[dbsec] Re: Extracting password hashes from raw oracle DB files

[dbsec] Re: Extracting password hashes from raw oracle DB filesEach database's 
system dbf will be different based upon usage... Usernames and passwords are 
stored in the USER$ table which is stored in the C_USER# cluster so search for 
database blocks with object ID for C_USER# for your database. To understand 
database blocks etc read 
http://www.databasesecurity.com/dbsec/Locating-Dropped-Objects.pdf and 
http://www.databasesecurity.com/dbsec/oracle-forensics-scns.pdf - use cadfile 
to dump the info: http://www.databasesecurity.com/cadfile.zip
HTH,
David

  ----- Original Message ----- 
  From: Hamid Kashfi 
  To: dbsec@xxxxxxxxxxxxx 
  Sent: Friday, June 19, 2009 10:36 PM
  Subject: [dbsec] Re: Extracting password hashes from raw oracle DB files


  Following my own post ,
  I`ve to mention that I already know the trick mentioned in
  Oracle-Hackers-Hanbook ,
  For example ,

   hexdump -C -s 448767 -n 2000 system01.dbf

  But this rise the question whether offsets are always the same (at least
  for default accounts like SYS) ?

  If not , any pattern to look for , to match & locate offsets of every
  user and it`s hash in dbf file ?


  End. :)


--
E-MAIL DISCLAIMER

The information contained in this email and any subsequent
correspondence is private, is solely for the intended recipient(s) and
may contain confidential or privileged information. For those other than
the intended recipient(s), any disclosure, copying, distribution, or any
other action taken, or omitted to be taken, in reliance on such
information is prohibited and may be unlawful. If you are not the
intended recipient and have received this message in error, please
inform the sender and delete this mail and any attachments.

The views expressed in this email do not necessarily reflect NGS policy.
NGS accepts no liability or responsibility for any onward transmission
or use of emails and attachments having left the NGS domain.

NGS and NGSSoftware are trading names of Next Generation Security
Software Ltd. Registered office address: Manchester Technology Centre,
Oxford Road, Manchester, M1 7EF with Company Number 04225835 and
VAT Number 783096402

Other related posts: