Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 16b4530

Browse files
bdamelebdamele
committed
Minor bug fixes to --os-shell (altought web backdoor functionality still to be reviewed).
Minor common library code refactoring. Code cleanup. Set back the default User-Agent to sqlmap for comparison algorithm reasons. Updated THANKS.
1 parent 5121a4d commit 16b4530

35 files changed

Lines changed: 157 additions & 200 deletions

‎doc/THANKS‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,9 @@ Pierre Chifflier <[email protected]>
2727
for uploading the sqlmap 0.6.2 Debian package to the official Debian
2828
project repository
2929

30+
Ulises U. Cune <[email protected]>
31+
for reporting a bug
32+
3033
Stefano Di Paola <[email protected]>
3134
for suggesting good features
3235

@@ -80,6 +83,9 @@ Anant Kochhar <[email protected]>
8083
Alexander Kornbrust <[email protected]>
8184
for reporting a couple of bugs
8285

86+
Nicolas Krassas <[email protected]>
87+
for reporting a bug
88+
8389
Guido Landi <[email protected]>
8490
for the great technical discussions
8591
for Microsoft SQL Server 2000 and Microsoft SQL Server 2005

‎lib/contrib/magic.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -64,7 +64,7 @@ def __del__(self):
6464
try:
6565
magic_close(self.cookie)
6666
except Exception, e:
67-
print "got thig: ", e
67+
print "got this:", e
6868

6969

7070
_magic_mime = None

‎lib/contrib/multipartpost.py‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -54,11 +54,11 @@ def http_request(self, request):
5454
v_files = []
5555
v_vars = []
5656
try:
57-
for(key, value) in data.items():
58-
if type(value) == file:
59-
v_files.append((key, value))
60-
else:
61-
v_vars.append((key, value))
57+
for(key, value) in data.items():
58+
if type(value) == file:
59+
v_files.append((key, value))
60+
else:
61+
v_vars.append((key, value))
6262
except TypeError:
6363
systype, value, traceback = sys.exc_info()
6464
raise sqlmapDataException, "not a valid non-string sequence or mapping object", traceback

‎lib/controller/checks.py‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,6 @@
2727
import re
2828
import time
2929

30-
from lib.controller.action import action
3130
from lib.core.agent import agent
3231
from lib.core.common import randomInt
3332
from lib.core.common import randomStr
@@ -295,9 +294,9 @@ def checkStability():
295294
infoMsg = "testing if the url is stable, wait a few seconds"
296295
logger.info(infoMsg)
297296

298-
firstPage, firstHeaders = Request.queryPage(content=True)
297+
firstPage, _ = Request.queryPage(content=True)
299298
time.sleep(1)
300-
secondPage, secondHeaders = Request.queryPage(content=True)
299+
secondPage, _ = Request.queryPage(content=True)
301300

302301
condition = firstPage == secondPage
303302

‎lib/controller/controller.py‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,6 @@
3636
from lib.core.data import conf
3737
from lib.core.data import kb
3838
from lib.core.data import logger
39-
from lib.core.exception import sqlmapConnectionException
4039
from lib.core.exception import sqlmapNotVulnerableException
4140
from lib.core.session import setInjection
4241
from lib.core.target import createTargetDirs
@@ -105,7 +104,6 @@ def start():
105104
logger.info(infoMsg)
106105

107106
hostCount = 0
108-
receivedCookies = []
109107
cookieStr = ""
110108
setCookieAsInjectable = True
111109

‎lib/core/agent.py‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,6 @@
3333
from lib.core.data import queries
3434
from lib.core.data import temp
3535
from lib.core.exception import sqlmapNoneDataException
36-
from lib.core.exception import sqlmapUnsupportedDBMSException
3736

3837

3938
class Agent:

‎lib/core/common.py‎

Lines changed: 74 additions & 56 deletions
Original file line numberDiff line numberDiff line change
@@ -141,9 +141,9 @@ def formatDBMSfp(versions=None):
141141

142142

143143
def formatFingerprintString(values, chain=" or "):
144-
string = "|".join([v for v in values])
144+
strJoin = "|".join([v for v in values])
145145

146-
return string.replace("|", chain)
146+
return strJoin.replace("|", chain)
147147

148148

149149
def formatFingerprint(target, info):
@@ -224,73 +224,91 @@ def getHtmlErrorFp():
224224

225225

226226
def getDocRoot():
227-
"""
228-
This method returns the web application document root based on the
229-
detected absolute files paths in the knowledge base.
230-
"""
231-
232227
docRoot = None
233228

