tools

Overview

SQLplus (SQLplus) is Oracle’s command-line client for connecting to and interacting with Oracle Database instances. During penetration tests it is used to authenticate to Oracle databases (including with AS SYSDBA for elevated access), enumerate tables and users, extract password hashes for offline cracking, and verify exploitation paths like webshell uploads.

Target / Context

Oracle Database instances accessible via TNS listener on TCP/1521. Requires valid credentials (or SYSDBA privileges via an authenticated path from ODAT).

Installation

ℹ︎Installation Commands:

Option 1 — apt:

sudo apt install oracle-instantclient-sqlplus

Option 2 — manual install script (handles library dependencies):

wget https://download.oracle.com/otn_software/linux/instantclient/214000/instantclient-basic-linux.x64-21.4.0.0.0dbru.zip
wget https://download.oracle.com/otn_software/linux/instantclient/214000/instantclient-sqlplus-linux.x64-21.4.0.0.0dbru.zip
sudo mkdir -p /opt/oracle
sudo unzip -d /opt/oracle instantclient-basic-linux.x64-21.4.0.0.0dbru.zip
sudo unzip -d /opt/oracle instantclient-sqlplus-linux.x64-21.4.0.0.0dbru.zip
export LD_LIBRARY_PATH=/opt/oracle/instantclient_21_4:$LD_LIBRARY_PATH
export PATH=$LD_LIBRARY_PATH:$PATH
source ~/.bashrc
sqlplus -V

Fix libsqlplus.so error:

sudo sh -c "echo /usr/lib/oracle/**{VERSION}**/client64/lib > /etc/ld.so.conf.d/oracle-instantclient.conf"; sudo ldconfig

Find version:

find / -name sqlplus 2>/dev/null

Guide: https://www.geeksforgeeks.org/how-to-install-sqlplus-on-linux/

Basic Usage

ℹ︎Basic Usage: 
sqlplus <username>/<password>@<host>/<SID_or_service>

Standard connection:

sqlplus <username>/<password>@<target-ip>/XE

Connect as SYSDBA:

sqlplus <username>/<password>@<target-ip>/XE as sysdba

Flags & Options

ℹ︎Flags & Options:
OptionDescriptionExample
as sysdbaConnect with SYSDBA privilegessqlplus user/pass@host/SID as sysdba
as sysoperConnect with SYSOPER privilegessqlplus user/pass@host/SID as sysoper
-SSilent mode — suppress banners and promptssqlplus -S user/pass@host/SID
/nologStart sqlplus without connectingsqlplus /nolog

Common Use Cases

Database and Table Enumeration

ℹ︎Commands:

List all accessible tables

select table_name from all_tables;

Tables by schema

select owner, table_name from all_tables order by owner;
select column_name, data_type from all_tab_columns where table_name = 'USERS';

Check Current User Privileges

ℹ︎Commands:

Current user’s roles and privileges

select * from user_role_privs;

Current session’s effective privileges

select * from session_privs;

Requires DBA

select grantee, privilege from dba_sys_privs where grantee = 'SCOTT';

Extract Password Hashes (SYSDBA required)

ℹ︎Commands: 
select name, password from sys.user$;

Hashes can be cracked offline using Hashcat or JohnTheRipper.

Check if SYSDBA Login is Possible

When user has appropriate privileges or the database is misconfigured:

ℹ︎Commands: 
sqlplus <username>/<password>@<target-ip>/XE as sysdba

After logging in: show user; — should return USER is “SYS”

  • Service Enumeration

References / Images