Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit aa5d038

Browse files
stamparmstamparm
committed
more code refactoring
1 parent 3cae766 commit aa5d038

4 files changed

Lines changed: 532 additions & 13 deletions

File tree

‎lib/core/common.py‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -663,7 +663,8 @@ def setPaths():
663663
paths.COMMON_TABLES = os.path.join(paths.SQLMAP_TXT_PATH, "common-tables.txt")
664664
paths.COMMON_OUTPUTS = os.path.join(paths.SQLMAP_TXT_PATH, 'common-outputs.txt')
665665
paths.SQL_KEYWORDS = os.path.join(paths.SQLMAP_TXT_PATH, "keywords.txt")
666-
paths.WORDLIST_TXT = os.path.join(paths.SQLMAP_TXT_PATH, "wordlist.txt")
666+
paths.ORACLE_DEFAULT_PASSWD = os.path.join(paths.SQLMAP_TXT_PATH, "oracle-default-passwords.txt")
667+
paths.WORDLIST = os.path.join(paths.SQLMAP_TXT_PATH, "wordlist.txt")
667668
paths.PHPIDS_RULES_XML = os.path.join(paths.SQLMAP_XML_PATH, "phpids_rules.xml")
668669
paths.ERRORS_XML = os.path.join(paths.SQLMAP_XML_PATH, "errors.xml")
669670
paths.INJECTIONS_XML = os.path.join(paths.SQLMAP_XML_PATH, "injections.xml")
@@ -1607,10 +1608,13 @@ def logHTTPTraffic(requestLogMsg, responseLogMsg):
16071608
kb.locks.reqLock.release()
16081609

16091610
def getPublicTypeMembers(type_):
1611+
"""
1612+
Useful for getting members from types (e.g. in enums)
1613+
"""
16101614
retVal = []
16111615

16121616
for name, value in getmembers(type_):
16131617
if not name.startswith('__'):
16141618
retVal.append((name, value))
16151619

1616-
return retVal
1620+
return retVal

‎lib/core/enums.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,6 @@ class HASH:
5050
MSSQL = r'(?i)\A0x0100[0-9a-f]{8}[0-9a-f]{40}\Z'
5151
MSSQL_OLD = r'(?i)\A0x0100[0-9a-f]{8}[0-9a-f]{80}\Z'
5252
ORACLE = r'(?i)\As:[0-9a-f]{60}\Z'
53-
ORACLE_OLD = r'(?i)\A[0-9a-f]{16}\Z'
53+
ORACLE_OLD = r'(?i)\A[01-9a-f]{16}\Z'
5454
MD5_GENERIC = r'(?i)\A[0-9a-f]{32}\Z'
5555
SHA1_GENERIC = r'(?i)\A[0-9a-f]{40}\Z'

‎lib/utils/hash.py‎

Lines changed: 38 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@
1616

1717
from extra.pydes.pyDes import des
1818
from extra.pydes.pyDes import CBC
19+
from lib.core.common import checkFile
1920
from lib.core.common import conf
2021
from lib.core.common import dataToStdout
2122
from lib.core.common import getFileItems
@@ -191,11 +192,23 @@ def dictionaryAttack():
191192

192193
hash_ = hash_.split()[0]
193194

194-
for _, regex in getPublicTypeMembers(HASH):
195-
if re.match(regex, hash_):
195+
for name, regex in getPublicTypeMembers(HASH):
196+
if kb.dbms == DBMS.ORACLE and regex == HASH.MYSQL_OLD:
197+
continue
198+
elif kb.dbms == DBMS.MYSQL and regex == HASH.ORACLE_OLD:
199+
continue
200+
elif re.match(regex, hash_):
196201
rehash = regex
202+
infoMsg = "using hash method: '%s'" % name
203+
logger.info(infoMsg)
197204
break
198205

206+
if rehash:
207+
break
208+
209+
if rehash:
210+
break
211+
199212
if rehash:
200213
for (user, hashes) in kb.data.cachedUsersPasswords.items():
201214
for hash_ in hashes:
@@ -207,7 +220,7 @@ def dictionaryAttack():
207220
if re.match(rehash, hash_):
208221
hash_ = hash_.lower()
209222

