# Wodat | Windows Oracle Database Attack Toolkit **URL:** \ **Category:** Tools & Scripts\ **Tags:** tools, programming\ **Created:** [November 22, 2022, 8:38pm UTC](https://onehack.st/t/wodat-windows-oracle-database-attack-toolkit/228747 "2022-11-22T20:38:00Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![TheStrength](https://onehack.st/user_avatar/onehack.st/thestrength/32/46753_2.png) [@TheStrength](https://onehack.st/u/TheStrength)\ **Post date:** [November 22, 2022, 8:38pm UTC](https://onehack.st/t/wodat-windows-oracle-database-attack-toolkit/228747/1 "2022-11-22T20:38:00Z")
![image](https://onehack.st/uploads/default/original/3X/0/9/093402f52f8ead73370fc086b3169a550ce8d425.png) Windows Oracle Database Attack Tool [![Follow on Twitter](https://camo.githubusercontent.com/179c2b8c0906a983aba8aa4b3811350ebd84d782f5bb2617c1f8a828d1c9e0c0/68747470733a2f2f696d672e736869656c64732e696f2f747769747465722f666f6c6c6f772f696e6974726f6f74743f6c6162656c3d466f6c6c6f77253230267374796c653d736f6369616c)](https://camo.githubusercontent.com/179c2b8c0906a983aba8aa4b3811350ebd84d782f5bb2617c1f8a828d1c9e0c0/68747470733a2f2f696d672e736869656c64732e696f2f747769747465722f666f6c6c6f772f696e6974726f6f74743f6c6162656c3d466f6c6c6f77253230267374796c653d736f6369616c) [![GitHub last commit](https://camo.githubusercontent.com/61b30f7eca7993ea6f30d66c6a1c3776d151aa5dd3becac3da4027d1285fcb60/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c6173742d636f6d6d69742f696e6974726f6f742f776f646174)](https://camo.githubusercontent.com/61b30f7eca7993ea6f30d66c6a1c3776d151aa5dd3becac3da4027d1285fcb60/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c6173742d636f6d6d69742f696e6974726f6f742f776f646174) Simple port of the popular Oracle Database Attack Tool (ODAT) ([https://github.com/quentinhardy/odat](https://github.com/quentinhardy/odat)) to C# .Net Framework. Credit to [https://github.com/quentinhardy/odat](https://github.com/quentinhardy/odat) as lots of the functionality are ported from his code. - Perform password based attacks e.g. username as password, username list against given password, password list against given username, username:pass combolist. - Test if a credential/connection string is working against target - Brute force attacks to discover valid SID/ServiceNames - Perform discovery of valid TNS listeners against provided target file or CIDR range - More to come, I hope! [![image](https://user-images.githubusercontent.com/954507/180816033-31dbc5d5-0012-401a-9748-48df230b0fdf.png)](https://user-images.githubusercontent.com/954507/180816033-31dbc5d5-0012-401a-9748-48df230b0fdf.png) ## Disclaimer I take not responsibility for your use of the software. Development is done in my personal capacity and carry no affiliation to my work. ## Usage The general command line arguments required are as follow: ```auto wodat.exe COMMAND ARGGUMENTS COMMAND (ALL,BRUTECRED,BRUTESID,BRUTESRV,TEST,DISC) -server:XXX.XXX.XXX.XXX -port:1520 -sid:AS OR -srv:AS -user:Peter -pass:Password ``` To test if a specific credential set works. ```auto wodat.exe TEST -server:XXX.XXX.XXX.XXX -port:1521 -sid:XE -user:peter -pass:pan ``` See the outline on modules for further usage. The tool will always first check if the TNS listener that is targeted works. ## Modules #### BRUTESID Module performs wordlist SID guessing attack if not successful will ask for brute force attack. ```auto wodat.exe BRUTESID -server:XXX.XXX.XXX.XXX -port:1521 ``` [![image](https://user-images.githubusercontent.com/954507/180816431-7bb82722-55cf-4233-9cca-8e809ebf5f4a.png)](https://user-images.githubusercontent.com/954507/180816431-7bb82722-55cf-4233-9cca-8e809ebf5f4a.png) #### BRUTESRV Module performs wordlist ServiceName guessing attack if not successful will ask for brute force attack. ```auto wodat.exe BRUTESRV -server:XXX.XXX.XXX.XXX -port:1521 ``` #### BRUTECRED Module performs wordlist password based attack. The following options exist: ```auto A - username:password combolist with no credentials given during arguments B - username list with password given in arguments C - password list with username given in arguments D - username as password with username list provided ``` To perform a basic attack with a given file that has username:password combos. ```auto wodat.exe BRUTECRED -server:XXX.XXX.XXX.XXX -port:1521 -sid:XE ``` [![image](https://user-images.githubusercontent.com/954507/180830466-3bf2f809-8373-44cc-a72f-bc11ad012283.png)](https://user-images.githubusercontent.com/954507/180830466-3bf2f809-8373-44cc-a72f-bc11ad012283.png) #### TEST Module tests if the given connection string can connect successfully. ```auto wodat.exe TEST -server:XXX.XXX.XXX.XXX -port:1521 -sid:XE -user:peter -pass:pan ``` [![image](https://user-images.githubusercontent.com/954507/180830998-112671d7-d747-43ba-90e9-01c615ca5248.png)](https://user-images.githubusercontent.com/954507/180830998-112671d7-d747-43ba-90e9-01c615ca5248.png) #### DISC Module will perform discovery against provided CIDR range or file with instances. Note, only instances with valid TNS listeners will be returned. Testing a network range will be much faster as it’s processed in parallel. ```auto wodat.exe DISC ``` Instances to test must be formatted as per the below example `targets.txt`: ```auto 192.168.10.1 192.168.10.5,1521 ``` [![image](https://user-images.githubusercontent.com/954507/181905625-a2b4261c-3364-4f5d-b60e-dbfceaba5a65.png)](https://user-images.githubusercontent.com/954507/181905625-a2b4261c-3364-4f5d-b60e-dbfceaba5a65.png) ### ALL Not implemented yet. #### RECON Not implemented yet. ## Setup and Requirements You can grab automated release build from the GitHub Actions or build yourself using the following commands: ```auto nuget restore wodat.sln msbuild wodat.sln -t:rebuild -property:Configuration=Release ``` Some general notes: The `Oracle.ManagedDataAccess.dll` library will have to be copied with the binary. I’m looking at ways of embedding it. ## Todo - Handle SYSDBA and SYSOPER connections - Implement outstanding modules - Various validation, error handling code still needs to be done - Some minor known bugfixes - Add options to check against built in lists for SID, ServiceNames or common credentials ## Changelog Version 0.1 - Base toolkit and functionality Version 0.2 - Several bugfixes, improved socket connection and added RECON module ## GitHub: > **[GitHub - InitRoot/wodat: Windows Oracle Database Attack Toolkit](https://github.com/InitRoot/wodat)** > > Windows Oracle Database Attack Toolkit