Major bug fix when the CU alias (current user) is given (with -U option)

bdamele · bdamele · commit f91843540f9c · 2009-01-19T21:25:37.000Z
together with --privileges or --password to work properly also on
MySQL &gt;= 5.0.
diff --git a/plugins/generic/enumeration.py b/plugins/generic/enumeration.py
@@ -206,6 +206,12 @@ def getPasswordHashes(self):
                     query += " WHERE "
                     query += " OR ".join("%s = '%s'" % (condition, user) for user in users)
                 else:
+                    if kb.dbms == "MySQL":
+                        parsedUser = re.search("[\047]*(.*?)[\047]*\@", conf.user)
+
+                        if parsedUser:
+                            conf.user = parsedUser.groups()[0]
+
                     query += " WHERE %s = '%s'" % (condition, conf.user)
 
             value = inject.getValue(query, blind=False)
@@ -238,7 +244,7 @@ def getPasswordHashes(self):
 
             for user in users:
                 if kb.dbms == "MySQL":
-                    parsedUser = re.search("\047(.*?)\047@'", user)
+                    parsedUser = re.search("[\047]*(.*?)[\047]*\@", user)
 
                     if parsedUser:
                         user = parsedUser.groups()[0]
@@ -386,6 +392,12 @@ def getPrivileges(self):
                     else:
                         query += " OR ".join("%s = '%s'" % (condition, user) for user in users)
                 else:
+                    if kb.dbms == "MySQL":
+                        parsedUser = re.search("[\047]*(.*?)[\047]*\@", conf.user)
+
+                        if parsedUser:
+                            conf.user = parsedUser.groups()[0]
+
                     # NOTE: I assume that the user provided is not in
                     # MySQL >= 5.0 syntax 'user'@'host'
                     if kb.dbms == "MySQL" and self.has_information_schema:
@@ -449,6 +461,11 @@ def getPrivileges(self):
                         for user in conf.user.split(","):
                             users.add("%" + user + "%")
                     else:
+                        parsedUser = re.search("[\047]*(.*?)[\047]*\@", conf.user)
+
+                        if parsedUser:
+                            conf.user = parsedUser.groups()[0]
+
                         users = [ "%" + conf.user + "%" ]
 
                 elif "," in conf.user:
