##
# This module requires Metasploit: https:\/\/metasploit.com\/download
# Current source: https:\/\/github.com\/rapid7\/metasploit-framework
##<\/p>\n
class MetasploitModule < Msf::Auxiliary
include Msf::Exploit::Remote::TNS
include Msf::Auxiliary::Report
include Msf::Auxiliary::Scanner<\/p>\n
def initialize(info = {})
super(update_info(info,
‘Name’ => ‘Oracle TNS Listener SID Enumeration’,
‘Description’ => %q{
This module simply queries the TNS listener for the Oracle SID.
With Oracle 9.2.0.8 and above the listener will be protected and
the SID will have to be bruteforced or guessed.
},
‘Author’ => [ ‘CG’, ‘MC’ ],
‘License’ => MSF_LICENSE,
‘DisclosureDate’ => ‘2009-01-07’
))<\/p>\n
register_options(
[
Opt::RPORT(1521)
])
end<\/p>\n
def run_host(ip)
begin
connect<\/p>\n
pkt = tns_packet(“(CONNECT_DATA=(COMMAND=STATUS))”)<\/p>\n
sock.put(pkt)<\/p>\n
select(nil,nil,nil,0.5)<\/p>\n
data = sock.get_once<\/p>\n
if ( data and data =~ \/ERROR_STACK\/ )
print_error(“TNS listener protected for #{ip}…”)
else
if(not data)
print_error(“#{ip} Connection but no data”)
else
sid = data.scan(\/INSTANCE_NAME=([^\\)]+)\/)
sid.uniq.each do |s|
report_note(
:host => ip,
:port => rport,
:type => “oracle_sid”,
:data => “PORT=#{rport}, SID=#{s}”,
:update => :unique_data
)
print_good(“Identified SID for #{ip}:#{rport} #{s}”)
end
service_name = data.scan(\/SERVICE_NAME=([^\\)]+)\/)
service_name.uniq.each do |s|
report_note(
:host => ip,
:port => rport,
:type => “oracle_service_name”,
:data => “PORT=#{rport}, SERVICE_NAME=#{s}”,
:update => :unique_data
)
print_status(“Identified SERVICE_NAME for #{ip}:#{rport} #{s}”)
end
end
end
disconnect
rescue ::Rex::ConnectionError
rescue ::Errno::EPIPE
end
end
end<\/p>\n","protected":false},"excerpt":{"rendered":"
### This module requires Metasploit: https:\/\/metasploit.com\/download# Current source: https:\/\/github.com\/rapid7\/metasploit-framework## class MetasploitModule < Msf::Auxiliaryinclude Msf::Exploit::Remote::TNSinclude Msf::Auxiliary::Reportinclude Msf::Auxiliary::Scanner def initialize(info = {})super(update_info(info,‘Name’ => ‘Oracle TNS Listener SID Enumeration’,‘Description’ => %q{This module simply queries the TNS listener for the Oracle SID.With Oracle 9.2.0.8 and above the listener will be protected andthe SID will have to be bruteforced or …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-59333","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/59333","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=59333"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/59333\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=59333"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=59333"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=59333"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}