github.com/quentinhardy/odat/releases/). The ODAT standalone has been generated thanks to pyinstaller.

If you want to have the development version installed on your computer, these following tools and dependencies are needed: