{"id":17,"date":"2012-07-24T13:35:00","date_gmt":"2012-07-24T11:35:00","guid":{"rendered":"http:\/\/anjo.pt\/wp\/keyword-oracle\/2012\/07\/24\/oracle-11g-default-passwords-and-hashes\/"},"modified":"2015-11-17T20:27:23","modified_gmt":"2015-11-17T19:27:23","slug":"oracle-11g-default-passwords-and-hashes","status":"publish","type":"post","link":"https:\/\/anjo.pt\/keyword-oracle\/2012\/07\/24\/oracle-11g-default-passwords-and-hashes\/","title":{"rendered":"Oracle 11g default passwords and hashes"},"content":{"rendered":"<p><span style=\"font-family: Arial, Helvetica, sans-serif;\">Today I was asked to get the list of Oracle default password hashes. Immediately thought about <a href=\"http:\/\/www.petefinnigan.com\/\">Pete Finigan website<\/a> which talks about all Oracle security issues. <\/p>\n<p>Quickly I found <a href=\"http:\/\/www.petefinnigan.com\/default\/default_password_list.htm\">this page with the list of hashes<\/a>, but I was not convinced this would work on Oracle 11.1 and 11.2. This because with the latest Oracle versions the information can be in different columns (password, spare4 from sys.user$).<\/p>\n<p>But then looking at MOS, I found the note <a href=\"https:\/\/support.oracle.com\/epmos\/faces\/ui\/km\/DocumentDisplay.jspx?id=227010.1\">Script to Check for Default Passwords Being Used for Common Usernames [ID 227010.1]<\/a> where an interesting snipped is found:<br \/>\n<\/span><\/p>\n<blockquote><p>\n<span style=\"font-family: Arial, Helvetica, sans-serif;\">The default password checker no longer exists in 11g, instead there is a<br \/>\ntable in the data dictionary SYS.DEFAULT_PWD$ which contains the default<br \/>\npasswords and there is a view DBA_USERS_WITH_DEFPWD which shows which users<br \/>\non the system are still using default passwords.<\/span><\/p><\/blockquote>\n<p><span style=\"font-family: Arial, Helvetica, sans-serif;\">So it was now important to see if on my databases all the accounts which still have the defaults are locked (or better, deleted). A simple sql gave the answer:<\/p>\n<p><\/span><\/p>\n<pre>SQL&gt; select username , account_status\n  2  from DBA_USERS_WITH_DEFPWD\n  3  natural join dba_users;\n\nUSERNAME                       ACCOUNT_STATUS\n------------------------------ --------------------------------\nAPPQOSSYS                      EXPIRED &amp; LOCKED\nCTXSYS                         EXPIRED &amp; LOCKED\nEXFSYS                         EXPIRED &amp; LOCKED\nMDDATA                         EXPIRED &amp; LOCKED\nMDSYS                          EXPIRED &amp; LOCKED\nOLAPSYS                        EXPIRED &amp; LOCKED\nORACLE_OCM                     EXPIRED &amp; LOCKED\nORDDATA                        EXPIRED &amp; LOCKED\nORDPLUGINS                     EXPIRED &amp; LOCKED\nORDSYS                         EXPIRED &amp; LOCKED\nOUTLN                          EXPIRED &amp; LOCKED\nOWBSYS                         EXPIRED &amp; LOCKED\nSCOTT                          EXPIRED &amp; LOCKED\nSI_INFORMTN_SCHEMA             EXPIRED &amp; LOCKED\nSPATIAL_CSW_ADMIN_USR          EXPIRED &amp; LOCKED\nSPATIAL_WFS_ADMIN_USR          EXPIRED &amp; LOCKED\nWMSYS                          EXPIRED &amp; LOCKED\nXDB                            EXPIRED &amp; LOCKED\nXS$NULL                        EXPIRED &amp; LOCKED\n\n19 rows selected.\n\n<\/pre>\n","protected":false},"excerpt":{"rendered":"<p>Today I was asked to get the list of Oracle default password hashes. Immediately thought about Pete Finigan website which talks about all Oracle security issues. Quickly I found this page with the list of hashes, but I was not convinced this would work on Oracle 11.1 and 11.2. This because with the latest Oracle [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6,9],"tags":[],"class_list":["post-17","post","type-post","status-publish","format-standard","category-oracle","category-security","czr-hentry"],"_links":{"self":[{"href":"https:\/\/anjo.pt\/keyword-oracle\/wp-json\/wp\/v2\/posts\/17","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/anjo.pt\/keyword-oracle\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/anjo.pt\/keyword-oracle\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/anjo.pt\/keyword-oracle\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/anjo.pt\/keyword-oracle\/wp-json\/wp\/v2\/comments?post=17"}],"version-history":[{"count":1,"href":"https:\/\/anjo.pt\/keyword-oracle\/wp-json\/wp\/v2\/posts\/17\/revisions"}],"predecessor-version":[{"id":82,"href":"https:\/\/anjo.pt\/keyword-oracle\/wp-json\/wp\/v2\/posts\/17\/revisions\/82"}],"wp:attachment":[{"href":"https:\/\/anjo.pt\/keyword-oracle\/wp-json\/wp\/v2\/media?parent=17"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/anjo.pt\/keyword-oracle\/wp-json\/wp\/v2\/categories?post=17"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/anjo.pt\/keyword-oracle\/wp-json\/wp\/v2\/tags?post=17"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}