Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit aa0b97b

Browse files
stamparmstamparm
committed
Support for Informix --roles/--privileges (Issue #552)
1 parent df645d7 commit aa0b97b

5 files changed

Lines changed: 54 additions & 33 deletions

File tree

‎lib/core/dicts.py‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -159,6 +159,17 @@
159159
"B": "SUBSCRIBE",
160160
}
161161

162+
# Reference(s): https://www.ibm.com/support/knowledgecenter/SSGU8G_12.1.0/com.ibm.sqls.doc/ids_sqs_0147.htm
163+
# https://www.ibm.com/support/knowledgecenter/SSGU8G_11.70.0/com.ibm.sqlr.doc/ids_sqr_077.htm
164+
165+
INFORMIX_PRIVS = {
166+
"D": "DBA (all privileges)",
167+
"R": "RESOURCE (create UDRs, UDTs, permanent tables and indexes)",
168+
"C": "CONNECT (work with existing tables)",
169+
"G": "ROLE",
170+
"U": "DEFAULT (implicit connection)",
171+
}
172+
162173
DB2_PRIVS = {
163174
1: "CONTROLAUTH",
164175
2: "ALTERAUTH",

‎lib/core/settings.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@
1919
from lib.core.revision import getRevisionNumber
2020

2121
# sqlmap version (<major>.<minor>.<month>.<monthly commit>)
22-
VERSION = "1.0.9.32"
22+
VERSION = "1.0.9.33"
2323
REVISION = getRevisionNumber()
2424
TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
2525
TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}

‎plugins/generic/users.py‎

Lines changed: 33 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -27,10 +27,11 @@
2727
from lib.core.data import kb
2828
from lib.core.data import logger
2929
from lib.core.data import queries
30+
from lib.core.dicts import DB2_PRIVS
31+
from lib.core.dicts import FIREBIRD_PRIVS
32+
from lib.core.dicts import INFORMIX_PRIVS
3033
from lib.core.dicts import MYSQL_PRIVS
3134
from lib.core.dicts import PGSQL_PRIVS
32-
from lib.core.dicts import FIREBIRD_PRIVS
33-
from lib.core.dicts import DB2_PRIVS
3435
from lib.core.enums import CHARSET_TYPE
3536
from lib.core.enums import DBMS
3637
from lib.core.enums import EXPECTED
@@ -470,32 +471,35 @@ def getPrivileges(self, query2=False):
470471
if Backend.isDbms(DBMS.MYSQL) and kb.data.has_information_schema:
471472
user = "%%%s%%" % user
472473

473-
infoMsg = "fetching number of privileges "
474-
infoMsg += "for user '%s'" % outuser
475-
logger.info(infoMsg)
476-
477-
if Backend.isDbms(DBMS.MYSQL) and not kb.data.has_information_schema:
478-
query = rootQuery.blind.count2 % user
479-
elif Backend.isDbms(DBMS.MYSQL) and kb.data.has_information_schema:
480-
query = rootQuery.blind.count % (conditionChar, user)
481-
elif Backend.isDbms(DBMS.ORACLE) and query2:
482-
query = rootQuery.blind.count2 % user
474+
if Backend.isDbms(DBMS.INFORMIX):
475+
count = 1
483476
else:
484-
query = rootQuery.blind.count % user
477+
infoMsg = "fetching number of privileges "
478+
infoMsg += "for user '%s'" % outuser
479+
logger.info(infoMsg)
480+
481+
if Backend.isDbms(DBMS.MYSQL) and not kb.data.has_information_schema:
482+
query = rootQuery.blind.count2 % user
483+
elif Backend.isDbms(DBMS.MYSQL) and kb.data.has_information_schema:
484+
query = rootQuery.blind.count % (conditionChar, user)
485+
elif Backend.isDbms(DBMS.ORACLE) and query2:
486+
query = rootQuery.blind.count2 % user
487+
else:
488+
query = rootQuery.blind.count % user
485489

486-
count = inject.getValue(query, union=False, error=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS)
490+
count = inject.getValue(query, union=False, error=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS)
487491

488-
if not isNumPosStrValue(count):
489-
if not retrievedUsers and Backend.isDbms(DBMS.ORACLE) and not query2:
490-
infoMsg = "trying with table USER_SYS_PRIVS"
491-
logger.info(infoMsg)
492+
if not isNumPosStrValue(count):
493+
if not retrievedUsers and Backend.isDbms(DBMS.ORACLE) and not query2:
494+
infoMsg = "trying with table USER_SYS_PRIVS"
495+
logger.info(infoMsg)
492496

493-
return self.getPrivileges(query2=True)
497+
return self.getPrivileges(query2=True)
494498

495-
warnMsg = "unable to retrieve the number of "
496-
warnMsg += "privileges for user '%s'" % outuser
497-
logger.warn(warnMsg)
498-
continue
499+
warnMsg = "unable to retrieve the number of "
500+
warnMsg += "privileges for user '%s'" % outuser
501+
logger.warn(warnMsg)
502+
continue
499503

500504
infoMsg = "fetching privileges for user '%s'" % outuser
501505
logger.info(infoMsg)
@@ -514,6 +518,8 @@ def getPrivileges(self, query2=False):
514518
query = rootQuery.blind.query2 % (user, index)
515519
elif Backend.isDbms(DBMS.FIREBIRD):
516520
query = rootQuery.blind.query % (index, user)
521+
elif Backend.isDbms(DBMS.INFORMIX):
522+
query = rootQuery.blind.query % (user,)
517523
else:
518524
query = rootQuery.blind.query % (user, index)
519525

