From 8c0ac767f42832670680beef881996e5e61786eb Mon Sep 17 00:00:00 2001 From: Bernardo Damele Date: Wed, 22 Apr 2009 11:48:07 +0000 Subject: [PATCH] Updated to sqlmap 0.7 release candidate 1 --- doc/AUTHORS | 8 +- doc/ChangeLog | 30 +- doc/README.html | 456 +++++---- doc/README.pdf | Bin 337338 -> 355247 bytes doc/README.sgml | 443 +++++---- doc/THANKS | 68 +- extra/mysqludfsys/command_execution/linux.sql | 119 +++ .../mysqludfsys/command_execution/windows.sql | 128 +++ extra/mysqludfsys/lib_mysqludf_sys/Makefile | 4 - .../{ => doc}/lib_mysqludf_sys.html | 0 .../lib_mysqludf_sys/lib_mysqludf_sys.so | Bin 12896 -> 0 bytes .../lib_mysqludf_sys/linux/Makefile | 6 + .../lib_mysqludf_sys/{ => linux}/install.sh | 8 +- .../{ => linux}/lib_mysqludf_sys.sql | 0 .../linux/so/lib_mysqludf_sys.so | Bin 0 -> 5476 bytes .../{ => linux/src}/lib_mysqludf_sys.c | 2 +- .../windows/dll/lib_mysqludf_sys.dll | Bin 0 -> 6656 bytes .../windows/lib_mysqludf_sys.sql | 33 + .../windows/src/lib_mysqludf_sys.c | 426 +++++++++ .../mysqludfsys/lib_mysqludf_sys_0.0.3.tar.gz | Bin 12538 -> 12695 bytes .../command_execution/linux.sql | 97 ++ .../command_execution/windows.sql | 104 ++ .../lib_postgresqludf_sys/Makefile | 4 - .../lib_postgresqludf_sys.so | Bin 8607 -> 0 bytes .../lib_postgresqludf_sys/linux/Makefile | 11 + .../{ => linux}/install.sh | 56 +- .../{ => linux}/lib_postgresqludf_sys.sql | 4 +- .../linux/so/8.2/lib_postgresqludf_sys.so | Bin 0 -> 5476 bytes .../linux/so/8.3/lib_postgresqludf_sys.so | Bin 0 -> 5476 bytes .../linux/src/8.2/lib_postgresqludf_sys.c | 111 +++ .../src/8.3}/lib_postgresqludf_sys.c | 135 +-- .../windows/dll/8.2/lib_postgresqludf_sys.dll | Bin 0 -> 6144 bytes .../windows/dll/8.3/lib_postgresqludf_sys.dll | Bin 0 -> 6144 bytes .../windows/lib_postgresqludf_sys.sql | 23 + .../windows/src/8.2/lib_postgresqludf_sys.c | 111 +++ .../windows/src/8.3/lib_postgresqludf_sys.c | 111 +++ .../lib_postgresqludf_sys_0.0.1.tar.gz | Bin 5705 -> 11430 bytes lib/__init__.py | 4 +- lib/contrib/__init__.py | 4 +- lib/contrib/magic.py | 203 ++++ lib/contrib/tokenkidnapping/Churrasco.exe | Bin 0 -> 125952 bytes lib/contrib/upx/doc/LICENSE | 138 +++ lib/contrib/upx/doc/README | 142 +++ lib/contrib/upx/doc/upx.html | 888 ++++++++++++++++++ lib/contrib/upx/linux/upx | Bin 0 -> 320044 bytes lib/contrib/upx/windows/upx.exe | Bin 0 -> 271872 bytes lib/controller/__init__.py | 4 +- lib/controller/action.py | 28 +- lib/controller/checks.py | 4 +- lib/controller/controller.py | 20 +- lib/controller/handler.py | 6 +- lib/core/__init__.py | 4 +- lib/core/agent.py | 126 ++- lib/core/common.py | 160 +++- lib/core/convert.py | 11 +- lib/core/data.py | 4 +- lib/core/datatype.py | 4 +- lib/core/dump.py | 38 +- lib/core/exception.py | 12 +- lib/core/option.py | 209 ++++- lib/core/optiondict.py | 14 +- lib/core/progress.py | 4 +- lib/core/readlineng.py | 10 +- lib/core/session.py | 151 ++- lib/core/settings.py | 55 +- lib/core/shell.py | 28 +- lib/core/subprocessng.py | 89 ++ lib/core/target.py | 4 +- lib/core/unescaper.py | 4 +- lib/core/update.py | 4 +- lib/parse/__init__.py | 4 +- lib/parse/banner.py | 12 +- lib/parse/cmdline.py | 111 ++- lib/parse/configfile.py | 4 +- lib/parse/handler.py | 7 +- lib/parse/headers.py | 4 +- lib/parse/html.py | 4 +- lib/parse/queriesfile.py | 7 +- lib/request/__init__.py | 4 +- lib/request/basic.py | 4 +- lib/request/comparison.py | 23 +- lib/request/connect.py | 19 +- lib/request/inject.py | 139 +-- lib/request/proxy.py | 4 +- lib/takeover/__init__.py | 25 + lib/takeover/abstraction.py | 171 ++++ lib/takeover/dep.py | 176 ++++ lib/takeover/metasploit.py | 666 +++++++++++++ lib/takeover/registry.py | 139 +++ lib/takeover/udf.py | 67 ++ lib/takeover/upx.py | 89 ++ lib/takeover/xp_cmdshell.py | 220 +++++ lib/techniques/__init__.py | 4 +- lib/techniques/blind/__init__.py | 4 +- lib/techniques/blind/inference.py | 53 +- lib/techniques/blind/timebased.py | 23 +- lib/techniques/inband/__init__.py | 4 +- lib/techniques/inband/union/__init__.py | 4 +- lib/techniques/inband/union/test.py | 103 +- lib/techniques/inband/union/use.py | 105 +-- lib/techniques/outband/__init__.py | 4 +- lib/techniques/outband/stacked.py | 24 +- lib/utils/__init__.py | 4 +- lib/utils/google.py | 4 +- lib/utils/parenthesis.py | 4 +- lib/utils/resume.py | 4 +- plugins/__init__.py | 4 +- plugins/dbms/__init__.py | 4 +- plugins/dbms/mssqlserver.py | 493 +++++++++- plugins/dbms/mysql.py | 482 ++++++---- plugins/dbms/oracle.py | 54 +- plugins/dbms/postgresql.py | 303 +++++- plugins/generic/__init__.py | 4 +- plugins/generic/enumeration.py | 329 ++++--- plugins/generic/filesystem.py | 305 +++++- plugins/generic/fingerprint.py | 4 +- plugins/generic/misc.py | 134 +++ plugins/generic/takeover.py | 397 +++++++- sqlmap.conf | 82 +- sqlmap.py | 4 +- udf/mysql/linux/lib_mysqludf_sys.so | Bin 0 -> 5476 bytes udf/mysql/windows/lib_mysqludf_sys.dll | Bin 0 -> 6656 bytes .../linux/8.2/lib_postgresqludf_sys.so | Bin 0 -> 5476 bytes .../linux/8.3/lib_postgresqludf_sys.so | Bin 0 -> 5476 bytes .../windows/8.2/lib_postgresqludf_sys.dll | Bin 0 -> 6144 bytes .../windows/8.3/lib_postgresqludf_sys.dll | Bin 0 -> 6144 bytes xml/banner/generic.xml | 16 +- xml/banner/mssql.xml | 32 + xml/queries.xml | 14 +- 129 files changed, 8386 insertions(+), 1388 deletions(-) create mode 100644 extra/mysqludfsys/command_execution/linux.sql create mode 100644 extra/mysqludfsys/command_execution/windows.sql delete mode 100644 extra/mysqludfsys/lib_mysqludf_sys/Makefile rename extra/mysqludfsys/lib_mysqludf_sys/{ => doc}/lib_mysqludf_sys.html (100%) delete mode 100755 extra/mysqludfsys/lib_mysqludf_sys/lib_mysqludf_sys.so create mode 100644 extra/mysqludfsys/lib_mysqludf_sys/linux/Makefile rename extra/mysqludfsys/lib_mysqludf_sys/{ => linux}/install.sh (91%) rename extra/mysqludfsys/lib_mysqludf_sys/{ => linux}/lib_mysqludf_sys.sql (100%) create mode 100755 extra/mysqludfsys/lib_mysqludf_sys/linux/so/lib_mysqludf_sys.so rename extra/mysqludfsys/lib_mysqludf_sys/{ => linux/src}/lib_mysqludf_sys.c (94%) create mode 100755 extra/mysqludfsys/lib_mysqludf_sys/windows/dll/lib_mysqludf_sys.dll create mode 100644 extra/mysqludfsys/lib_mysqludf_sys/windows/lib_mysqludf_sys.sql create mode 100644 extra/mysqludfsys/lib_mysqludf_sys/windows/src/lib_mysqludf_sys.c create mode 100644 extra/postgresqludfsys/command_execution/linux.sql create mode 100644 extra/postgresqludfsys/command_execution/windows.sql delete mode 100644 extra/postgresqludfsys/lib_postgresqludf_sys/Makefile delete mode 100755 extra/postgresqludfsys/lib_postgresqludf_sys/lib_postgresqludf_sys.so create mode 100644 extra/postgresqludfsys/lib_postgresqludf_sys/linux/Makefile rename extra/postgresqludfsys/lib_postgresqludf_sys/{ => linux}/install.sh (80%) rename extra/postgresqludfsys/lib_postgresqludf_sys/{ => linux}/lib_postgresqludf_sys.sql (75%) create mode 100644 extra/postgresqludfsys/lib_postgresqludf_sys/linux/so/8.2/lib_postgresqludf_sys.so create mode 100755 extra/postgresqludfsys/lib_postgresqludf_sys/linux/so/8.3/lib_postgresqludf_sys.so create mode 100755 extra/postgresqludfsys/lib_postgresqludf_sys/linux/src/8.2/lib_postgresqludf_sys.c rename extra/postgresqludfsys/lib_postgresqludf_sys/{ => linux/src/8.3}/lib_postgresqludf_sys.c (74%) create mode 100755 extra/postgresqludfsys/lib_postgresqludf_sys/windows/dll/8.2/lib_postgresqludf_sys.dll create mode 100755 extra/postgresqludfsys/lib_postgresqludf_sys/windows/dll/8.3/lib_postgresqludf_sys.dll create mode 100644 extra/postgresqludfsys/lib_postgresqludf_sys/windows/lib_postgresqludf_sys.sql create mode 100755 extra/postgresqludfsys/lib_postgresqludf_sys/windows/src/8.2/lib_postgresqludf_sys.c