sqlmapproject/sqlmap
1
1
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2025-06-07 14:43:08 +03:00
Code Issues Packages Projects Releases Wiki Activity

update regarding os shell-ing regarding JSP and ASPX

Browse Source
This commit is contained in:
Miroslav Stampar 2010-11-16 13:46:46 +00:00
parent 6232397129
commit e7a66371f8
2 changed files with 24 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
lib/core/common.py
View File

@ -304,7 +304,7 @@ def getDocRoot(webApi=None):
pagePath = directoryPath(conf.path) pagePath = directoryPath(conf.path)
if kb.os == "Windows": if kb.os == "Windows":
if webApi == "php": if webApi in ("php", "jsp"):
defaultDocRoot = "C:/xampp/htdocs/" defaultDocRoot = "C:/xampp/htdocs/"
else: else:
defaultDocRoot = "C:/Inetpub/wwwroot/" defaultDocRoot = "C:/Inetpub/wwwroot/"
@ -361,7 +361,7 @@ def getDirs(webApi=None):
directories = set() directories = set()
if kb.os == "Windows": if kb.os == "Windows":
if webApi == "php": if webApi in ("php", "jsp"):
defaultDirs = ["C:/xampp/htdocs/"] defaultDirs = ["C:/xampp/htdocs/"]
else: else:
defaultDirs = ["C:/Inetpub/wwwroot/"] defaultDirs = ["C:/Inetpub/wwwroot/"]

38
lib/takeover/web.py
View File

@ -76,7 +76,7 @@ class Web:
def __webFileStreamUpload(self, stream, destFileName, directory): def __webFileStreamUpload(self, stream, destFileName, directory):
stream.seek(0) # Rewind stream.seek(0) # Rewind
if self.webApi in ("php", "asp"): if self.webApi in ("php", "asp", "aspx", "jsp"):
multipartParams = { multipartParams = {
"upload": "1", "upload": "1",
"file": stream, "file": stream,
@ -93,9 +93,6 @@ class Web:
else: else:
return True return True
elif self.webApi == "jsp":
return False
def __webFileInject(self, fileContent, fileName, directory): def __webFileInject(self, fileContent, fileName, directory):
outFile = posixpath.normpath("%s/%s" % (directory, fileName)) outFile = posixpath.normpath("%s/%s" % (directory, fileName))
uplQuery = fileContent.replace("WRITABLE_DIR", directory.replace('/', '\\') if kb.os == "Windows" else directory) uplQuery = fileContent.replace("WRITABLE_DIR", directory.replace('/', '\\') if kb.os == "Windows" else directory)
@ -124,30 +121,34 @@ class Web:
message = "which web application language does the web server " message = "which web application language does the web server "
message += "support?\n" message += "support?\n"
message += "[1] ASP%s\n" % (" (default)" if kb.os == "Windows" else "") message += "[1] ASP%s\n" % (" (default)" if kb.os == "Windows" else "")
message += "[2] PHP%s\n" % ("" if kb.os == "Windows" else " (default)") message += "[2] ASPX\n"
message += "[3] JSP" message += "[3] PHP%s\n" % ("" if kb.os == "Windows" else " (default)")
message += "[4] JSP"
while True: while True:
choice = readInput(message, default="1" if kb.os == "Windows" else "2") choice = readInput(message, default="1" if kb.os == "Windows" else "2")
if not choice or choice == "2": if choice == "1":
self.webApi = "php"
break
elif choice == "1":
self.webApi = "asp" self.webApi = "asp"
break break
elif choice == "2":
self.webApi = "aspx"
break
elif choice == "3": elif choice == "3":
errMsg = "JSP web backdoor functionality is not yet " self.webApi = "php"
errMsg += "implemented" break
raise sqlmapUnsupportedDBMSException(errMsg)
elif choice == "4":
self.webApi = "jsp"
break
elif not choice.isdigit(): elif not choice.isdigit():
logger.warn("invalid value, only digits are allowed") logger.warn("invalid value, only digits are allowed")
elif int(choice) < 1 or int(choice) > 3: elif int(choice) < 1 or int(choice) > 4:
logger.warn("invalid value, it must be 1 or 3") logger.warn("invalid value, it must be between 1 and 4")
kb.docRoot = getDocRoot(self.webApi) kb.docRoot = getDocRoot(self.webApi)
directories = getDirs(self.webApi) directories = getDirs(self.webApi)
@ -188,7 +189,12 @@ class Web:
warnMsg = "unable to upload the file stager " warnMsg = "unable to upload the file stager "
warnMsg += "on '%s'" % directory warnMsg += "on '%s'" % directory
logger.warn(warnMsg) logger.warn(warnMsg)
continue
elif "<%" in uplPage or "<?" in uplPage:
warnMsg = "file stager uploaded "
warnMsg += "on '%s' but not dynamically interpreted" % directory
logger.warn(warnMsg)
continue continue
infoMsg = "the file stager has been successfully uploaded " infoMsg = "the file stager has been successfully uploaded "