From ebd40b3933a9e3a8fa617b79ed473133556aec4f Mon Sep 17 00:00:00 2001 From: Bernardo Damele Date: Fri, 17 Feb 2012 15:16:05 +0000 Subject: [PATCH] Minor bug fix to make --file-read and --os-bof syntactically work also with -d (direct connection) --- plugins/dbms/mssqlserver/filesystem.py | 3 +-- plugins/dbms/mssqlserver/takeover.py | 3 +-- 2 files changed, 2 insertions(+), 4 deletions(-) diff --git a/plugins/dbms/mssqlserver/filesystem.py b/plugins/dbms/mssqlserver/filesystem.py index f27de444c..c0ce6ea21 100644 --- a/plugins/dbms/mssqlserver/filesystem.py +++ b/plugins/dbms/mssqlserver/filesystem.py @@ -51,8 +51,7 @@ class Filesystem(GenericFilesystem): inject.goStacked("BULK INSERT %s FROM '%s' WITH (CODEPAGE='RAW', FIELDTERMINATOR='%s', ROWTERMINATOR='%s')" % (txtTbl, rFile, randomStr(10), randomStr(10)), silent=True) # Reference: http://support.microsoft.com/kb/104829 - binToHexQuery = """ - DECLARE @charset VARCHAR(16) + binToHexQuery = """DECLARE @charset VARCHAR(16) DECLARE @counter INT DECLARE @hexstr VARCHAR(4096) DECLARE @length INT diff --git a/plugins/dbms/mssqlserver/takeover.py b/plugins/dbms/mssqlserver/takeover.py index bb7ef9eae..7d5e8ced4 100644 --- a/plugins/dbms/mssqlserver/takeover.py +++ b/plugins/dbms/mssqlserver/takeover.py @@ -76,8 +76,7 @@ class Takeover(GenericTakeover): shellcodeChar = shellcodeChar[:-1] - self.spExploit = """ - DECLARE @buf NVARCHAR(4000), + self.spExploit = """DECLARE @buf NVARCHAR(4000), @val NVARCHAR(4), @counter INT SET @buf = '