Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit e697354

Browse files
stamparmstamparm
committed
Fixing non-resumal of MsSQL/Sybase/MaxDB enumeration queries
1 parent 7210468 commit e697354

8 files changed

Lines changed: 33 additions & 33 deletions

File tree

‎lib/core/option.py‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1713,6 +1713,7 @@ def _setKnowledgeBaseAttributes(flushAll=True):
17131713
kb.absFilePaths = set()
17141714
kb.adjustTimeDelay = None
17151715
kb.alerted = False
1716+
kb.aliasName = randomStr()
17161717
kb.alwaysRefresh = None
17171718
kb.arch = None
17181719
kb.authHeader = None

‎lib/core/settings.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@
1919
from lib.core.enums import OS
2020

2121
# sqlmap version (<major>.<minor>.<month>.<monthly commit>)
22-
VERSION = "1.2.9.34"
22+
VERSION = "1.2.9.35"
2323
TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
2424
TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}
2525
VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)

‎lib/core/target.py‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -692,6 +692,13 @@ def _createTargetDirs():
692692
_createFilesDir()
693693
_configureDumper()
694694

695+
def _setAuxOptions():
696+
"""
697+
Setup auxiliary (host-dependent) options
698+
"""
699+
700+
kb.aliasName = randomStr(seed=hash(conf.hostname or ""))
701+
695702
def _restoreMergedOptions():
696703
"""
697704
Restore merged options (command line, configuration file and default values)
@@ -745,3 +752,4 @@ def setupTargetEnv():
745752
_resumeHashDBValues()
746753
_setResultsFile()
747754
_setAuthCred()
755+
_setAuxOptions()

‎lib/utils/pivotdumptable.py‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@
3232
from lib.core.unescaper import unescaper
3333
from lib.request import inject
3434

35-
def pivotDumpTable(table, colList, count=None, blind=True):
35+
def pivotDumpTable(table, colList, count=None, blind=True, alias=None):
3636
lengths = {}
3737
entries = {}
3838

@@ -89,7 +89,7 @@ def pivotDumpTable(table, colList, count=None, blind=True):
8989
if not validPivotValue:
9090
for column in colList:
9191
infoMsg = "fetching number of distinct "
92-
infoMsg += "values for column '%s'" % column
92+
infoMsg += "values for column '%s'" % column.replace(("%s." % alias) if alias else "", "")
9393
logger.info(infoMsg)
9494

9595
query = dumpNode.count2 % (column, table)
@@ -100,7 +100,7 @@ def pivotDumpTable(table, colList, count=None, blind=True):
100100
validColumnList = True
101101

102102
if value == count:
103-
infoMsg = "using column '%s' as a pivot " % column
103+
infoMsg = "using column '%s' as a pivot " % column.replace(("%s." % alias) if alias else "", "")
104104
infoMsg += "for retrieving row data"
105105
logger.info(infoMsg)
106106

‎plugins/dbms/maxdb/enumeration.py‎

Lines changed: 4 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -43,9 +43,8 @@ def getDbs(self):
4343
logger.info(infoMsg)
4444

4545
rootQuery = queries[DBMS.MAXDB].dbs
46-
randStr = randomStr()
4746
query = rootQuery.inband.query
48-
retVal = pivotDumpTable("(%s) AS %s" % (query, randStr), ['%s.schemaname' % randStr], blind=True)
47+
retVal = pivotDumpTable("(%s) AS %s" % (query, kb.aliasName), ['%s.schemaname' % kb.aliasName], blind=True)
4948

5049
if retVal:
5150
kb.data.cachedDbs = retVal[0].values()[0]
@@ -79,9 +78,8 @@ def getTables(self, bruteForce=None):
7978
rootQuery = queries[DBMS.MAXDB].tables
8079

8180
for db in dbs:
82-
randStr = randomStr()
8381
query = rootQuery.inband.query % (("'%s'" % db) if db != "USER" else 'USER')
84-
retVal = pivotDumpTable("(%s) AS %s" % (query, randStr), ['%s.tablename' % randStr], blind=True)
82+
retVal = pivotDumpTable("(%s) AS %s" % (query, kb.aliasName), ['%s.tablename' % kb.aliasName], blind=True)
8583

8684
if retVal:
8785
for table in retVal[0].values()[0]:
@@ -202,15 +200,14 @@ def getColumns(self, onlyColNames=False, colTuple=None, bruteForce=None, dumpMod
202200
infoMsg += "on database '%s'" % unsafeSQLIdentificatorNaming(conf.db)
203201
logger.info(infoMsg)
204202