210-
if rehash in (HASH.MYSQL, HASH.MYSQL_OLD, HASH.MD5_GENERIC, HASH.SHA1_GENERIC) and kb.dbms != DBMS.ORACLE:
223+
if rehash in (HASH.MYSQL, HASH.MYSQL_OLD, HASH.MD5_GENERIC, HASH.SHA1_GENERIC):
211224
attack_info.append([(user, hash_), {}])
212225
elif rehash in (HASH.ORACLE_OLD, HASH.POSTGRES):
213226
attack_info.append([(user, hash_), {'username': user}])
@@ -216,24 +229,34 @@ def dictionaryAttack():
216229
elif rehash in (HASH.MSSQL, HASH.MSSQL_OLD):
217230
attack_info.append([(user, hash_), {'salt': hash_[6:14]}])
218231

219-
infoMsg = "loading dictionary from: '%s'" % paths.WORDLIST_TXT
232+
if rehash == HASH.ORACLE_OLD: #it's the slowest of all methods hence smaller default dict
233+
message = "what's the dictionary's location? [%s]" % paths.ORACLE_DEFAULT_PASSWD
234+
dictpath = readInput(message, default=paths.ORACLE_DEFAULT_PASSWD)
235+
236+
else:
237+
message = "what's the dictionary's location? [%s]" % paths.WORDLIST
238+
dictpath = readInput(message, default=paths.WORDLIST)
239+
240+
checkFile(dictpath)
241+
242+
infoMsg = "loading dictionary from: '%s'" % dictpath
220243
logger.info(infoMsg)
221-
wordlist = getFileItems(paths.WORDLIST_TXT, None, False)
244+
wordlist = getFileItems(dictpath, None, False)
222245

223246
infoMsg = "running dictionary attack"
224247
logger.info(infoMsg)
225248

226249
length = len(wordlist)
227250

228-
if rehash in (HASH.MYSQL, HASH.MYSQL_OLD, HASH.MD5_GENERIC, HASH.SHA1_GENERIC) and kb.dbms != DBMS.ORACLE:
251+
if rehash in (HASH.MYSQL, HASH.MYSQL_OLD, HASH.MD5_GENERIC, HASH.SHA1_GENERIC):
229252
count = 0
230253
for word in wordlist:
231254
count += 1
232255
current = __functions__[rehash](password = word, uppercase = False)
233256
for item in attack_info:
234257
((user, hash_), _) = item
235258

236-
if count % 1117 == 0 or count == length:
259+
if count % 1117 == 0 or count == length or rehash in (HASH.ORACLE_OLD):
237260
status = '%d/%d words (%d%s)' % (count, length, round(100.0*count/length), '%')
238261
dataToStdout("\r[%s] [INFO] %s" % (time.strftime("%X"), status), True)
239262

@@ -242,25 +265,30 @@ def dictionaryAttack():
242265
#dataToStdout("\r[%s] [INFO] found: %s:%s\n" % (time.strftime("%X"), user, word), True)
243266
attack_info.remove(item)
244267

268+
dataToStdout("\n", True)
245269
else:
246270
for ((user, hash_), kwargs) in attack_info:
247271
count = 0
248272
for word in wordlist:
249273
current = __functions__[rehash](password = word, uppercase = False, **kwargs)
250274

251275
count += 1
252-
if count % 1117 == 0 or count == length:
253-
status = '%d/%d words (%d%s)' % (count, length, round(100.0*count/length), '%')
276+
if count % 1117 == 0 or count == length or rehash in (HASH.ORACLE_OLD):
277+
status = '%d/%d words (%d%s) (user: %s)' % (count, length, round(100.0*count/length), '%', user)
254278
dataToStdout("\r[%s] [INFO] %s" % (time.strftime("%X"), status), True)
255279

256280
if hash_ == current:
257281
results.append((user, hash_, word))
258282
#dataToStdout("\r[%s] [INFO] found: %s:%s\n" % (time.strftime("%X"), user, word), True)
259283
break
260284

261-
dataToStdout("\n", True)
285+
dataToStdout("\n", True)
286+
262287
blank = " "
263288
for (user, hash_, password) in results:
264289
for i in xrange(len(kb.data.cachedUsersPasswords[user])):
265290
if kb.data.cachedUsersPasswords[user][i] and hash_.lower() in kb.data.cachedUsersPasswords[user][i].lower():
266291
kb.data.cachedUsersPasswords[user][i] += "%s%spassword: %s" % ('\n' if kb.data.cachedUsersPasswords[user][i][-1] != '\n' else '', blank, password)
292+
else:
293+
errMsg = "hash format unrecognized"
294+
logger.error(errMsg)

0 commit comments

Comments
 (0)