2008-10-15 19:38:22 +04:00
|
|
|
#!/usr/bin/env python
|
|
|
|
|
|
|
|
"""
|
2008-10-15 19:56:32 +04:00
|
|
|
$Id$
|
2008-10-15 19:38:22 +04:00
|
|
|
|
2010-10-14 18:41:14 +04:00
|
|
|
Copyright (c) 2006-2010 sqlmap developers (http://sqlmap.sourceforge.net/)
|
2010-10-15 03:18:29 +04:00
|
|
|
See the file 'doc/COPYING' for copying permission
|
2008-10-15 19:38:22 +04:00
|
|
|
"""
|
|
|
|
|
|
|
|
from lib.controller.handler import setHandler
|
|
|
|
from lib.core.common import getHtmlErrorFp
|
2010-09-26 18:02:13 +04:00
|
|
|
from lib.core.common import dataToStdout
|
2008-10-15 19:38:22 +04:00
|
|
|
from lib.core.data import conf
|
|
|
|
from lib.core.data import kb
|
2010-09-30 16:35:45 +04:00
|
|
|
from lib.core.data import paths
|
2008-10-15 19:38:22 +04:00
|
|
|
from lib.core.exception import sqlmapUnsupportedDBMSException
|
|
|
|
from lib.core.settings import SUPPORTED_DBMS
|
2008-11-13 02:44:09 +03:00
|
|
|
from lib.techniques.blind.timebased import timeTest
|
2010-10-20 13:09:04 +04:00
|
|
|
from lib.techniques.error.test import errorTest
|
2008-10-15 19:38:22 +04:00
|
|
|
from lib.techniques.inband.union.test import unionTest
|
2008-12-17 00:30:24 +03:00
|
|
|
from lib.techniques.outband.stacked import stackedTest
|
2008-10-15 19:38:22 +04:00
|
|
|
|
|
|
|
def action():
|
|
|
|
"""
|
|
|
|
This function exploit the SQL injection on the affected
|
|
|
|
url parameter and extract requested data from the
|
|
|
|
back-end database management system or operating system
|
|
|
|
if possible
|
|
|
|
"""
|
|
|
|
|
|
|
|
# First of all we have to identify the back-end database management
|
|
|
|
# system to be able to go ahead with the injection
|
2010-03-27 02:23:25 +03:00
|
|
|
setHandler()
|
2008-10-15 19:38:22 +04:00
|
|
|
|
|
|
|
if not conf.dbmsHandler:
|
|
|
|
htmlParsed = getHtmlErrorFp()
|
|
|
|
|
|
|
|
errMsg = "sqlmap was not able to fingerprint the "
|
|
|
|
errMsg += "back-end database management system"
|
|
|
|
|
|
|
|
if htmlParsed:
|
|
|
|
errMsg += ", but from the HTML error page it was "
|
|
|
|
errMsg += "possible to determinate that the "
|
|
|
|
errMsg += "back-end DBMS is %s" % htmlParsed
|
|
|
|
|
|
|
|
if htmlParsed and htmlParsed.lower() in SUPPORTED_DBMS:
|
|
|
|
errMsg += ". Do not specify the back-end DBMS manually, "
|
|
|
|
errMsg += "sqlmap will fingerprint the DBMS for you"
|
|
|
|
else:
|
2010-10-18 15:34:53 +04:00
|
|
|
errMsg += ". Support for this DBMS will be implemented at "
|
|
|
|
errMsg += "some point"
|
2008-10-15 19:38:22 +04:00
|
|
|
|
|
|
|
raise sqlmapUnsupportedDBMSException, errMsg
|
|
|
|
|
2010-09-26 18:02:13 +04:00
|
|
|
dataToStdout("%s\n" % conf.dbmsHandler.getFingerprint())
|
2008-10-15 19:38:22 +04:00
|
|
|
|
2008-11-12 03:36:50 +03:00
|
|
|
# Techniques options
|
2008-12-17 00:30:24 +03:00
|
|
|
if conf.stackedTest:
|
2010-10-31 19:58:38 +03:00
|
|
|
conf.dumper.technic("stacked queries injection payload", stackedTest())
|
2008-12-17 00:30:24 +03:00
|
|
|
|
2010-10-19 22:17:34 +04:00
|
|
|
if conf.errorTest:
|
2010-10-31 19:58:38 +03:00
|
|
|
conf.dumper.technic("error-based injection payload", errorTest())
|
2010-10-19 22:17:34 +04:00
|
|
|
|
2008-11-12 03:36:50 +03:00
|
|
|
if conf.timeTest:
|
2010-10-31 19:58:38 +03:00
|
|
|
conf.dumper.technic("time-based blind injection payload", timeTest())
|
2008-11-12 03:36:50 +03:00
|
|
|
|
2010-10-26 03:39:55 +04:00
|
|
|
if conf.unionTest and kb.unionPosition is None:
|
2010-10-31 19:58:38 +03:00
|
|
|
conf.dumper.technic("inband injection payload", unionTest())
|
2008-10-15 19:38:22 +04:00
|
|
|
|
|
|
|
# Enumeration options
|
|
|
|
if conf.getBanner:
|
2010-05-28 20:43:04 +04:00
|
|
|
conf.dumper.banner(conf.dbmsHandler.getBanner())
|
2008-10-15 19:38:22 +04:00
|
|
|
|
|
|
|
if conf.getCurrentUser:
|
2010-05-28 20:43:04 +04:00
|
|
|
conf.dumper.currentUser(conf.dbmsHandler.getCurrentUser())
|
2008-10-15 19:38:22 +04:00
|
|
|
|
|
|
|
if conf.getCurrentDb:
|
2010-05-28 20:43:04 +04:00
|
|
|
conf.dumper.currentDb(conf.dbmsHandler.getCurrentDb())
|
2008-10-15 19:38:22 +04:00
|
|
|
|
2008-12-18 23:41:11 +03:00
|
|
|
if conf.isDba:
|
2010-05-28 20:43:04 +04:00
|
|
|
conf.dumper.dba(conf.dbmsHandler.isDba())
|
2008-12-18 23:41:11 +03:00
|
|
|
|
2008-10-15 19:38:22 +04:00
|
|
|
if conf.getUsers:
|
2010-05-28 20:43:04 +04:00
|
|
|
conf.dumper.users(conf.dbmsHandler.getUsers())
|
2008-10-15 19:38:22 +04:00
|
|
|
|
|
|
|
if conf.getPasswordHashes:
|
2010-05-28 20:43:04 +04:00
|
|
|
conf.dumper.userSettings("database management system users password hashes",
|
|
|
|
conf.dbmsHandler.getPasswordHashes(), "password hash")
|
2008-10-15 19:38:22 +04:00
|
|
|
|
|
|
|
if conf.getPrivileges:
|
2010-05-28 20:43:04 +04:00
|
|
|
conf.dumper.userSettings("database management system users privileges",
|
|
|
|
conf.dbmsHandler.getPrivileges(), "privilege")
|
2008-10-15 19:38:22 +04:00
|
|
|
|
2010-03-25 18:46:06 +03:00
|
|
|
if conf.getRoles:
|
2010-05-28 20:43:04 +04:00
|
|
|
conf.dumper.userSettings("database management system users roles",
|
|
|
|
conf.dbmsHandler.getRoles(), "role")
|
2010-03-25 18:46:06 +03:00
|
|
|
|
2008-10-15 19:38:22 +04:00
|
|
|
if conf.getDbs:
|
2010-05-28 20:43:04 +04:00
|
|
|
conf.dumper.dbs(conf.dbmsHandler.getDbs())
|
2008-10-15 19:38:22 +04:00
|
