Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 6fa2fd1

Browse files
stamparmstamparm
committed
implemented support for __pivotDumpTable on MSSQL as normal tables tend to not play well with normal TOP 1 ..NOT IN..ORDER BY mechanism if the argument for ORDER BY is not the unique one (returns only number of rows equal to the number of distinct values for that field)
1 parent beb9814 commit 6fa2fd1

4 files changed

Lines changed: 17 additions & 19 deletions

File tree

‎lib/techniques/error/use.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -195,7 +195,7 @@ def errorUse(expression, expected=None, resumeValue=True, dump=False):
195195
or (Backend.getIdentifiedDbms() in FROM_TABLE and not \
196196
expression.upper().endswith(FROM_TABLE[Backend.getIdentifiedDbms()]))) \
197197
and ("(CASE" not in expression.upper() or ("(CASE" in expression.upper() and "WHEN use" in expression))) \
198-
and not any(map(lambda x: x in expression.upper(), ["COUNT(*)", "EXISTS(", "MAX(", "MIN("])):
198+
and not any(map(lambda x: x in expression.upper(), ["COUNT(*)", "EXISTS(", "MAX(", "MIN(", "COUNT(DISTINCT"])):
199199

200200
limitRegExp = re.search(queries[Backend.getIdentifiedDbms()].limitregexp.query, expression, re.I)
201201
topLimit = re.search("TOP\s+([\d]+)\s+", expression, re.I)

‎lib/techniques/inband/union/use.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -137,7 +137,7 @@ def unionUse(expression, unpack=True, dump=False):
137137
" FROM " in expression.upper() and ((Backend.getIdentifiedDbms() \
138138
not in FROM_TABLE) or (Backend.getIdentifiedDbms() in FROM_TABLE \
139139
and not expression.upper().endswith(FROM_TABLE[Backend.getIdentifiedDbms()]))) \
140-
and not any(map(lambda x: x in expression.upper(), ["(CASE", "COUNT(*)", "EXISTS(", "MAX(", "MIN("])):
140+
and not any(map(lambda x: x in expression.upper(), ["(CASE", "COUNT(*)", "EXISTS(", "MAX(", "MIN(", "COUNT(DISTINCT"])):
141141

142142
limitRegExp = re.search(queries[Backend.getIdentifiedDbms()].limitregexp.query, expression, re.I)
143143
topLimit = re.search("TOP\s+([\d]+)\s+", expression, re.I)

‎plugins/generic/enumeration.py‎

Lines changed: 14 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1304,10 +1304,14 @@ def dumpTable(self):
13041304
query = rootQuery.inband.query % (colString, conf.tbl.upper() if not conf.db else ("%s.%s" % (conf.db.upper(), conf.tbl.upper())))
13051305
elif Backend.getIdentifiedDbms() == DBMS.SQLITE:
13061306
query = rootQuery.inband.query % (colString, conf.tbl)
1307-
elif Backend.getIdentifiedDbms() == DBMS.SYBASE:
1308-
table = "%s..%s" % (conf.db, conf.tbl)
1309-
entries, _ = self.__pivotDumpTable(table, colList, blind=False)
1310-
entries = zip(*[entries[colName] for colName in colList])
1307+
elif Backend.getIdentifiedDbms() in (DBMS.SYBASE, DBMS.MSSQL):
1308+
# Partial inband and error
1309+
if not (isTechniqueAvailable(PAYLOAD.TECHNIQUE.UNION) and kb.injection.data[PAYLOAD.TECHNIQUE.UNION].where == PAYLOAD.WHERE.ORIGINAL):
1310+
table = "%s.%s" % (conf.db, conf.tbl)
1311+
entries, _ = self.__pivotDumpTable(table, colList, blind=False)
1312+
entries = zip(*[entries[colName] for colName in colList])
1313+
else:
1314+
query = rootQuery.inband.query % (colString, conf.db, conf.tbl)
13111315
else:
13121316
query = rootQuery.inband.query % (colString, conf.db, conf.tbl)
13131317

