#########################################################################################
# Oracle Settings
#########################################################################################

[config]
default_port = 1521
protocol	 = tcp
categories 	 = recon, vulnlookup, vulnscan, defaultcreds, bruteforce, postexploit

[specific_options]
sid = var

[products]
oracle-server =
    Oracle/Database Server


#########################################################################################
# Recon
#########################################################################################
[check_tnscmd]
name        = tnscmd
category    = recon
description = Connect to TNS Listener and issue commands Ping, Status, Version
tool        = odat
command_1   = python2.7 odat.py tnscmd -s [IP] -p [PORT] -d any --ping -v
command_2   = python2.7 odat.py tnscmd -s [IP] -p [PORT] -d any --status -v
command_3   = python2.7 odat.py tnscmd -s [IP] -p [PORT] -d any --version -v

[check_sid-guessing]
name        = sid-guessing
category    = recon
description = Check for most common SIDs (service names)
tool        = odat
command_1   = /bin/bash -c 'export ORACLE_HOME=`file /usr/lib/oracle/*/client64/ | tail -n 1 | cut -d":" -f1`; export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$ORACLE_HOME/lib; export PATH=$ORACLE_HOME/bin:$PATH; python2.7 odat.py sidguesser -s [IP] -p [PORT] -d any -v'
context_1   = { 'sid': False }


#########################################################################################
# Vulnlookup
#########################################################################################
[check_vulners-lookup]
name        = vulners-lookup
category    = vulnlookup
description = Vulnerabilities lookup on Vulners.com (requires product name+version)
tool        = vulners-lookup
apikey      = vulners
command_1   = python3 vulners-lookup.py --apikey [APIKEY name="vulners"] '[ORACLE-SERVER-VENDOR] [ORACLE-SERVER-NAME] [ORACLE-SERVER-VERSION]'
context_1   = { 'oracle-server': 'any|version_known' }

[check_cvedetails-lookup]
name        = cvedetails-lookup
category    = vulnlookup
description = Vulnerabilities lookup on Cvedetails.com (requires product name+version)
tool        = cvedetails-lookup
command_1   = python3 cvedetails-lookup.py --vendor "[ORACLE-SERVER-VENDOR]" --product "[ORACLE-SERVER-NAME]" --version "[ORACLE-SERVER-VERSION]"
context_1   = { 'oracle-server': 'any|version_known' }


#########################################################################################
# Vulnscan
#########################################################################################
[check_tnspoisoning]
name        = tnspoisoning
category    = vulnscan
description = Test if TNS Listener is vulnerable to TNS Poisoning (CVE-2012-1675)
tool        = odat
#command_1   = python2.7 odat.py tnspoison -s [IP] -p [PORT] -d any -vv --test-module
command_1   = /bin/bash -c 'export ORACLE_HOME=`file /usr/lib/oracle/*/client64/ | tail -n 1 | cut -d":" -f1`; export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$ORACLE_HOME/lib; export PATH=$ORACLE_HOME/bin:$PATH; python2.7 odat.py tnspoison -s [IP] -p [PORT] -d any -vv --test-module'


#########################################################################################
# Defaultcreds
#########################################################################################
[check_default-creds]
name        = default-creds
category    = defaultcreds
description = Check default/common credentials on Oracle server
tool        = odat
# command_1   = python2.7 odat.py passwordguesser -s [IP] -p [PORT] -d [SID set="_VAR_"] -vv --force-retry --accounts-file accounts/accounts_multiple.txt
command_1   = /bin/bash -c 'export ORACLE_HOME=`file /usr/lib/oracle/*/client64/ | tail -n 1 | cut -d":" -f1`; export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$ORACLE_HOME/lib; export PATH=$ORACLE_HOME/bin:$PATH; python2.7 odat.py passwordguesser -s [IP] -p [PORT] -d [SID set="_VAR_"] -vv --force-retry --accounts-file "[WORDLISTSDIR]/services/oracle/oracle-default-combo-slash.txt"'
context_1   = { 'sid': True }


#########################################################################################
# Bruteforce
#########################################################################################
[check_bruteforce-creds]
name        = bruteforce-creds
category    = bruteforce
description = Bruteforce Oracle accounts (might block some accounts !)
tool        = odat
# Run bruteforce only if no creds found/known
# command_1   = python2.7 odat.py passwordguesser -s [IP] -p [PORT] -d [SID set="_VAR_"] -vv --force-retry --accounts-files accounts/logins.txt accounts/pwds.txt
command_1   = /bin/bash -c 'export ORACLE_HOME=`file /usr/lib/oracle/*/client64/ | tail -n 1 | cut -d":" -f1`; export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$ORACLE_HOME/lib; export PATH=$ORACLE_HOME/bin:$PATH; python2.7 odat.py passwordguesser -s [IP] -p [PORT] -d [SID set="_VAR_"] -vv --force-retry --accounts-files "[USERLIST default="services/oracle/oracle-usernames.txt"]" "[PASSLIST default="services/oracle/oracle-passwords.txt"]"'
context_1   = { 'sid': True, 'auth_status': NO_AUTH }
# If a user is known, bruteforce with this account
command_2   = echo '[USERNAME]' > /tmp/odatuser.txt; /bin/bash -c 'export ORACLE_HOME=`file /usr/lib/oracle/*/client64/ | tail -n 1 | cut -d":" -f1`; export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$ORACLE_HOME/lib; export PATH=$ORACLE_HOME/bin:$PATH; python2.7 odat.py passwordguesser -s [IP] -p [PORT] -d [SID set="_VAR_"] -vv --force-retry --accounts-files /tmp/odatuser.txt "[PASSLIST default="services/oracle/oracle-passwords.txt"]"'; rm /tmp/odatuser.txt
context_2   = { 'sid': True, 'auth_status': USER_ONLY }


#########################################################################################
# Postexploit
#########################################################################################
[check_postauth-audit]
name        = postauth-audit
category    = postexploit
description = Check for privesc vectors, config leading to command execution, weak accounts after authenticating on Oracle
tool        = odat
command_1   = /bin/bash -c 'export ORACLE_HOME=`file /usr/lib/oracle/*/client64/ | tail -n 1 | cut -d":" -f1`; export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$ORACLE_HOME/lib; export PATH=$ORACLE_HOME/bin:$PATH; python2.7 odat.py all -s [IP] -p [PORT] -d [SID set="_VAR_"] -U "[USERNAME]" -P "[PASSWORD]" --no-tns-poisoning-check --force-retry'
context_1   = { 'sid': True, 'auth_status': POST_AUTH }

[check_search-columns-passwords]
name        = search-columns-passwords
category    = postexploit
description = Search for columns storing passwords in the database
tool        = odat
command_1   = /bin/bash -c 'export ORACLE_HOME=`file /usr/lib/oracle/*/client64/ | tail -n 1 | cut -d":" -f1`; export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$ORACLE_HOME/lib; export PATH=$ORACLE_HOME/bin:$PATH; python2.7 odat.py search -s [IP] -p [PORT] -d [SID set="_VAR_"] -U "[USERNAME]" -P "[PASSWORD]" -vv --pwd-column-names --show-empty-columns'
context_1   = { 'sid': True, 'auth_status': POST_AUTH }