|
|
|
|
|
|
if conf.getTables:
|
2010-05-28 20:43:04 +04:00
|
|
|
conf.dumper.dbTables(conf.dbmsHandler.getTables())
|
2008-10-15 19:38:22 +04:00
|
|
|
|
2010-09-30 16:35:45 +04:00
|
|
|
if conf.cExists:
|
|
|
|
conf.dumper.dbTables(conf.dbmsHandler.tableExists(paths.COMMON_TABLES))
|
|
|
|
|
|
|
|
if conf.tableFile:
|
|
|
|
conf.dumper.dbTables(conf.dbmsHandler.tableExists(conf.tableFile))
|
|
|
|
|
2008-10-15 19:38:22 +04:00
|
|
|
if conf.getColumns:
|
2010-05-28 20:43:04 +04:00
|
|
|
conf.dumper.dbTableColumns(conf.dbmsHandler.getColumns())
|
2008-10-15 19:38:22 +04:00
|
|
|
|
|
|
|
if conf.dumpTable:
|
2010-05-28 20:43:04 +04:00
|
|
|
conf.dumper.dbTableValues(conf.dbmsHandler.dumpTable())
|
2008-10-15 19:38:22 +04:00
|
|
|
|
|
|
|
if conf.dumpAll:
|
|
|
|
conf.dbmsHandler.dumpAll()
|
|
|
|
|
2010-05-07 17:40:57 +04:00
|
|
|
if conf.search:
|
|
|
|
conf.dbmsHandler.search()
|
|
|
|
|
2008-10-15 19:38:22 +04:00
|
|
|
if conf.query:
|
2010-05-28 20:43:04 +04:00
|
|
|
conf.dumper.query(conf.query, conf.dbmsHandler.sqlQuery(conf.query))
|
2008-10-15 19:38:22 +04:00
|
|
|
|
|
|
|
if conf.sqlShell:
|
|
|
|
conf.dbmsHandler.sqlShell()
|
|
|
|
|
2009-09-26 03:03:45 +04:00
|
|
|
# User-defined function options
|
|
|
|
if conf.udfInject:
|
|
|
|
conf.dbmsHandler.udfInjectCustom()
|
|
|
|
|
2008-10-15 19:38:22 +04:00
|
|
|
# File system options
|
|
|
|
if conf.rFile:
|
2010-05-28 20:43:04 +04:00
|
|
|
conf.dumper.rFile(conf.rFile, conf.dbmsHandler.readFile(conf.rFile))
|
2008-10-15 19:38:22 +04:00
|
|
|
|
|
|
|
if conf.wFile:
|
2009-04-22 15:48:07 +04:00
|
|
|
conf.dbmsHandler.writeFile(conf.wFile, conf.dFile, conf.wFileType)
|
|
|
|
|
|
|
|
# Operating system options
|
|
|
|
if conf.osCmd:
|
|
|
|
conf.dbmsHandler.osCmd()
|
2008-10-15 19:38:22 +04:00
|
|
|
|
|
|
|
if conf.osShell:
|
|
|
|
conf.dbmsHandler.osShell()
|
2009-04-22 15:48:07 +04:00
|
|
|
|
|
|
|
if conf.osPwn:
|
|
|
|
conf.dbmsHandler.osPwn()
|
|
|
|
|
|
|
|
if conf.osSmb:
|
|
|
|
conf.dbmsHandler.osSmb()
|
|
|
|
|
|
|
|
if conf.osBof:
|
|
|
|
conf.dbmsHandler.osBof()
|
|
|
|
|
2009-09-26 03:03:45 +04:00
|
|
|
# Windows registry options
|
|
|
|
if conf.regRead:
|
2010-05-28 20:43:04 +04:00
|
|
|
conf.dumper.registerValue(conf.dbmsHandler.regRead())
|
2009-09-26 03:03:45 +04:00
|
|
|
|
|
|
|
if conf.regAdd:
|
|
|
|
conf.dbmsHandler.regAdd()
|
|
|
|
|
|
|
|
if conf.regDel:
|
|
|
|
conf.dbmsHandler.regDel()
|
|
|
|
|
2009-04-22 15:48:07 +04:00
|
|
|
# Miscellaneous options
|
|
|
|
if conf.cleanup:
|
|
|
|
conf.dbmsHandler.cleanup()
|
2010-03-27 02:23:25 +03:00
|
|
|
|
|
|
|
if conf.direct:
|
|
|
|
conf.dbmsConnector.close()
|