create mode 100644 extra/postgresqludfsys/lib_postgresqludf_sys/windows/src/8.3/lib_postgresqludf_sys.c create mode 100644 lib/contrib/magic.py create mode 100755 lib/contrib/tokenkidnapping/Churrasco.exe create mode 100644 lib/contrib/upx/doc/LICENSE create mode 100644 lib/contrib/upx/doc/README create mode 100644 lib/contrib/upx/doc/upx.html create mode 100755 lib/contrib/upx/linux/upx create mode 100755 lib/contrib/upx/windows/upx.exe create mode 100644 lib/core/subprocessng.py create mode 100644 lib/takeover/__init__.py create mode 100644 lib/takeover/abstraction.py create mode 100644 lib/takeover/dep.py create mode 100644 lib/takeover/metasploit.py create mode 100644 lib/takeover/registry.py create mode 100644 lib/takeover/udf.py create mode 100644 lib/takeover/upx.py create mode 100644 lib/takeover/xp_cmdshell.py create mode 100644 plugins/generic/misc.py create mode 100755 udf/mysql/linux/lib_mysqludf_sys.so create mode 100755 udf/mysql/windows/lib_mysqludf_sys.dll create mode 100644 udf/postgresql/linux/8.2/lib_postgresqludf_sys.so create mode 100755 udf/postgresql/linux/8.3/lib_postgresqludf_sys.so create mode 100755 udf/postgresql/windows/8.2/lib_postgresqludf_sys.dll create mode 100755 udf/postgresql/windows/8.3/lib_postgresqludf_sys.dll diff --git a/doc/AUTHORS b/doc/AUTHORS index b534c3e1f..262251555 100644 --- a/doc/AUTHORS +++ b/doc/AUTHORS @@ -1,7 +1,3 @@ -Bernardo Damele A. G. (inquis) - project leader, core developer +Bernardo Damele A. G. (inquis) - Lead developer -PGP Key ID: 0x05F5A30F - -Daniele Bellucci (belch) - project founder, initial developer - -PGP Key ID: 0x9A0E8190 +PGP Key ID: 0x05F5A30F diff --git a/doc/ChangeLog b/doc/ChangeLog index 1e7d3e2aa..84a32f391 100644 --- a/doc/ChangeLog +++ b/doc/ChangeLog @@ -1,10 +1,34 @@ -sqlmap (0.6.5-1) stable; urgency=low +sqlmap (0.7rc1-1) stable; urgency=low + * Added support to execute arbitrary commands on the database server + underlying operating system either returning the standard output or not + via UDF injection on MySQL and PostgreSQL and via xp_cmdshell() stored + procedure on Microsoft SQL Server; + * Added support for out-of-band connection between the attacker box and + the database server underlying operating system via stand-alone payload + stager created by Metasploit and supporting Meterpreter, shell and VNC + payloads for both Windows and Linux; + * Added support for out-of-band connection via Microsoft SQL Server 2000 + and 2005 'sp_replwritetovarbin' stored procedure heap-based buffer + overflow (MS09-004) exploitation with multi-stage Metasploit payload + support; + * Added support for out-of-band connection via SMB reflection attack with + UNC path request from the database server to the attacker box by using + the Metasploit smb_relay exploit; + * Added support to read and write (upload) both text and binary files on + the database server underlying file system for MySQL, PostgreSQL and + Microsoft SQL Server; + * Added database process' user privilege escalation via Windows Access + Tokens kidnapping on MySQL and Microsoft SQL Server via either + Meterpreter's incognito extension or Churrasco stand-alone executable; + * Speed up the inference algorithm by providing the minimum required + charset for the query output; * Major bug fix in the comparison algorithm to correctly handle also the case that the url is stable and the False response changes the page - content very little. + content very little; + * Many minor bug fixes, minor enhancements and layout adjustments. - -- Bernardo Damele A. G. Day, DD MMM 2009 HH:MM:SS +0000 + -- Bernardo Damele A. G. Wed, 22 Apr 2009 10:30:00 +0000 sqlmap (0.6.4-1) stable; urgency=low diff --git a/doc/README.html b/doc/README.html index 497abee0b..43f0bd3b7 100644 --- a/doc/README.html +++ b/doc/README.html @@ -8,7 +8,7 @@