@@ -1358,8 +1362,8 @@ def dumpTable(self):
13581362
query = rootQuery.blind.count % (conf.tbl.upper() if not conf.db else ("%s.%s" % (conf.db.upper(), conf.tbl.upper())))
13591363
elif Backend.getIdentifiedDbms() in (DBMS.SQLITE, DBMS.ACCESS, DBMS.FIREBIRD):
13601364
query = rootQuery.blind.count % conf.tbl
1361-
elif Backend.getIdentifiedDbms() == DBMS.SYBASE:
1362-
query = rootQuery.blind.count % ("%s..%s" % (conf.db, conf.tbl))
1365+
elif Backend.getIdentifiedDbms() in (DBMS.SYBASE, DBMS.MSSQL):
1366+
query = rootQuery.blind.count % ("%s.%s" % (conf.db, conf.tbl))
13631367
elif Backend.getIdentifiedDbms() == DBMS.MAXDB:
13641368
query = rootQuery.blind.count % ("%s" % conf.tbl)
13651369
else:
@@ -1381,17 +1385,17 @@ def dumpTable(self):
13811385
entries = {}
13821386

13831387
try:
1384-
if Backend.getIdentifiedDbms() in (DBMS.ACCESS, DBMS.SYBASE, DBMS.MAXDB):
1388+
if Backend.getIdentifiedDbms() in (DBMS.ACCESS, DBMS.SYBASE, DBMS.MAXDB, DBMS.MSSQL):
13851389
if Backend.getIdentifiedDbms() == DBMS.ACCESS:
13861390
table = conf.tbl
1387-
elif Backend.getIdentifiedDbms() == DBMS.SYBASE:
1388-
table = "%s..%s" % (conf.db, conf.tbl)
1391+
elif Backend.getIdentifiedDbms() in (DBMS.SYBASE, DBMS.MSSQL):
1392+
table = "%s.%s" % (conf.db, conf.tbl)
13891393
elif Backend.getIdentifiedDbms() == DBMS.MAXDB:
13901394
table = "%s.%s" % (conf.db, conf.tbl)
13911395
entries, lengths = self.__pivotDumpTable(table, colList, count, blind=True)
13921396

13931397
else:
1394-
if Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.MSSQL, DBMS.SYBASE):
1398+
if Backend.getIdentifiedDbms() == DBMS.ORACLE:
13951399
plusOne = True
13961400
else:
13971401
plusOne = False
@@ -1412,11 +1416,6 @@ def dumpTable(self):
14121416
query = rootQuery.blind.query % (column, column,
14131417
conf.tbl.upper() if not conf.db else ("%s.%s" % (conf.db.upper(), conf.tbl.upper())),
14141418
index)
1415-
elif Backend.getIdentifiedDbms() in (DBMS.MSSQL, DBMS.SYBASE):
1416-
query = rootQuery.blind.query % (column, index, conf.db,
1417-
conf.tbl, colList[0],
1418-
colList[0], colList[0])
1419-
14201419
elif Backend.getIdentifiedDbms() == DBMS.SQLITE:
14211420
query = rootQuery.blind.query % (column, conf.tbl, index)
14221421

‎xml/queries.xml‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -193,8 +193,7 @@
193193
</columns>
194194
<dump_table>
195195
<inband query="SELECT %s FROM %s.%s"/>
196-
<!--<blind query="SELECT TOP 1 %s FROM %s..%s WHERE %s NOT IN (SELECT TOP %d %s FROM %s..%s)" count="SELECT LTRIM(STR(COUNT(*))) FROM %s..%s"/>-->
197-
<blind query="SELECT TOP 1 %s FROM (SELECT TOP 1 * FROM ( SELECT TOP %d * FROM %s.%s ORDER BY %s ASC ) AS t1 ORDER BY %s DESC) AS t2 ORDER BY %s ASC" count="SELECT LTRIM(STR(COUNT(*))) FROM %s.%s"/>
196+
<blind query="SELECT MIN(%s) FROM %s WHERE CONVERT(NVARCHAR(4000),%s)>'%s'" query2="SELECT MAX(%s) FROM %s WHERE CONVERT(NVARCHAR(4000),%s) LIKE '%s'" count="SELECT LTRIM(STR(COUNT(*))) FROM %s" count2="SELECT LTRIM(STR(COUNT(DISTINCT(%s)))) FROM %s"/>
198197
</dump_table>
199198
<search_db>
200199
<inband query="SELECT name FROM master..sysdatabases WHERE " condition="name"/>

0 commit comments

Comments
 (0)