ODAT linux standalone version at https://github.com/quentinhardy/odat/releases/

ODAT

ODAT (Oracle Database Attacking Tool) is an open source penetration testing tool that tests the security of Oracle Databases remotely.

Usage examples of ODAT:

You have an Oracle database listening remotely and want to find valid SIDs and credentials in order to connect to the database
You have a valid Oracle account on a database and want to escalate your privileges to become DBA or SYSDBA
You have a Oracle account and you want to execute system commands (e.g. reverse shell) in order to move forward on the operating system hosting the database

Tested on Oracle Database 10g, 11g and 12c(12.1.0.2.0).

Changelog

Version 2.2 (25/03/2016):
- A new module (tnspoison) for exploiting the TNS listener poisoning attack (CVE-2012-1675). Big thanks to Joxean Koret and donctl.
- Some bug fixes
- Better help menu
- WIKI pages in the ODAT repository
Version 2.1 (04/03/2016) :
- A new module (cve) for exploiting some CVE (Common Vulnerabilities and Exposures). CVE-2012-3137 (perhaps this number, I'm not sure...) implemented at the moment: A user authenticated can modify all tables who can select even if he can't modify them normally (no ALTER privilege).
- new option (--accounts-files) for remote authentication attack which uses 2 distinct files: a login list and password list.
- Print 10g passwords for oclHashcat compatibility.
- bug fixes (listening with nc).
Version 2.0 (21/02/2016) :
A new module (privesc) for using system privileges of an Oracle user (e.g. CREATE ANY PROCEDURE) in order to gain privileged access (i.e. DBA). System privileges that can be used by ODAT in this version:
- CREATE ANY PROCEDURE: execution of arbitrary requests with APEX_040200's privileges (e.g. modification of Oracle users' passwords)
- CREATE PROCEDURE and EXECUTE ANY PROCEDURE: execution of arbitrary requests as SYS (e.g. gives DBA role to a user)
- CREATE ANY TRIGER (and CREATE PROCEDURE): execution of arbitrary requests as SYS (e.g. gives DBA role to a user)
- ANALYZE ANY (and CREATE PROCEDURE): execution of arbitrary requests as SYS (e.g. gives DBA role to a user)
- CREATE ANY INDEX (and CREATE PROCEDURE): execution of arbitrary requests as SYS (e.g. gives DBA role to a user)
The module privesc can be used to get all system privileges and roles granted. It shows system privileges that can be used to gain privileged access.
new option (-vvv) for showing SQL requests sent by ODAT in debugs
standalone version moved to releases (https://github.com/quentinhardy/odat/releases/)
Version 1.6 (14/07/2015) :
new feature to detect if a target is vulnerable to TNS poisoning (CVE-2012-1675)
new module named unwrapper to unwrap PL/SQL source code wrapped, from a file or a remote database
some improvements done
Version 1.5 (17/03/2015) :
new module named search in order to search in column names
some improvements done (ex: output of tables)
new option : output encoding
Version 1.4 (07/12/2014) :
fix some false positives
improve the CVE-2012-3137 module: check more easily if the vulnerability can be exploited
Version 1.3 (07/10/2014) :
add the -C option in the all module. This module can be used to use file which contains credentials (disable the -U and -P option)
add the tnscmd module to get TNS alias, database version (thanks to VSNNUM) and TNS status
bug fix: name server can be given to the -s option
Version 1.2 (08/08/2014) :
add the SMB module to capture a SMB authentication
add an option (SHOW_SQL_REQUESTS_IN_VERBOSE_MODE) in Constants.py to show SQL requests sent to the database server
Version 1.1 (28/07/2014) :
add the DBMS_LOB module useful in order to download files stored on a remote server through Oracle Database.
bug fix: java source code: "getenv no longer supported, use properties and -D instead"
Version 1.0 (26/06/2014) :
first ODAT version.