234-
if kb.absFilePaths:
235-
logMsg = "retrieved the possible injectable "
236-
logMsg += "file absolute system paths: "
237-
logMsg += "'%s'" % ", ".join(path for path in kb.absFilePaths)
238-
logger.info(logMsg)
229+
if kb.os == "Windows":
230+
defaultDocRoot = "C:\\Inetput\\wwwroot\\"
239231
else:
240-
warnMsg = "unable to retrieve the injectable file "
241-
warnMsg += "absolute system path"
242-
logger.warn(warnMsg)
232+
defaultDocRoot = "/var/www/"
243233

244-
for absFilePath in kb.absFilePaths:
245-
if conf.path in absFilePath:
246-
index = absFilePath.index(conf.path)
247-
docRoot = absFilePath[:index]
248-
break
234+
if kb.absFilePaths:
235+
for absFilePath in kb.absFilePaths:
236+
absFilePathWin = None
237+
238+
if re.search("([\w]\:[\/\\\\]+)", absFilePath):
239+
absFilePathWin = absFilePath
240+
absFilePath = absFilePath[2:].replace("\\", "/")
241+
242+
absFilePath = os.path.normpath(absFilePath)
243+
244+
if os.path.dirname(conf.path) in absFilePath:
245+
index = absFilePath.index(conf.path)
246+
docRoot = absFilePath[:index]
247+
248+
if absFilePathWin:
249+
docRoot = "C:\\%s" % docRoot.replace("/", "\\")
250+
251+
break
249252

250253
if docRoot:
251-
logMsg = "retrieved the remote web server "
252-
logMsg += "document root: '%s'" % docRoot
253-
logger.info(logMsg)
254+
infoMsg = "retrieved the web server document root: '%s'" % docRoot
255+
logger.info(infoMsg)
254256
else:
255-
warnMsg = "unable to retrieve the remote web server "
256-
warnMsg += "document root"
257+
warnMsg = "unable to retrieve the web server document root"
257258
logger.warn(warnMsg)
258259

259-
return docRoot
260+
message = "please provide the web server document root "
261+
message += "[%s]: " % defaultDocRoot
262+
inputDocRoot = readInput(message, default=defaultDocRoot)
260263

264+
if inputDocRoot:
265+
docRoot = inputDocRoot
266+
else:
267+
docRoot = defaultDocRoot
261268

262-
def getDirectories():
263-
"""
264-
This method calls a function that returns the web application document
265-
root and injectable file absolute system path.
269+
return docRoot
266270

267-
@return: a set of paths (document root and absolute system path).
268-
@rtype: C{set}
269-
@todo: replace this function with a site crawling functionality.
270-
"""
271271

272+
def getDirs():
272273
directories = set()
273274

274-
kb.docRoot = getDocRoot()
275+
if kb.os == "Windows":
276+
defaultDir = "C:\\Inetput\\wwwroot\\test\\"
277+
else:
278+
defaultDir = "/var/www/test/"
279+
280+
if kb.absFilePaths:
281+
infoMsg = "retrieved web server full paths: "
282+
infoMsg += "'%s'" % ", ".join(path for path in kb.absFilePaths)
283+
logger.info(infoMsg)
275284

276-
if kb.docRoot:
277-
directories.add(kb.docRoot)
285+
for absFilePath in kb.absFilePaths:
286+
directories.add(os.path.dirname(absFilePath))
287+
else:
288+
warnMsg = "unable to retrieve any web server path"
289+
logger.warn(warnMsg)
278290

279-
pagePath = re.search("^/(.*)/", conf.path)
291+
message = "please provide any additional web server full path to try "
292+
message += "to upload the agent [%s]: " % defaultDir
293+
inputDirs = readInput(message, default=defaultDir)
280294

281-
if kb.docRoot and pagePath:
282-
pagePath = pagePath.groups()[0]
295+
if inputDirs:
296+
inputDirs = inputDirs.replace(", ", ",")
297+
inputDirs = inputDirs.split(",")
283298

284-
directories.add("%s/%s" % (kb.docRoot, pagePath))
299+
for inputDir in inputDirs:
300+
directories.add(inputDir)
301+
else:
302+
directories.add(defaultDir)
285303

286304
return directories
287305

288306

289307
def filePathToString(filePath):
290-
string = filePath.replace("/", "_").replace("\\", "_")
291-
string = string.replace(" ", "_").replace(":", "_")
308+
strRepl = filePath.replace("/", "_").replace("\\", "_")
309+
strRepl = strRepl.replace(" ", "_").replace(":", "_")
292310

293-
return string
311+
return strRepl
294312

295313

296314
def dataToStdout(data):
@@ -326,18 +344,18 @@ def dataToOutFile(data):
326344
return rFilePath
327345

