The Oracle® Hacker's Handbook: Hacking and Defending Oracle

2.3. Wrapping Up

This chapter described the TNS protocol and some of the ways in which it is possible to get the version number using features in the protocol. You can see how this occurs from tnsver.c:

/************************************
/ Compile from a command line
/
/ C:\>cl /TC tnsver.c /link wsock32.lib
/
*/

#include <stdio.h>
#include <windows.h>
#include <winsock.h>


struct hostent *he;
struct sockaddr_in s_sa;
int ListenerPort=1521;
char host[260]="";

int GetOracleVersion(unsigned char *pkt, unsigned int pkt_len, unsigned
char *resp, unsigned int resp_len, int dr);
int StartWinsock(void);
int InitTNSPacket(unsigned char *data, unsigned short data_length);
int bswap_s(unsigned int v);
int bswap_i(unsigned int v);
int error();
int GetOracleVersionByError();
int GetOracleVersionByProtocolVersion();
int GetOracleVersionByVersionCommand();


typedef struct TNSHeader {
      unsigned short Length;
      unsigned short PacketChecksum;
      unsigned char Type;
      unsigned char Flags;
      unsigned short HeaderChecksum;
     }TNSHeader;

typedef struct TNSConnect {
      unsigned short Version;
      unsigned short MinVersion;
      unsigned short GlobalServiceOptions;
      unsigned short SessionDataUnit;
      unsigned short TransportDataUnit;

unsigned short Characteristics; unsigned short MaxPacketsBeforeAck; unsigned short ByteOrder; unsigned short Length; unsigned short Offset; unsigned int MaxRecv; unsigned short AdditionalNetworkOptions; unsigned char buf[24]; } TNSConnect; #define TNS_CONNECT 1 #define MAX_VER 0×0139 #define MIN_VER ...