205-
randStr = randomStr()
206203
query = rootQuery.inband.query % (unsafeSQLIdentificatorNaming(tbl), ("'%s'" % unsafeSQLIdentificatorNaming(conf.db)) if unsafeSQLIdentificatorNaming(conf.db) != "USER" else 'USER')
207-
retVal = pivotDumpTable("(%s) AS %s" % (query, randStr), ['%s.columnname' % randStr, '%s.datatype' % randStr, '%s.len' % randStr], blind=True)
204+
retVal = pivotDumpTable("(%s) AS %s" % (query, kb.aliasName), ['%s.columnname' % kb.aliasName, '%s.datatype' % kb.aliasName, '%s.len' % kb.aliasName], blind=True)
208205

209206
if retVal:
210207
table = {}
211208
columns = {}
212209

213-
for columnname, datatype, length in zip(retVal[0]["%s.columnname" % randStr], retVal[0]["%s.datatype" % randStr], retVal[0]["%s.len" % randStr]):
210+
for columnname, datatype, length in zip(retVal[0]["%s.columnname" % kb.aliasName], retVal[0]["%s.datatype" % kb.aliasName], retVal[0]["%s.len" % kb.aliasName]):
214211
columns[safeSQLIdentificatorNaming(columnname)] = "%s(%s)" % (datatype, length)
215212

216213
table[tbl] = columns

‎plugins/dbms/sybase/enumeration.py‎

Lines changed: 5 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,6 @@ def getUsers(self):
3838

3939
rootQuery = queries[DBMS.SYBASE].users
4040

41-
randStr = randomStr()
4241
query = rootQuery.inband.query
4342

4443
if any(isTechniqueAvailable(_) for _ in (PAYLOAD.TECHNIQUE.UNION, PAYLOAD.TECHNIQUE.ERROR, PAYLOAD.TECHNIQUE.QUERY)) or conf.direct:
@@ -47,7 +46,7 @@ def getUsers(self):
4746
blinds = (True,)
4847

4948
for blind in blinds:
50-
retVal = pivotDumpTable("(%s) AS %s" % (query, randStr), ['%s.name' % randStr], blind=blind)
49+
retVal = pivotDumpTable("(%s) AS %s" % (query, kb.aliasName), ['%s.name' % kb.aliasName], blind=blind, alias=kb.aliasName)
5150

5251
if retVal:
5352
kb.data.cachedUsers = retVal[0].values()[0]
@@ -94,7 +93,6 @@ def getDbs(self):
9493
logger.info(infoMsg)
9594

9695
rootQuery = queries[DBMS.SYBASE].dbs
97-
randStr = randomStr()
9896
query = rootQuery.inband.query
9997

10098
if any(isTechniqueAvailable(_) for _ in (PAYLOAD.TECHNIQUE.UNION, PAYLOAD.TECHNIQUE.ERROR, PAYLOAD.TECHNIQUE.QUERY)) or conf.direct:
@@ -103,7 +101,7 @@ def getDbs(self):
103101
blinds = [True]
104102

105103
for blind in blinds:
106-
retVal = pivotDumpTable("(%s) AS %s" % (query, randStr), ['%s.name' % randStr], blind=blind)
104+
retVal = pivotDumpTable("(%s) AS %s" % (query, kb.aliasName), ['%s.name' % kb.aliasName], blind=blind, alias=kb.aliasName)
107105

108106
if retVal:
109107
kb.data.cachedDbs = retVal[0].values()[0]
@@ -146,9 +144,8 @@ def getTables(self, bruteForce=None):
146144

147145
for db in dbs:
148146
for blind in blinds:
149-
randStr = randomStr()
150147
query = rootQuery.inband.query % db
151-
retVal = pivotDumpTable("(%s) AS %s" % (query, randStr), ['%s.name' % randStr], blind=blind)
148+
retVal = pivotDumpTable("(%s) AS %s" % (query, kb.aliasName), ['%s.name' % kb.aliasName], blind=blind, alias=kb.aliasName)
152149

153150
if retVal:
154151
for table in retVal[0].values()[0]:
@@ -278,15 +275,14 @@ def getColumns(self, onlyColNames=False, colTuple=None, bruteForce=None, dumpMod
278275
logger.info(infoMsg)
279276

280277
for blind in blinds:
281-
randStr = randomStr()
282278
query = rootQuery.inband.query % (conf.db, conf.db, conf.db, conf.db, conf.db, conf.db, conf.db, unsafeSQLIdentificatorNaming(tbl))
283-
retVal = pivotDumpTable("(%s) AS %s" % (query, randStr), ['%s.name' % randStr, '%s.usertype' % randStr], blind=blind)
279+
retVal = pivotDumpTable("(%s) AS %s" % (query, kb.aliasName), ['%s.name' % kb.aliasName, '%s.usertype' % kb.aliasName], blind=blind, alias=kb.aliasName)
284280

285281
if retVal:
286282
table = {}
287283
columns = {}
288284

289-
for name, type_ in filterPairValues(zip(retVal[0]["%s.name" % randStr], retVal[0]["%s.usertype" % randStr])):
285+
for name, type_ in filterPairValues(zip(retVal[0]["%s.name" % kb.aliasName], retVal[0]["%s.usertype" % kb.aliasName])):
290286
columns[name] = SYBASE_TYPES.get(int(type_) if isinstance(type_, basestring) and type_.isdigit() else type_, type_)
291287

292288
table[safeSQLIdentificatorNaming(tbl)] = columns

‎plugins/generic/users.py‎

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -187,13 +187,12 @@ def getPasswordHashes(self):
187187
query += " OR ".join("%s = '%s'" % (condition, user) for user in sorted(users))
188188

189189
if Backend.isDbms(DBMS.SYBASE):
190-
randStr = randomStr()
191190
getCurrentThreadData().disableStdOut = True
192191

193-
retVal = pivotDumpTable("(%s) AS %s" % (query, randStr), ['%s.name' % randStr, '%s.password' % randStr], blind=False)
192+
retVal = pivotDumpTable("(%s) AS %s" % (query, kb.aliasName), ['%s.name' % kb.aliasName, '%s.password' % kb.aliasName], blind=False)
194193

195194
if retVal:
196-
for user, password in filterPairValues(zip(retVal[0]["%s.name" % randStr], retVal[0]["%s.password" % randStr])):
195+
for user, password in filterPairValues(zip(retVal[0]["%s.name" % kb.aliasName], retVal[0]["%s.password" % kb.aliasName])):
197196
if user not in kb.data.cachedUsersPasswords:
198197
kb.data.cachedUsersPasswords[user] = [password]
199198
else:
@@ -228,13 +227,12 @@ def getPasswordHashes(self):
228227
if Backend.isDbms(DBMS.SYBASE):
229228
getCurrentThreadData().disableStdOut = True
230229

231-
randStr = randomStr()
232230
query = rootQuery.inband.query
233231

234-
retVal = pivotDumpTable("(%s) AS %s" % (query, randStr), ['%s.name' % randStr, '%s.password' % randStr], blind=True)
232+
retVal = pivotDumpTable("(%s) AS %s" % (query, kb.aliasName), ['%s.name' % kb.aliasName, '%s.password' % kb.aliasName], blind=True)
235233

236234
if retVal:
237-
for user, password in filterPairValues(zip(retVal[0]["%s.name" % randStr], retVal[0]["%s.password" % randStr])):
235+
for user, password in filterPairValues(zip(retVal[0]["%s.name" % kb.aliasName], retVal[0]["%s.password" % kb.aliasName])):
238236
password = "0x%s" % hexencode(password, conf.encoding).upper()
239237

240238
if user not in kb.data.cachedUsersPasswords:

‎txt/checksum.md5‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -43,17 +43,17 @@ cada93357a7321655927fc9625b3bfec lib/core/exception.py
4343
1e5532ede194ac9c083891c2f02bca93 lib/core/__init__.py
4444
458a194764805cd8312c14ecd4be4d1e lib/core/log.py
4545
7d6edc552e08c30f4f4d49fa93b746f1 lib/core/optiondict.py
46-
c59c0bfccf3e906564d82adf1fcd17de lib/core/option.py
46+
2f2b2286f82028cf36ace9be3af06bf9 lib/core/option.py
4747
c8c386d644d57c659d74542f5f57f632 lib/core/patch.py
4848
6783160150b4711d02c56ee2beadffdb lib/core/profiling.py
4949
6f654e1715571eff68a0f8af3d62dcf8 lib/core/readlineng.py
5050
0c3eef46bdbf87e29a3f95f90240d192 lib/core/replication.py
5151
a7db43859b61569b601b97f187dd31c5 lib/core/revision.py
5252
fcb74fcc9577523524659ec49e2e964b lib/core/session.py
53-
de9fa04f019f5d14db8589e1a61b3064 lib/core/settings.py
53+
279a9ae0ba5b11e48fa3e3c7fc0f6173 lib/core/settings.py
5454
dd68a9d02fccb4fa1428b20e15b0db5d lib/core/shell.py
5555
a7edc9250d13af36ac0108f259859c19 lib/core/subprocessng.py
56-
248bd121e0565318e1efaff54aa427bc lib/core/target.py
56+
62bc180e3e828949ffb342a8f756c183 lib/core/target.py
5757
72d499ca8d792e90a1ebfb2ad2341a51 lib/core/testing.py
5858
e896992e4db26605ab1e73615b1f9434 lib/core/threads.py
5959
c40758411bb0bd68764d78e0bb72bd0f lib/core/unescaper.py
@@ -112,7 +112,7 @@ f7af65aa47329d021e2b2cc8521b42a4 lib/utils/getch.py
112112
d0f4d56c5d6a09a4635035e233d4a782 lib/utils/hash.py
113113
011d2dbf589e0faa0deca61a651239cc lib/utils/htmlentities.py
114114
1e5532ede194ac9c083891c2f02bca93 lib/utils/__init__.py
115-
b0105f091c2e919c3cdb549cb29fd194 lib/utils/pivotdumptable.py
115+
527409077a094b63c88f3291138b1c81 lib/utils/pivotdumptable.py
116116
683c3bd05b6164f56a57ed495c162684 lib/utils/progress.py
117117
0ec5cec9d93d5ffd1eaeda6e942ecadf lib/utils/purge.py
118118
2c5a655c8e94cbe2664ee497752ac1f2 lib/utils/search.py
@@ -157,7 +157,7 @@ aa77fec4fe6b2d7ca4a91aebd9ff4e21 plugins/dbms/informix/syntax.py
157157
25f0fb28e9defcab48a2e946fbb7550a plugins/dbms/informix/takeover.py
158158
1e5532ede194ac9c083891c2f02bca93 plugins/dbms/__init__.py
159159
6917f9b045f6188b89e816dea9b46a3f plugins/dbms/maxdb/connector.py
160-
f33efaab1695dc9885ebae3f6072fffa plugins/dbms/maxdb/enumeration.py
160+
c5728157a49a4a3a98d414f453bb347e plugins/dbms/maxdb/enumeration.py
161161
ffd26f64142226d0b1ed1d70f7f294c0 plugins/dbms/maxdb/filesystem.py
162162
9f9f1c4c4c3150545c4b61d1cffc76a8 plugins/dbms/maxdb/fingerprint.py
163163
4321d7018f5121343460ebfd83bb69be plugins/dbms/maxdb/__init__.py
@@ -199,7 +199,7 @@ f639120d42b33b6ca67930bddbf2ac1f plugins/dbms/sqlite/__init__.py
199199
964e59d2eba619b068b0a15cea28efe0 plugins/dbms/sqlite/syntax.py
200200
3364b2938d7040c507cd622c323557dc plugins/dbms/sqlite/takeover.py
201201
9e64e67291a4c369bad8b8cf2cfa722a plugins/dbms/sybase/connector.py
202-
426698152f63504061e5875e64957691 plugins/dbms/sybase/enumeration.py
202+
6a675a1eb50121a3290e77f0e83a78b3 plugins/dbms/sybase/enumeration.py
203203
74de450dd6d6d006aa9c7eed56e6b09a plugins/dbms/sybase/filesystem.py
204204
0329ab09187614bea02398def59695ec plugins/dbms/sybase/fingerprint.py
205205
a3db8618eed5bb2807b6f77605cba9cc plugins/dbms/sybase/__init__.py
@@ -217,7 +217,7 @@ f7874230e5661910d5fd21544c7d1022 plugins/generic/misc.py
217217
b1d2a7f3170f9b69e71335aa47f9b08b plugins/generic/search.py
218218
a70cc0ada4b0cc9e7df23cb6d48a4a0c plugins/generic/syntax.py
219219
a37c21cc3fa5c0c220d33d450bf503ed plugins/generic/takeover.py
220-
4419b13a4b78d7e9e4a2632302344a1a plugins/generic/users.py
220+
4db140069923afbae38fd93e37c00248 plugins/generic/users.py
221221
1e5532ede194ac9c083891c2f02bca93 plugins/__init__.py
222222
5dc693e22f5d020c5c568d7325bd4226 shell/backdoors/backdoor.asp_
223223
158bfa168128393dde8d6ed11fe9a1b8 shell/backdoors/backdoor.aspx_

0 commit comments

Comments
 (0)