328346

329-
def strToHex(string):
347+
def strToHex(inpStr):
330348
"""
331-
@param string: string to be converted into its hexadecimal value.
332-
@type string: C{str}
349+
@param inpStr: inpStr to be converted into its hexadecimal value.
350+
@type inpStr: C{str}
333351
334-
@return: the hexadecimal converted string.
352+
@return: the hexadecimal converted inpStr.
335353
@rtype: C{str}
336354
"""
337355

338356
hexStr = ""
339357

340-
for character in string:
358+
for character in inpStr:
341359
if character == "\n":
342360
character = " "
343361

@@ -457,17 +475,17 @@ def randomStr(length=5, lowercase=False):
457475
return rndStr
458476

459477

460-
def sanitizeStr(string):
478+
def sanitizeStr(inpStr):
461479
"""
462-
@param string: string to sanitize: cast to str datatype and replace
480+
@param inpStr: inpStr to sanitize: cast to str datatype and replace
463481
newlines with one space and strip carriage returns.
464-
@type string: C{str}
482+
@type inpStr: C{str}
465483
466-
@return: sanitized string
484+
@return: sanitized inpStr
467485
@rtype: C{str}
468486
"""
469487

470-
cleanString = str(string)
488+
cleanString = str(inpStr)
471489
cleanString = cleanString.replace("\n", " ").replace("\r", "")
472490

473491
return cleanString
@@ -483,8 +501,8 @@ def checkFile(filename):
483501
raise sqlmapFilePathException, "unable to read file '%s'" % filename
484502

485503

486-
def replaceNewlineTabs(string):
487-
replacedString = string.replace("\n", "__NEWLINE__").replace("\t", "__TAB__")
504+
def replaceNewlineTabs(inpStr):
505+
replacedString = inpStr.replace("\n", "__NEWLINE__").replace("\t", "__TAB__")
488506
replacedString = replacedString.replace(temp.delimiter, "__DEL__")
489507

490508
return replacedString

‎lib/core/convert.py‎

Lines changed: 2 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -23,13 +23,8 @@
2323
"""
2424

2525

26-
try:
27-
from hashlib import md5
28-
from hashlib import sha
29-
except ImportError, _:
30-
import md5
31-
import sha
32-
26+
import md5
27+
import sha
3328
import struct
3429
import urllib
3530

‎lib/core/exception.py‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,8 +24,6 @@
2424

2525

2626

27-
import sys
28-
2927
from lib.core.settings import PLATFORM
3028
from lib.core.settings import PYVERSION
3129
from lib.core.settings import VERSION

‎lib/core/option.py‎

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -31,8 +31,6 @@
3131
import os
3232
import re
3333
import socket
34-
import sys
35-
import time
3634
import urllib2
3735
import urlparse
3836

@@ -42,8 +40,6 @@
4240
from lib.core.common import parseTargetUrl
4341
from lib.core.common import paths
4442
from lib.core.common import randomRange
45-
from lib.core.common import randomStr
46-
from lib.core.common import readInput
4743
from lib.core.common import sanitizeStr
4844
from lib.core.data import conf
4945
from lib.core.data import kb
@@ -60,8 +56,10 @@
6056
from lib.core.settings import MSSQL_ALIASES
6157
from lib.core.settings import MYSQL_ALIASES
6258
from lib.core.settings import PLATFORM
59+
from lib.core.settings import SITE
6360
from lib.core.settings import SUPPORTED_DBMS
6461
from lib.core.settings import SUPPORTED_OS
62+
from lib.core.settings import VERSION_STRING
6563
from lib.core.update import update
6664
from lib.parse.configfile import configFileParser
6765
from lib.parse.queriesfile import queriesParser
@@ -600,9 +598,14 @@ def __defaultHTTPUserAgent():
600598
@rtype: C{str}
601599
"""
602600

601+
return "%s (%s)" % (VERSION_STRING, SITE)
602+
603+
# Firefox 3 running on Ubuntu 9.04 updated at April 2009
604+
#return "Mozilla/5.0 (X11; U; Linux i686; en-GB; rv:1.9.0.9) Gecko/2009042113 Ubuntu/9.04 (jaunty) Firefox/3.0.9"
605+
603606
# Internet Explorer 7.0 running on Windows 2003 Service Pack 2 english
604607
# updated at March 2009
605-
return "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.2; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; .NET CLR 3.0.04506.648; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)"
608+
#return "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.2; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; .NET CLR 3.0.04506.648; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)"
606609

607610

608611
def __setHTTPUserAgent():

0 commit comments

Comments
 (0)