From ab64d385d6691c0674ebb393cfa1124916ffe8e3 Mon Sep 17 00:00:00 2001 From: Miroslav Stampar Date: Wed, 25 Dec 2013 22:18:57 +0100 Subject: [PATCH] Bug fix (stacked queries as in PgSQL and MsSQL DNS tunneling queries MUST end with the comment - not the recognized underlying technique's suffix) --- lib/techniques/dns/use.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/techniques/dns/use.py b/lib/techniques/dns/use.py index 6f0bbc510..f1963771b 100644 --- a/lib/techniques/dns/use.py +++ b/lib/techniques/dns/use.py @@ -70,7 +70,7 @@ def dnsUse(payload, expression): if Backend.getIdentifiedDbms() in (DBMS.MSSQL, DBMS.PGSQL): query = agent.prefixQuery("; %s" % expressionUnescaped) - query = agent.suffixQuery(query) + query = "%s%s" % (query, queries[Backend.getIdentifiedDbms()].comment.query) forgedPayload = agent.payload(newValue=query) else: forgedPayload = safeStringFormat(payload, (expressionUnescaped, randomInt(1), randomInt(3)))