Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 80bd146

Browse files
bdamelebdamele
committed
Added support for --dump with -C also on MSSQL
1 parent e5dc3f5 commit 80bd146

3 files changed

Lines changed: 45 additions & 30 deletions

File tree

‎plugins/dbms/mssqlserver.py‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -392,11 +392,6 @@ def getTables(self):
392392

393393
return kb.data.cachedTables
394394

395-
def dumpColumn(self):
396-
errMsg = "Table(s) dump by providing only -C is not "
397-
errMsg += "yet implemented for Microsoft SQL Server"
398-
raise sqlmapUnsupportedFeatureException, errMsg
399-
400395
def unionReadFile(self, rFile):
401396
errMsg = "Microsoft SQL Server does not support file reading "
402397
errMsg += "with UNION query SQL injection technique"

‎plugins/generic/enumeration.py‎

Lines changed: 41 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -960,15 +960,18 @@ def dumpColumn(self):
960960
errMsg = "invalid value"
961961
raise sqlmapNoneDataException, errMsg
962962

963-
if kb.dbms == "Microsoft SQL Server":
964-
plusOne = True
965-
else:
966-
plusOne = False
967-
968963
for column in colList:
969964
if kb.dbms == "Oracle":
970965
column = column.upper()
971966
conf.db = "USERS"
967+
elif kb.dbms == "Microsoft SQL Server":
968+
if not conf.db:
969+
if not len(kb.data.cachedDbs):
970+
enumDbs = self.getDbs()
971+
else:
972+
enumDbs = kb.data.cachedDbs
973+
974+
conf.db = ",".join(db for db in enumDbs)
972975

973976
foundCols[column] = {}
974977

@@ -1053,11 +1056,16 @@ def dumpColumn(self):
10531056

10541057
if kb.unionPosition:
10551058
query = rootQuery["inband"]["query2"]
1056-
if kb.dbms == "Oracle":
1057-
query += " WHERE %s" % colQuery
1058-
else:
1059+
1060+
if kb.dbms in ( "MySQL", "PostgreSQL" ):
10591061
query = query % db
10601062
query += " AND %s" % colQuery
1063+
elif kb.dbms == "Oracle":
1064+
query += " WHERE %s" % colQuery
1065+
elif kb.dbms == "Microsoft SQL Server":
1066+
query = query % (db, db, db, db, db)
1067+
query += " AND %s" % colQuery.replace("[DB]", db)
1068+
10611069
values = inject.getValue(query, blind=False)
10621070

10631071
if values:
@@ -1078,18 +1086,23 @@ def dumpColumn(self):
10781086
logger.info(infoMsg)
10791087

10801088
query = rootQuery["blind"]["count2"]
1081-
if kb.dbms == "Oracle":
1082-
query += " WHERE %s" % colQuery
1083-
else:
1089+
1090+
if kb.dbms in ( "MySQL", "PostgreSQL" ):
10841091
query = query % db
10851092
query += " AND %s" % colQuery
1093+
elif kb.dbms == "Oracle":
1094+
query += " WHERE %s" % colQuery
1095+
elif kb.dbms == "Microsoft SQL Server":
1096+
query = query % (db, db, db, db, db)
1097+
query += " AND %s" % colQuery.replace("[DB]", db)
1098+
10861099
count = inject.getValue(query, inband=False, expected="int", charsetType=2)
10871100

10881101
if not count.isdigit() or not len(count) or count == "0":
10891102
warnMsg = "no tables contain column"
10901103
if colConsider == "1":
10911104
warnMsg += "s like"
1092-
warnMsg += " '%s'" % column
1105+
warnMsg += " '%s' " % column
10931106
warnMsg += "in database '%s'" % db
10941107
logger.warn(warnMsg)
10951108