sqlmap user's manual

by -Bernardo Damele A. G.

version 0.6.4, 3rd of February 2009 +Bernardo Damele A. G.version 0.7 release candidate 1, April 22, 2009
This document is the user's manual to use sqlmap. @@ -27,6 +27,11 @@ for the latest version.

2. Features

+

3. Download and update

@@ -52,7 +57,7 @@ for the latest version.

6. Disclaimer

-

7. Authors

+

7. Author

@@ -66,8 +71,12 @@ in web applications. Once it detects one or more SQL injections on the target host, the user can choose among a variety of options to perform an extensive back-end database management system fingerprint, retrieve DBMS session user and database, enumerate users, password hashes, privileges, -databases, dump entire or user's specific DBMS tables/columns, run his own -SQL statement, read specific files on the file system and more.

+databases, dump entire or user's specified DBMS tables/columns, run his own +SQL statement, read or write either text or binary files on the file +system, execute arbitrary commands on the operating system, establish an +out-of-band stateful connection between the attacker box and the database +server via Metasploit payload stager, database stored procedure buffer +overflow exploitation or SMB relay attack and more.

1.1 Requirements @@ -77,7 +86,7 @@ SQL statement, read specific files on the file system and more.

Python, a dynamic object-oriented interpreted programming language. This makes the tool independent from the operating system since it only -requires the Python interpreter version equal or above to 2.4. +requires the Python interpreter version equal or above to 2.5. The interpreter is freely downloadable from its official site. To make it even easier, many GNU/Linux distributions come out of the box @@ -85,6 +94,11 @@ with Python interpreter package installed and other Unices and MacOS X too provide it packaged in their formats and ready to be installed. Windows users can download and install the Python setup-ready installer for x86, AMD64 and Itanium too.

+

sqlmap relies on the +Metasploit Framework for some of its post-exploitation takeover +functionalities. You need to grab a copy of it from the +download +page. The required version is 3.2 or above.

Optionally, if you are running sqlmap on Windows, you may wish to install PyReadline library to be able to take advantage of the sqlmap TAB completion and @@ -187,10 +201,11 @@ in the following section to go ahead with the exploiting. vulnerability: