Metasploit攻擊Oracle的環境搭建(Failed to load the OCI library: no such file to load -- oci8)

Metasploit中關於Oracle的攻擊模塊默認並不完全，需要自己做一些工作。本文主要記錄在搭建環境的中的一些錯誤（操作系統Backtrack 5）。在默認情況下使用oracle的一些攻擊功能會出現類似如下錯誤：ary module execution completed

1. msf > use auxiliary/admin/oracle/oracle_login
2. msf auxiliary(oracle_login) > set RHOST 192.168.0.91
3. RHOST => 192.168.0.91
4. msf auxiliary(oracle_login) > run
6. [-] Failed to load the OCI library: no such file to load -- oci8
7. [-] See http://www.metasploit.com/redmine/projects/framework/wiki/OracleUsage for installation instructions
8. [*] Auxiliary module execution completed

安裝Oracle Instant Clinet

下載basic, sqlplus,和SDK:http://www.oracle.com/technetwork/database/features/instant-client/index-097480.html, 將三個壓縮包解壓到同一個目錄下並創建一個libclntsh.so -> libclntsh.so.11.1的鏈接。

1. >unzip /opt/oracle/instantclient-basic-linux32-11.2.0.2.0.zip
2. >unzip /opt/oracle/instantclient-sqlplus-linux32-11.2.0.2.0.zip
3. >unzip /opt/oracle/instantclient-sdk-linux32-11.2.0.2.0.zip
4. >ln -s libclntsh.so.11.1 libclntsh.so

目錄裡的內容大概如下：

1. root@bt:/opt/oracle/instantclient_11_2# ls
2. adrci libclntsh.so libociei.so ojdbc5.jar SQLPLUS_README
3. BASIC_README libclntsh.so.11.1 libocijdbc11.so ojdbc6.jar uidrvci
4. genezi libnnz11.so libsqlplusic.so sdk xstreams.jar
5. glogin.sql libocci.so.11.1 libsqlplus.so sqlplus

然後執行vi ~/.bashrc 在文件的最後添加環境變量如下：

1. export PATH=$PATH:/opt/oracle/instantclient_11_2
2. export SQLPATH=/opt/oracle/instantclient_11_2
3. export TNS_ADMIN=/opt/oracle/instantclient_11_2
4. export LD_LIBRARY_PATH=/opt/oracle/instantclient_11_2
5. export ORACLE_HOME=/opt/oracle/instantclient_11_2

確認Oracle Instant Client是否安裝成功

1. root@bt:~# sqlplus scott/tiger@//192.168.0.91/ORCL
3. SQL*Plus: Release 11.2.0.2.0 Production on Fri Sep 23 04:39:08 2011
5. Copyright (c) 1982, 2010, Oracle. All rights reserved.
8. Connected to:
9. Oracle Database 10g Enterprise Edition Release 10.1.0.2.0 - Production
10. With the Partitioning, OLAP and Data Mining options
12. SQL>

安裝OCI8

下載鏈接：http://ruby-oci8.rubyforge.org/en/，解壓後進入解壓後的目錄，運行make 和 make install。在運行這兩個命令之前，先用env命令看看前面設置的環境變量是否生效了，如果沒有生效，前面sqlplus也是運行不起來的，這時重新啟動一下電腦就可以了。前面做的步驟可以參考http://dev.metasploit.com/redmine/projects/1/wiki/OracleUsage。

安裝完成後需要驗證一下OCI8是否安裝成功，我用的這個版本出現如下問題。

1. root@bt:~# irb
2. irb(main):001:0> require 'oci8'
3. LoadError: no such file to load -- oci8lib_191
4. from /usr/local/lib/site_ruby/1.9.2/oci8.rb:40:in `require'
5. from /usr/local/lib/site_ruby/1.9.2/oci8.rb:40:in `<top (required)>'
6. from (irb):1:in `require'
7. from (irb):1
8. from /usr/bin/irb:12:in `<main>'

因為我的ruby版本是1.9.2，安裝的時候生成的是oci8lib_192，所以需要改一個oci8.rb這個文件

root@bt:/usr/local/lib/site_ruby/1.9.2# vi oci8.rb

多加一個when, 讓其使用oci8lib_192這個庫

1. # The suffix number indicates the ruby API version.
2. # 18 - ruby 1.8.x
3. # 191 - ruby 1.9.1 and 1.9.2
4. # 19x - ruby 1.9.x future version which will break the API compatibility
5. case RUBY_VERSION
6. when /^1\.9\.1/
7. so_basename += '191'
8. when /^1\.9\.2/
9. so_basename += '192'
10. when /^1\.8/
11. so_basename += '18'
12. else
13. raise 'unsupported ruby version: ' + RUBY_VERSION
14. end
15. require so_basename

這時我們再來確認一下，出現下面類似的信息就可以了。

1. irb(main):002:0> require 'oci8'
2. Warning: NLS_LANG is not set. fallback to US-ASCII.
3. => true

在backtrack5 R1上，msf這時還是會出現

1. [-] Failed to load the OCI library: no such file to load -- oci8

這是因為metasploit的環境變量中沒有包含我們安裝的OCI8的緣故，可以在metasploit執行如下命令確認一下

1. msf auxiliary(oracle_login) > ruby -r rbconfig -e "puts Config::CONFIG['sitelibdir']"
2. [*] exec: ruby -r rbconfig -e "puts Config::CONFIG['sitelibdir']"
4. /opt/framework/ruby/lib/ruby/site_ruby/1.9.1

1. msf auxiliary(oracle_login) > env | grep RUBYLIB
2. [*] exec: env | grep RUBYLIB
4. RUBYLIB=/opt/framework/ruby/lib:/opt/framework/ruby/lib/ruby:/opt/framework/ruby/lib/ruby/1.9.1:/opt/framework/ruby/lib/ruby/1.9.1/i686-linux:/opt/framework/ruby/lib/ruby/site_ruby:/opt/framework/ruby/lib/ruby/site_ruby/1.9.1:/opt/framework/ruby/lib/ruby/site_ruby/1.9.1/i686-linux

在/opt/framework3/scripts/setenv.sh的 RUBLIB中加入你安裝的OCI8所在的目錄。

:/usr/local/lib/site_ruby/1.9.2:/usr/local/lib/site_ruby/1.9.2/i486-linux

重新啟動msfconsole

1. msf > use auxiliary/admin/oracle/oracle_login
2. msf auxiliary(oracle_login) > set RHOST 192.168.0.91
3. RHOST => 192.168.0.91
4. msf auxiliary(oracle_login) > run
6. [*] Starting brute force on 192.168.0.91:1521...
7. [*] Found user/pass of: scott/tiger on 192.168.0.91 with sid ORCL
8. [*] Auxiliary module execution completed