Skip to content

Commit 1f49e4a

Browse files
stamparmstamparm
committed
Fix for an Issue sqlmapproject#179 
1 parent 9a63133 commit 1f49e4a

File tree

4 files changed

+15
-134
lines changed

4 files changed

+15
-134
lines changed

‎plugins/dbms/maxdb/enumeration.py

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@
1616
from lib.core.exception import sqlmapMissingMandatoryOptionException
1717
from lib.core.exception import sqlmapNoneDataException
1818
from lib.core.settings import CURRENT_DB
19+
from lib.utils.pivotdumptable import pivotDumpTable
1920
from plugins.generic.enumeration import Enumeration as GenericEnumeration
2021

2122
class Enumeration(GenericEnumeration):
@@ -40,7 +41,7 @@ def getDbs(self):
4041
rootQuery = queries[Backend.getIdentifiedDbms()].dbs
4142
randStr = randomStr()
4243
query = rootQuery.inband.query
43-
retVal = self.__pivotDumpTable("(%s) AS %s" % (query, randStr), ['%s.schemaname' % randStr], blind=True)
44+
retVal = pivotDumpTable("(%s) AS %s" % (query, randStr), ['%s.schemaname' % randStr], blind=True)
4445

4546
if retVal:
4647
kb.data.cachedDbs = retVal[0].values()[0]
@@ -76,7 +77,7 @@ def getTables(self, bruteForce=None):
7677
for db in dbs:
7778
randStr = randomStr()
7879
query = rootQuery.inband.query % (("'%s'" % db) if db != "USER" else 'USER')
79-
retVal = self.__pivotDumpTable("(%s) AS %s" % (query, randStr), ['%s.tablename' % randStr], blind=True)
80+
retVal = pivotDumpTable("(%s) AS %s" % (query, randStr), ['%s.tablename' % randStr], blind=True)
8081

8182
if retVal:
8283
for table in retVal[0].values()[0]:
@@ -147,7 +148,7 @@ def getColumns(self, onlyColNames=False):
147148

148149
randStr = randomStr()
149150
query = rootQuery.inband.query % (unsafeSQLIdentificatorNaming(tbl), ("'%s'" % unsafeSQLIdentificatorNaming(conf.db)) if unsafeSQLIdentificatorNaming(conf.db) != "USER" else 'USER')
150-
retVal = self.__pivotDumpTable("(%s) AS %s" % (query, randStr), ['%s.columnname' % randStr,'%s.datatype' % randStr,'%s.len' % randStr], blind=True)
151+
retVal = pivotDumpTable("(%s) AS %s" % (query, randStr), ['%s.columnname' % randStr,'%s.datatype' % randStr,'%s.len' % randStr], blind=True)
151152

152153
if retVal:
153154
table = {}

‎plugins/dbms/sybase/enumeration.py

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@
2020
from lib.core.exception import sqlmapMissingMandatoryOptionException
2121
from lib.core.exception import sqlmapNoneDataException
2222
from lib.core.settings import CURRENT_DB
23+
from lib.utils.pivotdumptable import pivotDumpTable
2324
from plugins.generic.enumeration import Enumeration as GenericEnumeration
2425

2526
class Enumeration(GenericEnumeration):
@@ -41,7 +42,7 @@ def getUsers(self):
4142
blinds = (True,)
4243

4344
for blind in blinds:
44-
retVal = self.__pivotDumpTable("(%s) AS %s" % (query, randStr), ['%s.name' % randStr], blind=blind)
45+
retVal = pivotDumpTable("(%s) AS %s" % (query, randStr), ['%s.name' % randStr], blind=blind)
4546

4647
if retVal:
4748
kb.data.cachedUsers = retVal[0].values()[0]
@@ -95,7 +96,7 @@ def getDbs(self):
9596
blinds = [True]
9697

9798
for blind in blinds:
98-
retVal = self.__pivotDumpTable("(%s) AS %s" % (query, randStr), ['%s.name' % randStr], blind=blind)
99+
retVal = pivotDumpTable("(%s) AS %s" % (query, randStr), ['%s.name' % randStr], blind=blind)
99100

