sqlmap/plugins/generic/misc.py at master · kxcode/sqlmap · GitHub

History

212 lines (158 loc) · 7.02 KB

Raw

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

#!/usr/bin/env python

"""

See the file 'doc/COPYING' for copying permission

"""

import ntpath

import re

from lib.core.common import Backend

from lib.core.common import hashDBWrite

from lib.core.common import isStackingAvailable

from lib.core.common import normalizePath

from lib.core.common import ntToPosixSlashes

from lib.core.common import posixToNtSlashes

from lib.core.common import readInput

from lib.core.common import singleTimeDebugMessage

from lib.core.common import unArrayizeValue

from lib.core.data import conf

from lib.core.data import kb

from lib.core.data import logger

from lib.core.data import queries

from lib.core.enums import DBMS

from lib.core.enums import HASHDB_KEYS

from lib.core.enums import OS

from lib.core.exception import SqlmapNoneDataException

from lib.core.exception import SqlmapUnsupportedFeatureException

from lib.request import inject

class Miscellaneous:

"""

This class defines miscellaneous functionalities for plugins.

"""

def __init__(self):

pass

def getRemoteTempPath(self):

if not conf.tmpPath and Backend.isDbms(DBMS.MSSQL):

debugMsg = "identifying Microsoft SQL Server error log directory "

debugMsg += "that sqlmap will use to store temporary files with "

debugMsg += "commands' output"

logger.debug(debugMsg)

_ = unArrayizeValue(inject.getValue("SELECT SERVERPROPERTY('ErrorLogFileName')", safeCharEncode=False))

if _:

conf.tmpPath = ntpath.dirname(_)

if not conf.tmpPath:

if Backend.isOs(OS.WINDOWS):

if conf.direct:

conf.tmpPath = "%TEMP%"

else:

self.checkDbmsOs(detailed=True)

if Backend.getOsVersion() in ("2000", "NT"):

conf.tmpPath = "C:/WINNT/Temp"

elif Backend.isOs("XP"):

conf.tmpPath = "C:/Documents and Settings/All Users/Application Data/Temp"

else:

conf.tmpPath = "C:/Windows/Temp"

else:

conf.tmpPath = "/tmp"

if re.search(r"\A[\w]:[\/\\]+", conf.tmpPath, re.I):

Backend.setOs(OS.WINDOWS)

conf.tmpPath = normalizePath(conf.tmpPath)

conf.tmpPath = ntToPosixSlashes(conf.tmpPath)

singleTimeDebugMessage("going to use %s as temporary files directory" % conf.tmpPath)

hashDBWrite(HASHDB_KEYS.CONF_TMP_PATH, conf.tmpPath)

return conf.tmpPath

def getVersionFromBanner(self):

if "dbmsVersion" in kb.bannerFp:

return

infoMsg = "detecting back-end DBMS version from its banner"

logger.info(infoMsg)

if Backend.isDbms(DBMS.MYSQL):

first, last = 1, 6

elif Backend.isDbms(DBMS.PGSQL):

first, last = 12, 6

elif Backend.isDbms(DBMS.MSSQL):

first, last = 29, 9

else:

raise SqlmapUnsupportedFeatureException("unsupported DBMS")

query = queries[Backend.getIdentifiedDbms()].substring.query % (queries[Backend.getIdentifiedDbms()].banner.query, first, last)

if conf.direct:

query = "SELECT %s" % query

kb.bannerFp["dbmsVersion"] = unArrayizeValue(inject.getValue(query))

kb.bannerFp["dbmsVersion"] = (kb.bannerFp["dbmsVersion"] or "").replace(",", "").replace("-", "").replace(" ", "")

def delRemoteFile(self, filename):

if not filename:

return

self.checkDbmsOs()

if Backend.isOs(OS.WINDOWS):

filename = posixToNtSlashes(filename)

cmd = "del /F /Q %s" % filename

else:

cmd = "rm -f %s" % filename

self.execCmd(cmd, silent=True)

def createSupportTbl(self, tblName, tblField, tblType):

inject.goStacked("DROP TABLE %s" % tblName, silent=True)

if Backend.isDbms(DBMS.MSSQL) and tblName == self.cmdTblName:

inject.goStacked("CREATE TABLE %s(id INT PRIMARY KEY IDENTITY, %s %s)" % (tblName, tblField, tblType))

else:

inject.goStacked("CREATE TABLE %s(%s %s)" % (tblName, tblField, tblType))

def cleanup(self, onlyFileTbl=False, udfDict=None, web=False):

"""

Cleanup file system and database from sqlmap create files, tables

and functions

"""

if web and self.webBackdoorFilePath:

logger.info("cleaning up the web files uploaded")

self.delRemoteFile(self.webStagerFilePath)

self.delRemoteFile(self.webBackdoorFilePath)

if not isStackingAvailable() and not conf.direct:

return

if Backend.isOs(OS.WINDOWS):

libtype = "dynamic-link library"

elif Backend.isOs(OS.LINUX):

libtype = "shared object"

else:

libtype = "shared library"

if onlyFileTbl:

logger.debug("cleaning up the database management system")

else:

logger.info("cleaning up the database management system")

logger.debug("removing support tables")

inject.goStacked("DROP TABLE %s" % self.fileTblName, silent=True)

inject.goStacked("DROP TABLE %shex" % self.fileTblName, silent=True)

if not onlyFileTbl:

inject.goStacked("DROP TABLE %s" % self.cmdTblName, silent=True)

if Backend.isDbms(DBMS.MSSQL):

udfDict = {"master..new_xp_cmdshell": None}

if udfDict is None:

udfDict = self.sysUdfs

for udf, inpRet in udfDict.items():

message = "do you want to remove UDF '%s'? [Y/n] " % udf

output = readInput(message, default="Y")

if not output or output in ("y", "Y"):

dropStr = "DROP FUNCTION %s" % udf

if Backend.isDbms(DBMS.PGSQL):

inp = ", ".join(i for i in inpRet["input"])

dropStr += "(%s)" % inp

logger.debug("removing UDF '%s'" % udf)

inject.goStacked(dropStr, silent=True)

logger.info("database management system cleanup finished")

warnMsg = "remember that UDF %s files " % libtype

if conf.osPwn:

warnMsg += "and Metasploit related files in the temporary "

warnMsg += "folder "

warnMsg += "saved on the file system can only be deleted "

warnMsg += "manually"

logger.warn(warnMsg)

def likeOrExact(self, what):

message = "do you want sqlmap to consider provided %s(s):\n" % what

message += "[1] as LIKE %s names (default)\n" % what

message += "[2] as exact %s names" % what

choice = readInput(message, default='1')

if not choice or choice == '1':

choice = '1'

condParam = " LIKE '%%%s%%'"

elif choice == '2':

condParam = "='%s'"

else:

errMsg = "invalid value"

raise SqlmapNoneDataException(errMsg)

return choice, condParam

sqlmap/plugins/generic/misc.py at master · kxcode/sqlmap · GitHub

Expand file tree

Breadcrumbs

misc.py

Latest commit

History

Breadcrumbs

misc.py

File metadata and controls