Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 8220b62

Browse files
stamparmstamparm
committed
Fixes #3759 
1 parent 3b3f492 commit 8220b62

3 files changed

Lines changed: 20 additions & 7 deletions

File tree

‎data/xml/queries.xml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -32,9 +32,11 @@
3232
<inband query="SELECT grantee FROM INFORMATION_SCHEMA.USER_PRIVILEGES" query2="SELECT user FROM mysql.user"/>
3333
<blind query="SELECT DISTINCT(grantee) FROM INFORMATION_SCHEMA.USER_PRIVILEGES LIMIT %d,1" query2="SELECT DISTINCT(user) FROM mysql.user LIMIT %d,1" count="SELECT COUNT(DISTINCT(grantee)) FROM INFORMATION_SCHEMA.USER_PRIVILEGES" count2="SELECT COUNT(DISTINCT(user)) FROM mysql.user"/>
3434
</users>
35+
<!-- https://github.com/dev-sec/mysql-baseline/issues/35 -->
36+
<!-- https://stackoverflow.com/a/31122246 -->
3537
<passwords>
36-
<inband query="SELECT user,password FROM mysql.user" condition="user"/>
37-
<blind query="SELECT DISTINCT(password) FROM mysql.user WHERE user='%s' LIMIT %d,1" count="SELECT COUNT(DISTINCT(password)) FROM mysql.user WHERE user='%s'"/>
38+
<inband query="SELECT user,authentication_string FROM mysql.user" condition="user"/>
39+
<blind query="SELECT DISTINCT(authentication_string) FROM mysql.user WHERE user='%s' LIMIT %d,1" count="SELECT COUNT(DISTINCT(authentication_string)) FROM mysql.user WHERE user='%s'"/>
3840
</passwords>
3941
<privileges>
4042
<inband query="SELECT grantee,privilege_type FROM INFORMATION_SCHEMA.USER_PRIVILEGES" condition="grantee" query2="SELECT user,select_priv,insert_priv,update_priv,delete_priv,create_priv,drop_priv,reload_priv,shutdown_priv,process_priv,file_priv,grant_priv,references_priv,index_priv,alter_priv,show_db_priv,super_priv,create_tmp_table_priv,lock_tables_priv,execute_priv,repl_slave_priv,repl_client_priv,create_view_priv,show_view_priv,create_routine_priv,alter_routine_priv,create_user_priv FROM mysql.user" condition2="user"/>

‎lib/core/settings.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@
1818
from thirdparty.six import unichr as _unichr
1919

2020
# sqlmap version (<major>.<minor>.<month>.<monthly commit>)
21-
VERSION = "1.3.6.43"
21+
VERSION = "1.3.6.44"
2222
TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
2323
TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}
2424
VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)

‎plugins/generic/users.py‎

Lines changed: 15 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@
1515
from lib.core.common import isAdminFromPrivileges
1616
from lib.core.common import isInferenceAvailable
1717
from lib.core.common import isNoneValue
18+
from lib.core.common import isNullValue
1819
from lib.core.common import isNumPosStrValue
1920
from lib.core.common import isTechniqueAvailable
2021
from lib.core.common import parsePasswordHash
@@ -203,8 +204,10 @@ def getPasswordHashes(self):
203204
else:
204205
values = inject.getValue(query, blind=False, time=False)
205206

206-
if isNoneValue(values) and Backend.isDbms(DBMS.MSSQL):
207+
if Backend.isDbms(DBMS.MSSQL) and isNoneValue(values):
207208
values = inject.getValue(query.replace("master.dbo.fn_varbintohexstr", "sys.fn_sqlvarbasetostr"), blind=False, time=False)
209+
elif Backend.isDbms(DBMS.MYSQL) and (isNoneValue(values) or all(len(value) == 2 and (isNullValue(value[1]) or isNoneValue(value[1])) for value in values)):
210+
values = inject.getValue(query.replace("authentication_string", "password"), blind=False, time=False)
208211

209212
for user, password in filterPairValues(values):
210213
if not user or user == " ":
@@ -270,9 +273,13 @@ def getPasswordHashes(self):
270273

271274
count = inject.getValue(query, union=False, error=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS)
272275

273-
if not isNumPosStrValue(count) and Backend.isDbms(DBMS.MSSQL):
274-
fallback = True
275-
count = inject.getValue(query.replace("master.dbo.fn_varbintohexstr", "sys.fn_sqlvarbasetostr"), union=False, error=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS)
276+
if not isNumPosStrValue(count):
277+
if Backend.isDbms(DBMS.MSSQL):
278+
fallback = True
279+
count = inject.getValue(query.replace("master.dbo.fn_varbintohexstr", "sys.fn_sqlvarbasetostr"), union=False, error=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS)
280+
elif Backend.isDbms(DBMS.MYSQL):
281+
fallback = True
282+
count = inject.getValue(query.replace("authentication_string", "password"), union=False, error=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS)
276283

277284
if not isNumPosStrValue(count):
278285
warnMsg = "unable to retrieve the number of password "
@@ -307,6 +314,10 @@ def getPasswordHashes(self):
307314
else:
308315
query = rootQuery.blind.query % (user, index)
309316

317+
if Backend.isDbms(DBMS.MYSQL):
318+
if fallback:
319+
query = query.replace("authentication_string", "password")
320+
310321
password = unArrayizeValue(inject.getValue(query, union=False, error=False))
311322
password = parsePasswordHash(password)
312323

0 commit comments

Comments
 (0)