@@ -561,6 +567,10 @@ def getPrivileges(self, query2=False):
561567
elif Backend.isDbms(DBMS.FIREBIRD):
562568
privileges.add(FIREBIRD_PRIVS[privilege.strip()])
563569

570+
# In Informix we get one letter for the highest privilege
571+
elif Backend.isDbms(DBMS.INFORMIX):
572+
privileges.add(INFORMIX_PRIVS[privilege.strip()])
573+
564574
# In DB2 we get Y or G if the privilege is
565575
# True, N otherwise
566576
elif Backend.isDbms(DBMS.DB2):

‎txt/checksum.md5‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ e77cca1cb063016f71f6e6bdebf4ec73 lib/core/data.py
3232
1d042f0bc0557d3fd564ea5a46deb77e lib/core/datatype.py
3333
e4ca0fd47f20cf7ba6a5f5cbf980073c lib/core/decorators.py
3434
67f206cf2658145992cc1d7020138325 lib/core/defaults.py
35-
863095fcfb94799c4e5ba3d3d6f590d6 lib/core/dicts.py
35+
439cae0904cf3db20d1bc81d56980a21 lib/core/dicts.py
3636
1f98d3f57ce21d625fd67adb26cfd13c lib/core/dump.py
3737
1128705f593013359497b3959078b650 lib/core/enums.py
3838
e4aec2b11c1ad6039d0c3dbbfbc5eb1a lib/core/exception.py
@@ -45,7 +45,7 @@ e60456db5380840a586654344003d4e6 lib/core/readlineng.py
4545
5ef56abb8671c2ca6ceecb208258e360 lib/core/replication.py
4646
99a2b496b9d5b546b335653ca801153f lib/core/revision.py
4747
7c15dd2777af4dac2c89cab6df17462e lib/core/session.py
48-
5750f92c622c3c5468a1c263bde4b306 lib/core/settings.py
48+
55a79706107d51efb7ed0a771f80e58e lib/core/settings.py
4949
7af83e4f18cab6dff5e67840eb65be80 lib/core/shell.py
5050
23657cd7d924e3c6d225719865855827 lib/core/subprocessng.py
5151
0bc2fae1dec18cdd11954b22358293f2 lib/core/target.py
@@ -213,7 +213,7 @@ cc9c82cfffd8ee9b25ba3af6284f057e plugins/generic/__init__.py
213213
7b3e044a7fca497278d79883697089b7 plugins/generic/search.py
214214
73f8d047dbbcff307d62357836e382e6 plugins/generic/syntax.py
215215
da3ebc20998af02e3d952d0417a67792 plugins/generic/takeover.py
216-
4b5a6e2aec8e240fc43916d9dde27b14 plugins/generic/users.py
216+
078434ac78aaa539526031ebdd5556f2 plugins/generic/users.py
217217
cc9c82cfffd8ee9b25ba3af6284f057e plugins/__init__.py
218218
b04db3e861edde1f9dd0a3850d5b96c8 shell/backdoor.asp_
219219
158bfa168128393dde8d6ed11fe9a1b8 shell/backdoor.aspx_
@@ -455,4 +455,4 @@ a279656ea3fcb85c727249b02f828383 xml/livetests.xml
455455
96adb9bfbab867d221974d3ddb303cb6 xml/payloads/stacked_queries.xml
456456
c8b152ecebf04ec997e52c6c78cbd488 xml/payloads/time_blind.xml
457457
033b39025e8ee0f302935f6db3a39e77 xml/payloads/union_query.xml
458-
b788ef9f0198fa0bbb56644c206b688e xml/queries.xml
458+
3365321fc0217e148c2fa8a217cbfc5e xml/queries.xml

‎xml/queries.xml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -752,11 +752,11 @@
752752
<inband query="SELECT USERNAME,HASHED_PASSWORD,SALT FROM SYSUSER:SYSINTAUTHUSERS" condition="USERNAME"/>
753753
<blind query="SELECT HASHED_PASSWORD FROM SYSUSER:SYSINTAUTHUSERS WHERE USERNAME='%s'" query2="SELECT SALT FROM SYSUSER:SYSINTAUTHUSERS WHERE USERNAME='%s'"/>
754754
</passwords>
755-
<privileges/>
756-
<roles>
757-
<inband query="SELECT USERNAME,USERTYPE FROM SYSUSERS" condition="name"/>
758-
<blind query="SELECT GRANTED_ROLE FROM SYSUSERS WHERE USERNAME='s'"/>
759-
</roles>
755+
<privileges>
756+
<inband query="SELECT USERNAME,USERTYPE FROM SYSUSERS" condition="USERNAME"/>
757+
<blind query="SELECT USERTYPE FROM SYSUSERS WHERE USERNAME='%s'"/>
758+
</privileges>
759+
<roles/>
760760
<dbs>
761761
<inband query="SELECT NAME FROM SYSMASTER:SYSDATABASES"/>
762762
<blind query="SELECT SKIP %d LIMIT 1 NAME FROM SYSMASTER:SYSDATABASES ORDER BY NAME" count="SELECT COUNT(NAME) FROM SYSMASTER:SYSDATABASES"/>

0 commit comments

Comments
 (0)