W32.Coozie: Discovering Oracle CVE-2018-3253

This post describes discovery and exploitation of an Oracle configuration/implementation flaw (CVE-2018-3253) where an Oracle password filter (oidpwdcn.dll) writes unsalted SHA1 password hashes into the Active Directory attribute orclCommonAttribute and those values are readable by Authenticated Users. The author retrieved the attribute values via LDAPS, cracked thousands of passwords, achieved Domain Admin access during a red-team engagement, reported the issue to Oracle, and Oracle released a patch in October 2018.