From 890bf708bc7bf046efaf19cbae80a6ec75573080 Mon Sep 17 00:00:00 2001 From: Bernardo Damele Date: Thu, 15 Mar 2012 00:19:57 +0000 Subject: [PATCH] Minor fixes to make --os-* switch work again against MySQL/Windows/ASP.NET (where stacked queries are supported) --- lib/core/common.py | 2 +- xml/payloads.xml | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/lib/core/common.py b/lib/core/common.py index 2ef100c41..94f32d157 100644 --- a/lib/core/common.py +++ b/lib/core/common.py @@ -959,7 +959,7 @@ def cleanQuery(query): sqlStatementEsc = sqlStatement.replace("(", "\\(") queryMatch = re.search("(%s)" % sqlStatementEsc, query, re.I) - if queryMatch: + if queryMatch and "sys_exec" not in query: upperQuery = upperQuery.replace(queryMatch.group(1), sqlStatement.upper()) return upperQuery diff --git a/xml/payloads.xml b/xml/payloads.xml index b51ff2373..15c696a84 100644 --- a/xml/payloads.xml +++ b/xml/payloads.xml @@ -1834,7 +1834,7 @@ Formats: ; IF(([INFERENCE]),SLEEP([SLEEPTIME]),[RANDNUM]); ; SELECT SLEEP([SLEEPTIME]); - # + -- @@ -1855,7 +1855,7 @@ Formats: ; IF(([INFERENCE]),BENCHMARK([SLEEPTIME]000000,MD5('[RANDSTR]')),[RANDNUM]); ; SELECT BENCHMARK([SLEEPTIME]000000,MD5('[RANDSTR]')); - # + --