Breaking the Unbreakable Oracle with Metasploit

Architecture and Background

Breaking the "Unbreakable" Oracle with Metasploit Chris Gates Member of the Metasploit Project Mario Ceballos Developer for the Metasploit Project Over the years there have been tons of Oracle exploits, SQL Injection vulnerabilities, and post exploitation tricks and tools that had no order, methodology, or standardization, mainly just random .sql files. Additionally, none of the publicly available Pentest Frameworks have the ability to leverage built-in package SQL Injection vulnerabilities for privilege escalation, data extraction, or getting operating system access.

Vulnerability Analysis

In this presentation we are going to present an Oracle Pentesting Methodology and give you all the tools to break the "unbreakable" Oracle as Metasploit auxiliary modules. We've created your version and SID enumeration modules, account bruteforcing modules, ported all the public (and not so public) Oracle SQL Injection vulnerabilities into SQLI modules (with IDS evasion examples for 10g/11g), modules for OS interaction, and modules for automating some of our post exploitation tasks.

Exploitation and Demonstrations

Chris Gates (CG), member of the Metasploit project, Penetration Tester (but everyone is these days), and regular security blogger (carnal0wnage.blogspot.com). Mario Ceballos (MC) is a computer security analyst.

Remediation and Defensive Strategies

He has a number of years of experience in vulnerability research and exploit development. He is an active contributor to the Metasploit Framework primarily focusing on the auxiliary and exploit modules. For copies of the slides and additional materials please see the DEF CON 17 Archive here: