Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit f7bf1fb

Browse files
stamparmstamparm
committed
upgrade/fixes for direct DBMS access
1 parent af71e3c commit f7bf1fb

9 files changed

Lines changed: 33 additions & 27 deletions

File tree

‎lib/core/common.py‎

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -84,6 +84,7 @@
8484
from lib.core.settings import DBMS_DICT
8585
from lib.core.settings import DESCRIPTION
8686
from lib.core.settings import DUMMY_SQL_INJECTION_CHARS
87+
from lib.core.settings import NULL
8788
from lib.core.settings import IS_WIN
8889
from lib.core.settings import PLATFORM
8990
from lib.core.settings import PYVERSION
@@ -1088,9 +1089,9 @@ def parsePasswordHash(password):
10881089
blank = " " * 8
10891090

10901091
if not password or password == " ":
1091-
password = "NULL"
1092+
password = NULL
10921093

1093-
if Backend.isDbms(DBMS.MSSQL) and password != "NULL" and isHexEncodedString(password):
1094+
if Backend.isDbms(DBMS.MSSQL) and password != NULL and isHexEncodedString(password):
10941095
hexPassword = password
10951096
password = "%s\n" % hexPassword
10961097
password += "%sheader: %s\n" % (blank, hexPassword[:6])
@@ -2047,7 +2048,7 @@ def getPartRun():
20472048
# Return the INI tag to consider for common outputs (e.g. 'Databases')
20482049
return commonPartsDict[retVal][1] if isinstance(commonPartsDict.get(retVal), tuple) else retVal
20492050

2050-
def getUnicode(value, encoding=None, system=False):
2051+
def getUnicode(value, encoding=None, system=False, noneToNull=False):
20512052
"""
20522053
Return the unicode representation of the supplied value:
20532054
@@ -2059,6 +2060,13 @@ def getUnicode(value, encoding=None, system=False):
20592060
u'1'
20602061
"""
20612062

2063+
if noneToNull and value is None:
2064+
return NULL
2065+
2066+
if isinstance(value, (list, tuple)):
2067+
value = list(getUnicode(_, encoding, system, noneToNull) for _ in value)
2068+
return value
2069+
20622070
if not system:
20632071
if isinstance(value, unicode):
20642072
return value
@@ -2917,7 +2925,7 @@ def isNullValue(value):
29172925
Returns whether the value contains explicit 'NULL' value
29182926
"""
29192927

2920-
return isinstance(value, basestring) and value.upper() == "NULL"
2928+
return isinstance(value, basestring) and value.upper() == NULL
29212929

29222930
def expandMnemonics(mnemonics, parser, args):
29232931
"""

‎lib/core/dump.py‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,7 @@
2929
from lib.core.exception import sqlmapValueException
3030
from lib.core.replication import Replication
3131
from lib.core.settings import BUFFERED_LOG_SIZE
32+
from lib.core.settings import NULL
3233
from lib.core.settings import TRIM_STDOUT_DUMP_SIZE
3334
from lib.core.settings import UNICODE_ENCODING
3435

@@ -455,7 +456,7 @@ def dbTableValues(self, tableValues):
455456
value = getUnicode(info["values"][i])
456457

457458
if re.search("^[\ *]*$", value):
458-
value = "NULL"
459+
value = NULL
459460

460461
values.append(value)
461462
maxlength = int(info["length"])

‎lib/core/option.py‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -86,6 +86,7 @@
8686
from lib.core.settings import DEFAULT_TOR_HTTP_PORTS
8787
from lib.core.settings import DEFAULT_TOR_SOCKS_PORT
8888
from lib.core.settings import IS_WIN
89+
from lib.core.settings import NULL
8990
from lib.core.settings import PLATFORM
9091
from lib.core.settings import PYVERSION
9192
from lib.core.settings import SITE
@@ -1474,7 +1475,7 @@ def __setKnowledgeBaseAttributes(flushAll=True):
14741475
kb.testQueryCount = 0
14751476
kb.threadContinue = True
14761477
kb.threadException = False
1477-
kb.uChar = "NULL"
1478+
kb.uChar = NULL
14781479
kb.xpCmdshellAvailable = False
14791480

14801481
kb.chars = AttribDict()

‎lib/core/settings.py‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -239,6 +239,9 @@
239239
"rollback ", ),
240240
}
241241

