Metasploit中关于Oracle的攻击模块默认并不完全，需要自己做一些工作。本文主要记录在搭建环境的中的一些错误（操作系统Backtrack 5）。在默认情况下使用oracle的一些攻击功能会出现类似如下错误：ary module execution completed
- msf > use auxiliary/admin/oracle/oracle_login
- msf auxiliary(oracle_login) > set RHOST 192.168.0.91
- RHOST => 192.168.0.91
- msf auxiliary(oracle_login) > run
-
- [-] Failed to load the OCI library: no such file to load -- oci8
- [-] See http://www.metasploit.com/redmine/projects/framework/wiki/OracleUsage for installation instructions
- [*] Auxiliary module execution completed
|
安装Oracle Instant Clinet
下载basic, sqlplus,和SDK:http://www.oracle.com/technetwork/database/features/instant-client/index-097480.html, 将三个压缩包解压到同一个目录下并创建一个libclntsh.so -> libclntsh.so.11.1的链接。
- >unzip /opt/oracle/instantclient-basic-linux32-11.2.0.2.0.zip
- >unzip /opt/oracle/instantclient-sqlplus-linux32-11.2.0.2.0.zip
- >unzip /opt/oracle/instantclient-sdk-linux32-11.2.0.2.0.zip
- >ln -s libclntsh.so.11.1 libclntsh.so
|
目录里的内容大概如下：
- root@bt:/opt/oracle/instantclient_11_2# ls
- adrci libclntsh.so libociei.so ojdbc5.jar SQLPLUS_README
- BASIC_README libclntsh.so.11.1 libocijdbc11.so ojdbc6.jar uidrvci
- genezi libnnz11.so libsqlplusic.so sdk xstreams.jar
- glogin.sql libocci.so.11.1 libsqlplus.so sqlplus
|
然后执行vi ~/.bashrc 在文件的最后添加环境变量如下：
- export PATH=$PATH:/opt/oracle/instantclient_11_2
- export SQLPATH=/opt/oracle/instantclient_11_2
- export TNS_ADMIN=/opt/oracle/instantclient_11_2
- export LD_LIBRARY_PATH=/opt/oracle/instantclient_11_2
- export ORACLE_HOME=/opt/oracle/instantclient_11_2
|
确认Oracle Instant Client是否安装成功
- root@bt:~# sqlplus scott/tiger@//192.168.0.91/ORCL
-
- SQL*Plus: Release 11.2.0.2.0 Production on Fri Sep 23 04:39:08 2011
-
- Copyright (c) 1982, 2010, Oracle. All rights reserved.
-
-
- Connected to:
- Oracle Database 10g Enterprise Edition Release 10.1.0.2.0 - Production
- With the Partitioning, OLAP and Data Mining options
-
- SQL>
|
安装OCI8
安装完成后需要验证一下OCI8是否安装成功，我用的这个版本出现如下问题。
- root@bt:~# irb
- irb(main):001:0> require 'oci8'
- LoadError: no such file to load -- oci8lib_191
- from /usr/local/lib/site_ruby/1.9.2/oci8.rb:40:in `require'
- from /usr/local/lib/site_ruby/1.9.2/oci8.rb:40:in `<top (required)>'
- from (irb):1:in `require'
- from (irb):1
- from /usr/bin/irb:12:in `<main>'
|
因为我的ruby版本是1.9.2，安装的时候生成的是oci8lib_192，所以需要改一个oci8.rb这个文件
| root@bt:/usr/local/lib/site_ruby/1.9.2# vi oci8.rb |
多加一个when, 让其使用oci8lib_192这个库
-
-
-
-
- case RUBY_VERSION
- when /^1\.9\.1/
- so_basename += '191'
- when /^1\.9\.2/
- so_basename += '192'
- when /^1\.8/
- so_basename += '18'
- else
- raise 'unsupported ruby version: ' + RUBY_VERSION
- end
- require so_basename
|
这时我们再来确认一下，出现下面类似的信息就可以了。
- irb(main):002:0> require 'oci8'
- Warning: NLS_LANG is not set. fallback to US-ASCII.
- => true
|
在backtrack5 R1上，msf这时还是会出现
- [-] Failed to load the OCI library: no such file to load -- oci8
|
这是因为metasploit的环境变量中没有包含我们安装的OCI8的缘故，可以在metasploit执行如下命令确认一下
- msf auxiliary(oracle_login) > ruby -r rbconfig -e "puts Config::CONFIG['sitelibdir']"
- [*] exec: ruby -r rbconfig -e "puts Config::CONFIG['sitelibdir']"
-
- /opt/framework/ruby/lib/ruby/site_ruby/1.9.1
|
- msf auxiliary(oracle_login) > env | grep RUBYLIB
- [*] exec: env | grep RUBYLIB
-
- RUBYLIB=/opt/framework/ruby/lib:/opt/framework/ruby/lib/ruby:/opt/framework/ruby/lib/ruby/1.9.1:/opt/framework/ruby/lib/ruby/1.9.1/i686-linux:/opt/framework/ruby/lib/ruby/site_ruby:/opt/framework/ruby/lib/ruby/site_ruby/1.9.1:/opt/framework/ruby/lib/ruby/site_ruby/1.9.1/i686-linux
|
在/opt/framework3/scripts/setenv.sh的 RUBLIB中加入你安装的OCI8所在的目录。
| :/usr/local/lib/site_ruby/1.9.2:/usr/local/lib/site_ruby/1.9.2/i486-linux |
重新启动msfconsole
- msf > use auxiliary/admin/oracle/oracle_login
- msf auxiliary(oracle_login) > set RHOST 192.168.0.91
- RHOST => 192.168.0.91
- msf auxiliary(oracle_login) > run
-
- [*] Starting brute force on 192.168.0.91:1521...
- [*] Found user/pass of: scott/tiger on 192.168.0.91 with sid ORCL
- [*] Auxiliary module execution completed
|
本文转hackfreer51CTO博客，原文链接：http://blog.51cto.com/pnig0s1992/768894，如需转载请自行联系原作者
