Oracle TNS (enumeration and RCE)
The TNS listener (Transparent Network Substrate) is the process that handles connections to an Oracle database, by default on port 1521. It is a common attack surface on internal pentests: if we guess the SID (the instance identifier) and some credentials, we can query the database and, with enough privileges, reach command execution or write files on the server.
Mechanism
To talk to the listener and brute-force credentials, the go-to tool is ODAT (Oracle Database Attacking Tool), which automates SID guessing, credential spraying, and several abuses:
odat all -s <ip>ODAT returns the SID and, if it hits, valid credentials (for example the classic scott/tiger). With those you log in via sqlplus, and you can even try to escalate to database administrator:
sqlplus <user>/<pass>@<ip>/<sid>
sqlplus <user>/<pass>@<ip>/<sid> as sysdbaIf the account has privileges, the UTL_FILE package lets you write files to the system, which on a web server (IIS, say) turns into a web shell:
odat utlfile -s <ip> -d <sid> -U <user> -P <pass> --sysdba --putFile C:\\inetpub\\wwwroot <file> ./<file>Requirements
Enumerating the listener and the SID needs no credentials. From there, querying the database requires a valid user (often obtained by default or by spraying), and writing files or executing requires privileges such as sysdba or rights over UTL_FILE. The listener is remotely manageable in Oracle 8i/9i but not in 10g/11g, which limits some vectors depending on the version.
How to detect it
The attack is given away by: a burst of failed login attempts against the instance (ODAT spraying), the appearance of sysdba sessions from non-administrative machines, and file writes to web-server paths via UTL_FILE. Oracle's native auditing records logins and the use of sensitive packages.
Defence. Remove default accounts (scott, etc.) and enforce strong passwords, patch the database, restrict the listener to trusted origins (valid node checking), limit sysdba and UTL_FILE privileges, and enable auditing. Related to MSSQL xp_cmdshell, file upload RCE and credential reuse.