242+
# string representation for NULL value
243+
NULL = "NULL"
244+
242245
# Regular expressions used for parsing error messages (--parse-errors)
243246
ERROR_PARSING_REGEXES = (
244247
r"<b>[^<]*(fatal|error|warning|exception)[^<]*</b>:?\s*(?P<result>.+?)<br\s*/?\s*>",

‎lib/request/direct.py‎

Lines changed: 9 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -65,19 +65,17 @@ def direct(query, content=True):
6565
if not output:
6666
return output
6767
elif content:
68-
if conf.hostname not in kb.resumedQueries or ( conf.hostname in kb.resumedQueries and query not in kb.resumedQueries[conf.hostname] ):
69-
dataToSessionFile("[%s][%s][%s][%s][%s]\n" % (conf.hostname, kb.injection.place, conf.parameters[kb.injection.place], query, base64pickle(output)))
68+
#if conf.hostname not in kb.resumedQueries or ( conf.hostname in kb.resumedQueries and query not in kb.resumedQueries[conf.hostname] ):
69+
#dataToSessionFile("[%s][%s][%s][%s][%s]\n" % (conf.hostname, kb.injection.place, conf.parameters[kb.injection.place], query, base64pickle(output)))
7070

71-
if len(output) == 1:
71+
if output and isinstance(output, (list, tuple)):
7272
if len(output[0]) == 1:
73-
out = list(output)[0][0]
74-
if isinstance(out, str):
75-
out = utf8decode(out)
76-
return getUnicode(out, UNICODE_ENCODING)
77-
else:
78-
return list(output)
79-
else:
80-
return output
73+
if len(output) > 1:
74+
output = map(lambda _: _[0], output)
75+
else:
76+
output = output[0][0]
77+
78+
return getUnicode(output, noneToNull=True)
8179
else:
8280
for line in output:
8381
if line[0] in (1, -1):

‎plugins/dbms/maxdb/enumeration.py‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -78,8 +78,6 @@ def getTables(self, bruteForce=None):
7878
rootQuery = queries[Backend.getIdentifiedDbms()].tables
7979

8080
for db in dbs:
81-
db = unArrayizeValue(db)
82-
8381
randStr = randomStr()
8482
query = rootQuery.inband.query % (("'%s'" % db) if db != "USER" else 'USER')
8583
retVal = self.__pivotDumpTable("(%s) AS %s" % (query, randStr), ['%s.tablename' % randStr], blind=True)

‎plugins/dbms/mssqlserver/enumeration.py‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -89,8 +89,6 @@ def getTables(self):
8989

9090
if any(isTechniqueAvailable(_) for _ in (PAYLOAD.TECHNIQUE.UNION, PAYLOAD.TECHNIQUE.ERROR)) or conf.direct:
9191
for db in dbs:
92-
db = unArrayizeValue(db)
93-
9492
if conf.excludeSysDbs and db in self.excludeDbsList:
9593
infoMsg = "skipping system database '%s'" % db
9694
logger.info(infoMsg)
@@ -172,9 +170,6 @@ def searchTable(self):
172170
enumDbs = kb.data.cachedDbs
173171

174172
for db in enumDbs:
175-
if isinstance(db, list):
176-
db = db[0]
177-
178173
db = safeSQLIdentificatorNaming(db)
179174
foundTbls[db] = []
180175

‎plugins/dbms/sybase/enumeration.py‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -139,8 +139,6 @@ def getTables(self, bruteForce=None):
139139
rootQuery = queries[Backend.getIdentifiedDbms()].tables
140140

141141
for db in dbs:
142-
db = unArrayizeValue(db)
143-
144142
for blind in blinds:
145143
randStr = randomStr()
146144
query = rootQuery.inband.query % db

‎plugins/generic/enumeration.py‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -897,7 +897,7 @@ def getTables(self, bruteForce=None):
897897
value = map(lambda x: (dbs[0], x), value)
898898

899899
for db, table in filterPairValues(value):
900-
db = safeSQLIdentificatorNaming(unArrayizeValue(db))
900+
db = safeSQLIdentificatorNaming(db)
901901
table = safeSQLIdentificatorNaming(table, True)
902902

903903
if not kb.data.cachedTables.has_key(db):
@@ -1654,6 +1654,10 @@ def dumpTable(self, foundData=None):
16541654
else:
16551655
colEntry = entry[index] if index < len(entry) else u''
16561656

1657+
if colEntry is None:
1658+
import pdb
1659+
pdb.set_trace()
1660+
16571661
colEntryLen = len(getUnicode(colEntry))
16581662
maxLen = max(colLen, colEntryLen)
16591663

0 commit comments

Comments
 (0)