Oracle TNS#

Overview#

• Oracle TNS is a communication protocol used to connect Oracle databases and client applications.
• Supports multiple network protocols (e.g., TCP/IP, IPX/SPX).
• Built-in encryption for secure data transmission.
• Widely used in industries like healthcare, finance, retail.

⚙️ Key Features#

• Name Resolution
• Connection Management
• Load Balancing
• Security Layer over TCP/IP (including SSL/TLS)
• IPv6 Support
• Monitoring, Logging, Workload Management

🔐 Security Capabilities#

• Encryption between client-server.
• Basic authentication (hostnames, IP, username/password).
• Can use PL/SQL Exclusion List to restrict access to specific packages/types.

📦 Configuration Files#

1. tnsnames.ora (Client-side)#

• Resolves service names to network addresses.
• Contains DB service entries (service name, host, port, etc.).

📄 Example Entry:

ORCL =
(DESCRIPTION =
(ADDRESS_LIST =
(ADDRESS = (PROTOCOL = TCP)(HOST = 10.129.11.102)(PORT = 1521))
)
(CONNECT_DATA =
(SERVER = DEDICATED)
(SERVICE_NAME = orcl)
)
)
txt
CopyEdit

2. listener.ora (Server-side)#

• Configures Oracle Listener (handles incoming connections).
• Specifies which DBs the listener should forward requests to.

📄 Example Entry:

SID_LIST_LISTENER =
  (SID_LIST =
    (SID_DESC =
      (SID_NAME = PDB1)
      (ORACLE_HOME = C:\oracle\product\19.0.0\dbhome_1)
      (GLOBAL_DBNAME = PDB1)
    )
  )
LISTENER =
  (DESCRIPTION_LIST =
    (DESCRIPTION =
      (ADDRESS = (PROTOCOL = TCP)(HOST = orcl.inlanefreight.htb)(PORT = 1521))
      (ADDRESS = (PROTOCOL = IPC)(KEY = EXTPROC1521))
    )
  )

🔧 Default Configurations#

• Default Port: TCP/1521
• Supports various protocols and multiple network interfaces.
• Can be managed remotely (Oracle 8i/9i, not in 10g/11g).
• Security via Oracle Net Services.

🔑 TNS Parameters Explained#

🛠️ Setup: Oracle Tools for PenTesting#

Bash Script: Oracle-Tools-setup.sh

sudo apt-get install libaio1 python3-dev alien -y
git clone https://github.com/quentinhardy/odat.git
cd odat/
git submodule init && git submodule update
wget [instantclient-basic] && unzip
wget [instantclient-sqlplus] && unzip
export LD_LIBRARY_PATH=instantclient_21_12:$LD_LIBRARY_PATH
export PATH=$LD_LIBRARY_PATH:$PATH
pip3 install cx_Oracle
sudo apt-get install python3-scapy -y
pip3 install colorlog termcolor passlib python-libnmap pycryptodome

🔍 Tool: ODAT (Oracle Database Attacking Tool)#

• Written in Python.
• Enumerates and exploits Oracle DB flaws (e.g., SQLi, RCE, privilege escalation).
• Run with:

./odat.py -h

🔍 Scanning with Nmap#

sudo nmap -p1521 -sV 10.129.204.235 --open

• Shows Oracle TNS listener is running.
• Helps identify service version and SID availability.

🧠 Extra Notes#

• SID (System Identifier): Unique ID for each DB instance.
• A DB can have multiple SIDs for its instances.
• SID is required in the connection string.