@@ -1099,12 +1112,20 @@ def dumpColumn(self):
10991112

11001113
for index in indexRange:
11011114
query = rootQuery["blind"]["query2"]
1102-
if kb.dbms == "Oracle":
1103-
query += " WHERE %s" % colQuery
1104-
else:
1115+
1116+
if kb.dbms in ( "MySQL", "PostgreSQL" ):
11051117
query = query % db
11061118
query += " AND %s" % colQuery
1107-
query = agent.limitQuery(index, query)
1119+
field = None
1120+
elif kb.dbms == "Oracle":
1121+
query += " WHERE %s" % colQuery
1122+
field = None
1123+
elif kb.dbms == "Microsoft SQL Server":
1124+
query = query % (db, db, db, db, db)
1125+
query += " AND %s" % colQuery.replace("[DB]", db)
1126+
field = colCond.replace("[DB]", db)
1127+
1128+
query = agent.limitQuery(index, query, field)
11081129
tbl = inject.getValue(query, inband=False)
11091130

11101131
if tbl not in dbs[db]:
@@ -1154,23 +1175,22 @@ def dumpColumn(self):
11541175
dumpFromDbs = []
11551176
message = "which database(s)?\n[a]ll (default)\n"
11561177

1157-
for db in dbs:
1158-
message += "[%s]\n" % db
1178+
for db, tblData in dbs.items():
1179+
if tblData:
1180+
message += "[%s]\n" % db
11591181

11601182
message += "[q]uit"
11611183
test = readInput(message, default="a")
11621184

11631185
if not test or test in ("a", "A"):
11641186
dumpFromDbs = dbs.keys()
1165-
11661187
elif test in ("q", "Q"):
11671188
return
1168-
11691189
else:
11701190
dumpFromDbs = test.replace(" ", "").split(",")
11711191

11721192
for db, tblData in dbs.items():
1173-
if db not in dumpFromDbs:
1193+
if db not in dumpFromDbs or not tblData:
11741194
continue
11751195

11761196
conf.db = db
@@ -1187,13 +1207,10 @@ def dumpColumn(self):
11871207

11881208
if not test or test in ("a", "A"):
11891209
dumpFromTbls = tblData
1190-
11911210
elif test in ("s", "S"):
11921211
continue
1193-
11941212
elif test in ("q", "Q"):
11951213
return
1196-
11971214
else:
11981215
dumpFromTbls = test.replace(" ", "").split(",")
11991216

‎xml/queries.xml‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -226,7 +226,10 @@
226226
<inband query="SELECT %s..syscolumns.name, TYPE_NAME(%s..syscolumns.xtype) FROM %s..syscolumns, %s..sysobjects WHERE %s..syscolumns.id=%s..sysobjects.id AND %s..sysobjects.name='%s'" condition="[DB]..syscolumns.name"/>
227227
<blind query="SELECT %s..syscolumns.name FROM %s..syscolumns, %s..sysobjects WHERE %s..syscolumns.id=%s..sysobjects.id AND %s..sysobjects.name='%s'" query2="SELECT TYPE_NAME(%s..syscolumns.xtype) FROM %s..syscolumns, %s..sysobjects WHERE %s..syscolumns.name='%s' AND %s..syscolumns.id=%s..sysobjects.id AND %s..sysobjects.name='%s'" count="SELECT LTRIM(STR(COUNT(name))) FROM %s..syscolumns WHERE id=(SELECT id FROM %s..sysobjects WHERE name='%s')" condition="[DB]..syscolumns.name"/>
228228
</columns>
229-
<dump_column/>
229+
<dump_column>
230+
<inband query="" query2="SELECT %s..sysobjects.name FROM %s..syscolumns, %s..sysobjects WHERE %s..syscolumns.id=%s..sysobjects.id" condition="[DB]..syscolumns.name"/>
231+
<blind query="" query2="SELECT %s..sysobjects.name FROM %s..syscolumns, %s..sysobjects WHERE %s..syscolumns.id=%s..sysobjects.id" count="" count2="SELECT COUNT(%s..sysobjects.name) FROM %s..syscolumns, %s..sysobjects WHERE %s..syscolumns.id=%s..sysobjects.id" condition="[DB]..syscolumns.name"/>
232+
</dump_column>
230233
<dump_table>
231234
<inband query="SELECT %s FROM %s..%s"/>
232235
<blind query="SELECT TOP 1 %s FROM %s..%s WHERE %s NOT IN (SELECT TOP %d %s FROM %s..%s)" count="SELECT LTRIM(STR(COUNT(*))) FROM %s..%s"/>

0 commit comments

Comments
 (0)