development update (basic ms access dumping implemented)

plugins/generic/enumeration.py

@@ -1210,6 +1210,30 @@ class Enumeration:
                 plusOne = False
             indexRange = getRange(count, dump=True, plusOne=plusOne)
 
+            if kb.dbms == DBMS.ACCESS:
+                value = " "
+                for column in colList:
+                    for index in indexRange:
+                        if column not in lengths:
+                            lengths[column] = 0
+
+                        if column not in entries:
+                            entries[column] = []
+
+                        if column == colList[0]:
+                            # Correction for values with unrecognized chars
+                            if value and '?' in value and value[0]!='?':
+                                value = value.split('?')[0]
+                                value = value[:-1] + chr(ord(value[-1]) + 1)
+                            query = rootQuery.blind.query % (column, conf.tbl, column, value)
+                        else:
+                            query = rootQuery.blind.query2 % (column, conf.tbl, colList[0], entries[column][index])
+
+                        value = inject.getValue(query, inband=False)
+                        lengths[column] = max(lengths[column], len(value))
+                        entries[column].append(value)
+
+            else:
                 for index in indexRange:
                     for column in colList:
                         if column not in lengths:

xml/queries.xml

@@ -359,7 +359,7 @@
         <tables/>
         <dump_table>
             <inband query="SELECT %s FROM %s"/>
-            <blind query="SELECT MIN(%s) FROM %s WHERE %s > '%s'" count="SELECT COUNT(*) FROM %s"/>
+            <blind query="SELECT MIN(%s) FROM %s WHERE CVAR(%s) > '%s'" query2="SELECT %s FROM %s WHERE %s = '%s'" count="SELECT COUNT(*) FROM %s"/>
         </dump_table>
    </dbms>