100101
if retVal:
101102
kb.data.cachedDbs = retVal[0].values()[0]
@@ -140,7 +141,7 @@ def getTables(self, bruteForce=None):
140141
for blind in blinds:
141142
randStr = randomStr()
142143
query = rootQuery.inband.query % db
143-
retVal = self.__pivotDumpTable("(%s) AS %s" % (query, randStr), ['%s.name' % randStr], blind=blind)
144+
retVal = pivotDumpTable("(%s) AS %s" % (query, randStr), ['%s.name' % randStr], blind=blind)
144145

145146
if retVal:
146147
for table in retVal[0].values()[0]:
@@ -232,7 +233,7 @@ def getColumns(self, onlyColNames=False):
232233
for blind in blinds:
233234
randStr = randomStr()
234235
query = rootQuery.inband.query % (conf.db, conf.db, conf.db, conf.db, conf.db, conf.db, conf.db, unsafeSQLIdentificatorNaming(tbl))
235-
retVal = self.__pivotDumpTable("(%s) AS %s" % (query, randStr), ['%s.name' % randStr,'%s.usertype' % randStr], blind=blind)
236+
retVal = pivotDumpTable("(%s) AS %s" % (query, randStr), ['%s.name' % randStr,'%s.usertype' % randStr], blind=blind)
236237

237238
if retVal:
238239
table = {}

‎plugins/generic/entries.py

Lines changed: 3 additions & 125 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,7 @@
4242
from lib.core.settings import NULL
4343
from lib.request import inject
4444
from lib.utils.hash import attackDumpedTable
45+
from lib.utils.pivotdumptable import pivotDumpTable
4546

4647
class Entries:
4748
"""
@@ -51,129 +52,6 @@ class Entries:
5152
def __init__(self):
5253
pass
5354

54-
def __pivotDumpTable(self, table, colList, count=None, blind=True):
55-
lengths = {}
56-
entries = {}
57-
58-
dumpNode = queries[Backend.getIdentifiedDbms()].dump_table.blind
59-
60-
validColumnList = False
61-
validPivotValue = False
62-
63-
if count is None:
64-
query = dumpNode.count % table
65-
count = inject.getValue(query, inband=False, error=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS) if blind else inject.getValue(query, blind=False, expected=EXPECTED.INT)
66-
67-
if isinstance(count, basestring) and count.isdigit():
68-
count = int(count)
69-
70-
if count == 0:
71-
infoMsg = "table '%s' appears to be empty" % unsafeSQLIdentificatorNaming(table)
72-
logger.info(infoMsg)
73-
74-
for column in colList:
75-
lengths[column] = len(column)
76-
entries[column] = []
77-
78-
return entries, lengths
79-
80-
elif not isNumPosStrValue(count):
81-
return None
82-
83-
for column in colList:
84-
lengths[column] = 0
85-
entries[column] = BigArray()
86-
87-
colList = filter(None, sorted(colList, key=lambda x: len(x) if x else MAX_INT))
88-
89-
for column in colList:
90-
infoMsg = "fetching number of distinct "
91-
infoMsg += "values for column '%s'" % column
92-
logger.info(infoMsg)
93-
94-
query = dumpNode.count2 % (column, table)
95-
value = inject.getValue(query, blind=blind, inband=not blind, error=not blind, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS)
96-
97-
if isNumPosStrValue(value):
98-
validColumnList = True
99-
100-
if value == count:
101-
infoMsg = "using column '%s' as a pivot " % column
102-
infoMsg += "for retrieving row data"
103-
logger.info(infoMsg)
104-
105-
validPivotValue = True
106-
107-
colList.remove(column)
108-
colList.insert(0, column)
109-
break
110-
111-
if not validColumnList:
112-
errMsg = "all column name(s) provided are non-existent"
113-
raise sqlmapNoneDataException, errMsg
114-
115-
if not validPivotValue:
116-
warnMsg = "no proper pivot column provided (with unique values)."
117-
warnMsg += " It won't be possible to retrieve all rows"
118-
logger.warn(warnMsg)
119-
120-
pivotValue = " "
121-
breakRetrieval = False
122-
123-
try:
124-
for i in xrange(count):
125-
if breakRetrieval:
126-
break
127-
128-
for column in colList:
129-
# Correction for pivotValues with unrecognized/problematic chars
130-
for char in ('\'', '?'):
131-
if pivotValue and char in pivotValue and pivotValue[0] != char:
132-
pivotValue = pivotValue.split(char)[0]
133-
pivotValue = pivotValue[:-1] + decodeIntToUnicode(ord(pivotValue[-1]) + 1)
134-
break
135-
if column == colList[0]:
136-
query = dumpNode.query % (column, table, column, pivotValue)
137-
else:
138-
query = dumpNode.query2 % (column, table, colList[0], pivotValue)
139-
140-
value = inject.getValue(query, blind=blind, inband=not blind, error=not blind)
141-
142-
if column == colList[0]:
143-
if isNoneValue(value):
144-
breakRetrieval = True
145-
break
146-
else:
147-
pivotValue = safechardecode(value)
148-
149-
if conf.limitStart or conf.limitStop:
150-
if conf.limitStart and (i + 1) < conf.limitStart:
151-
warnMsg = "skipping first %d pivot " % conf.limitStart
152-
warnMsg += "point values"
153-
singleTimeWarnMessage(warnMsg)
154-
break
155-
elif conf.limitStop and (i + 1) > conf.limitStop:
156-
breakRetrieval = True
157-
break
158-
159-
value = "" if isNoneValue(value) else unArrayizeValue(value)
160-
161-
lengths[column] = max(lengths[column], len(value) if value else 0)
162-
entries[column].append(value)
163-
164-
except KeyboardInterrupt:
165-
warnMsg = "user aborted during enumeration. sqlmap "
166-
warnMsg += "will display partial output"
167-
logger.warn(warnMsg)
168-
169-
except sqlmapConnectionException, e:
170-
errMsg = "connection exception detected. sqlmap "
171-
errMsg += "will display partial output"
172-
errMsg += "'%s'" % e
173-
logger.critical(errMsg)
174-
175-
return entries, lengths
176-
17755
def dumpTable(self, foundData=None):
17856
self.forceDbmsEnum()
17957

@@ -269,7 +147,7 @@ def dumpTable(self, foundData=None):
269147
if not (isTechniqueAvailable(PAYLOAD.TECHNIQUE.UNION) and kb.injection.data[PAYLOAD.TECHNIQUE.UNION].where == PAYLOAD.WHERE.ORIGINAL):
270148
table = "%s.%s" % (conf.db, tbl)
271149

272-
retVal = self.__pivotDumpTable(table, colList, blind=False)
150+
retVal = pivotDumpTable(table, colList, blind=False)
273151

274152
if retVal:
275153
entries, _ = retVal
@@ -365,7 +243,7 @@ def dumpTable(self, foundData=None):
365243
elif Backend.isDbms(DBMS.MAXDB):
366244
table = "%s.%s" % (conf.db, tbl)
367245

368-
retVal = self.__pivotDumpTable(table, colList, count, blind=True)
246+
retVal = pivotDumpTable(table, colList, count, blind=True)
369247

370248
if retVal:
371249
entries, lengths = retVal

‎plugins/generic/users.py

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,7 @@
3939
from lib.core.threads import getCurrentThreadData
4040
from lib.request import inject
4141
from lib.utils.hash import attackCachedUsersPasswords
42+
from lib.utils.pivotdumptable import pivotDumpTable
4243

4344
class Users:
4445
"""
@@ -179,7 +180,7 @@ def getPasswordHashes(self):
179180
randStr = randomStr()
180181
getCurrentThreadData().disableStdOut = True
181182

182-
retVal = self.__pivotDumpTable("(%s) AS %s" % (query, randStr), ['%s.name' % randStr, '%s.password' % randStr], blind=False)
183+
retVal = pivotDumpTable("(%s) AS %s" % (query, randStr), ['%s.name' % randStr, '%s.password' % randStr], blind=False)
183184

184185
if retVal:
185186
for user, password in filterPairValues(zip(retVal[0]["%s.name" % randStr], retVal[0]["%s.password" % randStr])):
@@ -221,7 +222,7 @@ def getPasswordHashes(self):
221222
randStr = randomStr()
222223
query = rootQuery.inband.query
223224

224-
retVal = self.__pivotDumpTable("(%s) AS %s" % (query, randStr), ['%s.name' % randStr, '%s.password' % randStr], blind=True)
225+
retVal = pivotDumpTable("(%s) AS %s" % (query, randStr), ['%s.name' % randStr, '%s.password' % randStr], blind=True)
225226

226227
if retVal:
227228
for user, password in filterPairValues(zip(retVal[0]["%s.name" % randStr], retVal[0]["%s.password" % randStr])):

0 commit comments

Comments
 (0)