#!/usr/bin/env python """ Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) See the file 'LICENSE' for copying permission """ try: import _mssql import pymssql except: pass import logging from lib.core.common import getSafeExString from lib.core.convert import getText from lib.core.data import conf from lib.core.data import logger from lib.core.exception import SqlmapConnectionException from plugins.generic.connector import Connector as GenericConnector class Connector(GenericConnector): """ Homepage: http://pymssql.sourceforge.net/ User guide: http://pymssql.sourceforge.net/examples_pymssql.php API: http://pymssql.sourceforge.net/ref_pymssql.php Debian package: python-pymssql License: LGPL Possible connectors: http://wiki.python.org/moin/SQL%20Server Important note: pymssql library on your system MUST be version 1.0.2 to work, get it from http://sourceforge.net/projects/pymssql/files/pymssql/1.0.2/ """ def connect(self): self.initConnection() try: self.connector = pymssql.connect(host="%s:%d" % (self.hostname, self.port), user=self.user, password=self.password, database=self.db, login_timeout=conf.timeout, timeout=conf.timeout) except (pymssql.Error, _mssql.MssqlDatabaseException) as ex: raise SqlmapConnectionException(ex) except ValueError: raise SqlmapConnectionException self.initCursor() self.printConnected() def fetchall(self): try: return self.cursor.fetchall() except (pymssql.Error, _mssql.MssqlDatabaseException) as ex: logger.log(logging.WARN if conf.dbmsHandler else logging.DEBUG, "(remote) '%s'" % getSafeExString(ex).replace("\n", " ")) return None def execute(self, query, commit=True): retVal = False try: self.cursor.execute(getText(query)) # Commit non-SELECT (DML/DDL) here: direct() routes those to execute() alone, so without this a # '--sql-query'/'--sql-shell' write was silently rolled back on connection close. select() passes # commit=False and commits only AFTER fetchall(), because on pymssql commit() discards the open # result cursor (which otherwise emptied every SELECT result). if commit: try: self.connector.commit() except pymssql.OperationalError: pass retVal = True except (pymssql.OperationalError, pymssql.ProgrammingError) as ex: logger.log(logging.WARN if conf.dbmsHandler else logging.DEBUG, "(remote) '%s'" % getSafeExString(ex).replace("\n", " ")) except pymssql.InternalError as ex: raise SqlmapConnectionException(getSafeExString(ex)) return retVal def select(self, query): retVal = None if self.execute(query, commit=False): retVal = self.fetchall() try: self.connector.commit() except pymssql.OperationalError: pass return retVal