Features

Thanks to ODAT, you can:

search valid SID on a remote Oracle Database listener via:
a dictionary attack
a brute force attack
ALIAS of the listener
search Oracle accounts using:
a dictionary attack
each Oracle user like the password (need an account before to use this attack)
execute system commands on the database server using:
DBMS_SCHEDULER
JAVA
external tables
oradbg
download files stored on the database server using:
UTL_FILE
external tables
CTXSYS
DBMS_LOB
upload files on the database server using:
UTL_FILE
DBMS_XSLPROCESSOR
DBMS_ADVISOR
delete files using:
UTL_FILE
gain privileged access using these following system privileges combinations (see help for privesc module commands): (NEW : 2016/02/21)
CREATE ANY PROCEDURE
CREATE PROCEDURE and EXECUTE ANY PROCEDURE
CREATE ANY TRIGER (and CREATE PROCEDURE)
ANALYZE ANY (and CREATE PROCEDURE)
CREATE ANY INDEX (and CREATE PROCEDURE)
send/reveive HTTP requests from the database server using:
UTL_HTTP
HttpUriType
scan ports of the local server or a remote server using:
UTL_HTTP
HttpUriType
UTL_TCP
capture a SMB authentication through:
an index in order trigger a SMB connection
exploit some CVE:
the CVE-2012-3137
- pickup the session key and salt for arbitrary users
- attack by dictionary on sessions
the CVE-2012-????: A user authenticated can modify all tables who can select even if he can't modify them normally (no ALTER privilege).
the CVE-2012-1675 (aka TNS poisoning attack) (NEW : 25/03/2016)
search in column names thanks to the search module:
search a pattern (ex: password) in column names
unwrap PL/SQL source code (10g/11g and 12c)
get system privileges and roles granted. It is possible to get privileges and roles of roles granted also (NEW : 21/02/2016)

Supported Platforms and dependencies

ODAT is compatible with Linux only.

Standalone versions exist in order to don't have need to install dependencies and slqplus (see https://github.com/quentinhardy/odat/releases/). The ODAT standalone has been generated thanks to pyinstaller.

If you want to have the development version installed on your computer, these following tools and dependencies are needed:

Langage: Python 2.7
Oracle dependancies:
Instant Oracle basic
Instant Oracle sdk
Python libraries:
cx_Oracle
passlib
pycrypto
python-scapy
colorlog (recommended)
termcolor (recommended)
argcomplete (recommended)
pyinstaller (recommended)

Installation (optional, for development version)

This part describes how to install instantclient, CX_Oracle and some others python libraries on Ubuntu in order to have the ODAT development version. Don't forget that an ODAT standalone version exists at https://github.com/quentinhardy/odat/releases/: It is not required to install something for use the standalone version

Clone the repository to get the ODAT source code:

git clone git clone https://github.com/quentinhardy/odat.git

Update wiki pages in this repository for getting the ODAT documentation locally:

cd odat/
git submodule init
git submodule update

Get instant client basic, sdk (devel) and sqlplus from the Oracle web site:
X64: http://www.oracle.com/technetwork/topics/linuxx86-64soft-092277.html
X86: http://www.oracle.com/technetwork/topics/linuxsoft-082809.html
Install python-dev, alien and libaio1 package (for sqlplus):

sudo apt-get install libaio1 python-dev alien python-pip

Generate DEB files from RPM files thanks to :

sudo alien --to-deb oracle-instantclient11.2-basic-???.x???.rpm
sudo alien --to-deb oracle-instantclient11.2-sqlplus-???.x???.rpm
sudo alien --to-deb oracle-instantclient11.2-devel-???.x???.rpm

Install instant client basic, sdk and sqlplus:

sudo dpkg -i oracle-instantclient11.2-basic-???.x???.deb
sudo dpkg -i oracle-instantclient11.2-sqlplus-???.x???.deb
sudo dpkg -i oracle-instantclient11.2-devel_???_???.deb

Put these lines in your /etc/profile file in order to define Oracle env variables:

export ORACLE_HOME=/usr/lib/oracle/11.2/client64/
export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$ORACLE_HOME/lib
export PATH=$ORACLE_HOME/bin:$PATH

Restart your session (to apply env variables) and run sqlplus:

sqlplus

If nor error: good job, Continue...

Create a symlink to your so file.

cd $ORACLE_HOME/lib/
sudo ln -s libclntsh.so.11.1   libclntsh.so

Create the /etc/ld.so.conf.d/oracle.conf file and add the path to Oracle home:

/usr/lib/oracle/11.2/client64/lib/

Update the ldpath using:

sudo ldconfig

Install CX_Oracle

sudo -s
source /etc/profile
pip install cx_Oracle

Test if all is good:

python -c 'import cx_Oracle'

This command should just return without errors.

Install some python libraries:

sudo apt-get install python-scapy
sudo pip install colorlog termcolor pycrypto passlib
sudo pip install argcomplete && sudo activate-global-python-argcomplete

Install the development version of pyinstaller (http://www.pyinstaller.org/).

python setup.py install

Run ODAT:

./odat.py -h

Good job if you have not errors:)

Docs and examples

Docs and examples are on the WIKI