diff --git a/lib/core/dump.py b/lib/core/dump.py index dd486a754..318639ccd 100644 --- a/lib/core/dump.py +++ b/lib/core/dump.py @@ -125,15 +125,21 @@ class Dump: for user in users: settings = userSettings[user] - if user in self.__areAdmins: - self.__write("[*] %s (administrator) [%d]:" % (user, len(settings))) + if settings is None: + stringSettings = "" else: - self.__write("[*] %s [%d]:" % (user, len(settings))) + stringSettings = " [%d]:" % len(settings) - settings.sort() + if user in self.__areAdmins: + self.__write("[*] %s (administrator)%s" % (user, stringSettings)) + else: + self.__write("[*] %s%s" % (user, stringSettings)) - for setting in settings: - self.__write(" %s: %s" % (subHeader, setting)) + if settings: + settings.sort() + + for setting in settings: + self.__write(" %s: %s" % (subHeader, setting)) print def dbs(self,dbs): diff --git a/plugins/dbms/mssqlserver/enumeration.py b/plugins/dbms/mssqlserver/enumeration.py index 920ad9efa..f2d31d4dc 100644 --- a/plugins/dbms/mssqlserver/enumeration.py +++ b/plugins/dbms/mssqlserver/enumeration.py @@ -29,11 +29,33 @@ class Enumeration(GenericEnumeration): GenericEnumeration.__init__(self) def getPrivileges(self, *args): - warnMsg = "on Microsoft SQL Server it is not possible to fetch " - warnMsg += "database users privileges" + warnMsg = "on Microsoft SQL Server it is not possible to fetch " + warnMsg += "database users privileges, sqlmap will check whether " + warnMsg += "or not the database users are database administrators" logger.warn(warnMsg) - return {} + users = [] + areAdmins = set() + + if conf.user: + users = [ conf.user ] + elif not len(kb.data.cachedUsers): + users = self.getUsers() + else: + users = kb.data.cachedUsers + + for user in users: + if user is None: + continue + + isDba = self.isDba(user) + + if isDba is True: + areAdmins.add(user) + + kb.data.cachedUsersPrivileges[user] = None + + return ( kb.data.cachedUsersPrivileges, areAdmins ) def getTables(self): infoMsg = "fetching tables" diff --git a/plugins/generic/enumeration.py b/plugins/generic/enumeration.py index f2bdc19d0..4998bd2ae 100644 --- a/plugins/generic/enumeration.py +++ b/plugins/generic/enumeration.py @@ -126,21 +126,25 @@ class Enumeration: return kb.data.currentDb - def isDba(self): + def isDba(self, user=None): infoMsg = "testing if current user is DBA" logger.info(infoMsg) if Backend.getIdentifiedDbms() == DBMS.MYSQL: self.getCurrentUser() query = queries[Backend.getIdentifiedDbms()].is_dba.query % kb.data.currentUser.split("@")[0] + elif Backend.getIdentifiedDbms() == DBMS.MSSQL and user is not None: + query = queries[Backend.getIdentifiedDbms()].is_dba.query2 % user else: query = queries[Backend.getIdentifiedDbms()].is_dba.query query = agent.forgeCaseStatement(query) + isDba = inject.getValue(query, unpack=False, charsetType=1) - kb.data.isDba = inject.getValue(query, unpack=False, charsetType=1) + if user is None: + kb.data.isDba = isDba - return kb.data.isDba == "1" + return isDba == "1" def getUsers(self): infoMsg = "fetching database users"