Comments on Carnal0wnage Blog: Oracle Pwnage with the Metasploit Oracle Modules P...

It still doesn't works:fileformat.rb:3: uninitiali...

2008-11-21T10:54:00.000-05:00

It still doesn't works:
fileformat.rb:3: uninitialized constant Msf::Exploit (NameError)
from /root/framework-3.2/lib/msf/core/exploit.rb:2:in `require'
from /root/framework-3.2/lib/msf/core/exploit.rb:2
from /root/framework-3.2/lib/msf/core.rb:48:in `require'
...
...

Here follows step i take from a fresh framework-3.2:

1. put oracle.rb in lib/msf/core/exploit
2. put fileformat.rb in lib/msf/core/exploit
3. added require 'msf/core/exploit
/oracle' to lib/msf/core/exploit.rb adding:

ok, it should berequire 'msf/core/exploit/oracle't...

2008-11-20T18:25:00.000-05:00

ok, it should be

require 'msf/core/exploit/oracle'

to use the oracle aux modules

did you put the actual mixin in the folder? you cant call it without putting the mixin in the folder.

http://www.metasploit.com/users/mc/oracle9i/oracle.rb

the fileformat mixin and exploit.rb entry is for the fileformat exploits.

hope that makes sense.

If i remove:require 'msf/core/exploit/fileformat' ...

2008-11-20T11:57:00.000-05:00

If i remove:
require 'msf/core/exploit/fileformat'

from exploit.rb

i get the following:
/root/framework-3.2/modules/auxiliary/admin/oracle/oracle_sql.rb: NameError /root/framework-3.2/data/msfweb/vendor/rails/activerecord/lib/../../activesupport/lib/active_support/dependencies.rb:493:in `const_missing': uninitialized constant Msf::Exploit::ORACLE

well you jacked something up, I have no idea, remo...

2008-11-20T11:52:00.000-05:00

well you jacked something up, I have no idea, remove the line(s) you added. do you still get the error?

I tried to follow instructions from "Metasploit an...

2008-11-20T11:04:00.000-05:00

I tried to follow instructions from "Metasploit and File Format Bugs" but still doesn't works.

I'm using framework-3.2, ruby1.8.6-p111

./msfconsole :
uninitialized constant Msf::Exploit (NameError)
from /root/framework-3.2/lib/msf/core/exploit.rb:2:in `require'
from /root/framework-3.2/lib/msf/core/exploit.rb:2
from /root/framework-3.2/lib/msf/core.rb:48:in `require'
from /root/framework-3.2/lib/msf/core.rb:48
from /root/framework-3.2/lib/msf/ui/console/driver.rb:1:in `require'
from /root/framework-3.2/lib/msf/ui/console/driver.rb:1
from /root/framework-3.2/lib/msf/ui/console.rb:10:in `require'
from /root/framework-3.2/lib/msf/ui/console.rb:10
from /root/framework-3.2/lib/msf/ui.rb:10:in `require'
from /root/framework-3.2/lib/msf/ui.rb:10
from ./msfconsole:12:in `require'
from ./msfconsole:12

Great post, this is very useful for Oracle 9i and ...

2008-11-19T15:38:00.000-05:00

Great post, this is very useful for Oracle 9i and probably against early versions of 10g. Do you know if any work is being done to update the modules to attack Oracle 10g and 11g? like a SID brutefoce tool.

@netxfocus you have to load the mixinhttp://metasp...

2008-11-17T07:03:00.000-05:00

@netxfocus you have to load the mixin

http://metasploit.com/users/mc/oracle9i/oracle.rb

see the fileformat post on where to update the exploit.rb file.

@everyone else, thanks! and thank MC for releasing the code

Oh,I see.[*] WARNING! The following modules could ...

2008-11-17T00:42:00.000-05:00

Oh,I see.
[*] WARNING! The following modules could not be loaded!

C:/metasploit/modules/auxiliary/admin/oracle/oracle_sql.rb: NameError C:/metasploit/data/msfweb/vendor/rails/activerecord/lib/../../activesupport/lib/active_support/dependencies.rb:493:in `const_missing': uninitialized constant Msf::Exploit::ORACLE

Thx for your article.When testing,I have get some ...

2008-11-17T00:18:00.000-05:00

Thx for your article.When testing,I have get some error.
msf > use auxiliary/admin/oracle/oracle_sql
[-] Failed to load module: auxiliary/admin/oracle/oracle_sql

The file is exists.

What's wrong?

Great timing on this post. No kidding, I was going...

2008-11-16T23:36:00.000-05:00

Great timing on this post. No kidding, I was going to google up some of this tonight. Looking forward to your part two.