metasploit-framework/modules/auxiliary/scanner/oracle/sid_enum.rb

83 lines
2.3 KiB
Ruby
Raw Normal View History

##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'msf/core'
2016-03-08 13:02:44 +00:00
class MetasploitModule < Msf::Auxiliary
2013-08-30 21:28:54 +00:00
include Msf::Exploit::Remote::TNS
include Msf::Auxiliary::Report
include Msf::Auxiliary::Scanner
2013-08-30 21:28:54 +00:00
def initialize(info = {})
super(update_info(info,
'Name' => 'Oracle TNS Listener SID Enumeration',
'Description' => %q{
This module simply queries the TNS listner for the Oracle SID.
With Oracle 9.2.0.8 and above the listener will be protected and
the SID will have to be bruteforced or guessed.
},
'Author' => [ 'CG', 'MC' ],
'License' => MSF_LICENSE,
'DisclosureDate' => 'Jan 7 2009'
))
2013-08-30 21:28:54 +00:00
register_options(
[
Opt::RPORT(1521)
], self.class)
2013-08-30 21:28:54 +00:00
deregister_options('RHOST')
end
2013-08-30 21:28:54 +00:00
def run_host(ip)
begin
connect
2013-08-30 21:28:54 +00:00
pkt = tns_packet("(CONNECT_DATA=(COMMAND=STATUS))")
2013-08-30 21:28:54 +00:00
sock.put(pkt)
2013-08-30 21:28:54 +00:00
select(nil,nil,nil,0.5)
2013-08-30 21:28:54 +00:00
data = sock.get_once
2013-08-30 21:28:54 +00:00
if ( data and data =~ /ERROR_STACK/ )
print_error("TNS listener protected for #{ip}...")
else
if(not data)
print_error("#{ip} Connection but no data")
else
sid = data.scan(/INSTANCE_NAME=([^\)]+)/)
sid.uniq.each do |s|
report_note(
:host => ip,
:port => rport,
:type => "oracle_sid",
:data => "PORT=#{rport}, SID=#{s}",
:update => :unique_data
)
print_good("Identified SID for #{ip}:#{rport} #{s}")
end
service_name = data.scan(/SERVICE_NAME=([^\)]+)/)
service_name.uniq.each do |s|
report_note(
:host => ip,
:port => rport,
:type => "oracle_service_name",
:data => "PORT=#{rport}, SERVICE_NAME=#{s}",
:update => :unique_data
)
print_status("Identified SERVICE_NAME for #{ip}:#{rport} #{s}")
end
end
end
disconnect
rescue ::Rex::ConnectionError
rescue ::Errno::EPIPE
end
end
end