From: Pete Finnigan Newsgroups: comp.databases.oracle.server Subject: Re: USERs in ORACLE Date: Wed, 8 Aug 2001 14:26:28 +0100 Message-ID: <7cY7$KAE4Tc7EwC8@peterfinnigan.demon.co.uk> References: <9kjic4$4u5hi$1@ID-101160.news.dfncis.de> NNTP-Posting-Host: peterfinnigan.demon.co.uk X-NNTP-Posting-Host: peterfinnigan.demon.co.uk:193.237.131.110 X-Trace: news.demon.co.uk 997277323 nnrp-12:12500 NO-IDENT peterfinnigan.demon.co.uk:193.237.131.110 X-Complaints-To: abuse@demon.net MIME-Version: 1.0 X-Newsreader: Turnpike Integrated Version 5.01 S Lines: 250 Hi Amin I posted the following article to the pen-test mailing list a few weeks ago. It may be of use to you. It is pasted below as HTML between the lines +++++++++CUT and CUT+++++++ just cut it out and display it as html in IE or netscape. cheers Pete Finnigan Pentest Limited ++++++++++++++++++++++++++++++++++++++++++++CUT

Investigation of Default Oracle Accounts

I have investigated standard installations of the Oracle 8i RDBMS on both Linux and Windows NT for version 8.1.5 and have found the following possible default accounts and password's that could be installed. I have installed the standard RDBMS and development tools. This gives us 9 default accounts under Linux and 12 under Windows NT.

The Windows NT installation is more dangerous as it provides a DBA account with the user CTXSYS and also the user MDSYS has "ALL PRIVILEGES WITH ADMIN" granted. Having "ALL PRIVILEGES" is as good as having dba privileges. None of the Linux default users is as dangerous as this, except of course SYS and SYSTEM if the passwords have been left set to the defaults.

There are 52 default users for Linux and 57 for Windows NT. You are never going to see all of these users in one database unless someone is experimenting but its going to be possible to see some of them. I found out these users by searching all of the SQL files provided by Oracle in the standard installation.

Remember it's the data in the actual database that should be protected, and most often it's not. Its not necessary to get SYS, SYSTEM or even a DBA to get at user data in an Oracle database. A user such as DBSNMP or OUTLN can access a list of users in the database. The actual user information is stored in a database table called USER$ owned by the user SYS. Unless you are very lucky and someone has inadvertently granted access to this table you will not be able to see it unless you are logged on as SYS. There is also a view DBA_USERS that accesses this SYS table. Access is granted to select from this view to users who are DBA, or who have been granted permission to select any view. All is not lost though as any user who has the minimum permissions such as DBSNMP can access another view called ALL_USERS. This view doesn't let you see the password hash, but does let you get a list of all of the database users. If you can get a users password and quite often they are set to USER_NAME/USER_NAME then you can probably access the production schema and certainly do SQL Injection on the application. Using one of the innocent users such as DBSNMP or OUTLN you can glean a lot of information about a database, and who uses it.

Also for both Linux and Windows NT installations the internal users default password is set to oracle. This user name is used to connect effectivley as SYS without having the SYS password.

Here is a table listing all of the default users and passwords i could find for both Operating Systems. The usernames / passwords colored in Orange are the ones installed from a standard installation.

WINDOWS NTLINUXPRIVILEGES
ADAMS/WOODADAMS/WOOD .
AQDEMO/AQDEMOAQDEMO/AQDEMO.
AQUSER/AQUSERAQUSER/AQUSER.
AURORA$ORB$UNAUTHENTICATED/INVALID AURORA$ORB$UNAUTHENTICATED/INVALID.
BLAKE/PAPERBLAKE/PAP ER.
CATALOG/CATALOG..
CDEMO82/CDEMO82CDEMO82/CDEMO82 .
CDEMOCOR/CDEMOCORCDEMOCOR/CDEMOCOR< /TD>.
CDEMOUCB/CDEMOUCB..
.CDEMORID/CDEMORID.
CLARK/CLOTHCLARK/CLO TH.
COMPANY/COMPANYCOMPANY/COMPANY All Privileges
CTXSYS/CTXSYSCTXSYS/DBA
DBSNMP/DBSNMPDBSNMP/DBSNMP.
DEMO/DEMO..
DEMO8/DEMO8DEMO8/DEMO8.
EMP/EMP..
EVENT/EVENTEVENT/EVENTDBA
FINANCE/FINANCEFINANCE/FINANCE All Privileges
FND/FNDFND/FND.
GPFD/GPFDGPFD/GPFD.
GPLD/GPLDGPLD/GPLD.
JONES/STEELJONES/STE EL.
MDSYS/MDSYSMDSYS/MDSYSAll Privileges with Admin
MFG/MFGMFG/MFGAll Privileges
MILLER/MILLERMILLER/MILLER
MMO2/MMO2MMO2/MMO2.
.MODTEST/YESDBA
MOREAU/MOREAUMOREAU/MOREAU.
.NAMES/NAMES.
MTSSYS/MTSSYS..
OCITEST/OCITESTOCITEST/OCITEST .
ORDPLUGINS/ORDPLUGINSORDPLUGINS/ORDPLUGINS.
ORDSYS/ORDSYSORDSYS/ ORDSYS.
OUTLN/OUTLNOUTLN/OUTLN.
PO/POPO/PODBA
POWERCARTUSER/POWERCARTUSERPOWERCAR TUSER/POWERCARTUSER.
PRIMARY/PRIMARYPRIMARY/PRIMARY .
PUBSUB/PUBSUBPUBSUB/PUBSUBDBA
RE/RE..
RMAIL/RMAIL..
SAMPLE/SAMPLE.DBA
SCOTT/TIGERSCOTT/TIGER.
SECDEMO/SECDEMOSECDEMO/SECDEMO .
SYS/CHANGE_ON_INSTALLSYS/CHANGE_ON_INSTALLSUPERUSER DBA
SYSTEM/MANAGERSYSTEM/MANAGERDBA
TRACESVR/TRACE..
TSDEV/TSDEVTSDEV/TSDEV.
TSUSER/TSUSERTSUSER/TSUSER.
USER0/USER0USER0/USER0.
USER1/USER1USER1/USER1.
USER2/USER2USER2/USER2.
USER3/USER3USER3/USER3.
USER4/USER4USER4/USER4.
USER5/USER5USER5/USER5.
USER6/USER6USER6/USER6.
USER7/USER7USER7/USER7.
USER8/USER8USER8/USER8.
USER9/USER9USER9/USER9.
VRR1/VRR1VRR1/VRR1DBA
CUT+++++++++++++++++++++++++++++++++++++++++++++ In article <9kjic4$4u5hi$1@ID-101160.news.dfncis.de>, Amin Emami writes >hi folks, > >I've installed Oracle 81 on Win2000 but I've got a problem now! >I don't know what the passwords for the default users there is in the >system. >For example, what are the passwords of SYS or SYSTEM ? > >I've always worked with ORACLE at work and I don't know much more >administration stuffs. > >Any help on these admin users is welcome. > >Thanks, >Amin > > > > -- Pete Finnigan