Skip to content

Commit 48cc87f

Browse files
stamparmstamparm
committed
added support for fingerprinting SAP MaxDB (Issue 143)
1 parent 7a7938a commit 48cc87f

File tree

13 files changed

+481
-22
lines changed

13 files changed

+481
-22
lines changed

‎lib/controller/handler.py‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@
3232
from lib.core.settings import SQLITE_ALIASES
3333
from lib.core.settings import ACCESS_ALIASES
3434
from lib.core.settings import FIREBIRD_ALIASES
35+
from lib.core.settings import MAXDB_ALIASES
3536

3637
from plugins.dbms.mssqlserver import MSSQLServerMap
3738
from plugins.dbms.mssqlserver.connector import Connector as MSSQLServerConn
@@ -47,6 +48,8 @@
4748
from plugins.dbms.access.connector import Connector as AccessConn
4849
from plugins.dbms.firebird import FirebirdMap
4950
from plugins.dbms.firebird.connector import Connector as FirebirdConn
51+
from plugins.dbms.maxdb import MaxDBMap
52+
from plugins.dbms.maxdb.connector import Connector as MaxDBConn
5053

5154
def setHandler():
5255
"""
@@ -55,7 +58,7 @@ def setHandler():
5558
"""
5659

5760
count = 0
58-
dbmsNames = ( "MySQL", "Oracle", "PostgreSQL", "Microsoft SQL Server", "SQLite", "Microsoft Access", "Firebird" )
61+
dbmsNames = ( "MySQL", "Oracle", "PostgreSQL", "Microsoft SQL Server", "SQLite", "Microsoft Access", "Firebird", "SAP MaxDB" )
5962
dbmsMap = (
6063
( MYSQL_ALIASES, MySQLMap, MySQLConn ),
6164
( ORACLE_ALIASES, OracleMap, OracleConn ),
@@ -64,6 +67,7 @@ def setHandler():
6467
( SQLITE_ALIASES, SQLiteMap, SQLiteConn ),
6568
( ACCESS_ALIASES, AccessMap, AccessConn ),
6669
( FIREBIRD_ALIASES, FirebirdMap, FirebirdConn ),
70+
( MAXDB_ALIASES, MaxDBMap, MaxDBConn ),
6771
)
6872

6973
for dbmsAliases, dbmsMap, dbmsConn in dbmsMap:

‎lib/core/common.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -164,7 +164,7 @@ def formatDBMSfp(versions=None):
164164
while versions and None in versions:
165165
versions.remove(None)
166166

167-
if not versions and kb.dbmsVersion and kb.dbmsVersion[0] != "Unknown":
167+
if not versions and kb.dbmsVersion and kb.dbmsVersion[0] != "Unknown" and kb.dbmsVersion[0] != None:
168168
versions = kb.dbmsVersion
169169

170170
if isinstance(versions, basestring):

‎lib/core/settings.py‎

Lines changed: 16 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -57,10 +57,10 @@
5757
MSSQL_VERSIONS_URL = "http://www.sqlsecurity.com/FAQs/SQLServerVersionDatabase/tabid/63/Default.aspx"
5858

5959
# Database management system specific variables
60-
MSSQL_SYSTEM_DBS = ( "Northwind", "model", "msdb", "pubs", "tempdb" )
61-
MYSQL_SYSTEM_DBS = ( "information_schema", "mysql" ) # Before MySQL 5.0 only "mysql"
62-
PGSQL_SYSTEM_DBS = ( "information_schema", "pg_catalog", "pg_toast" )
63-
ORACLE_SYSTEM_DBS = ( "SYSTEM", "SYSAUX" ) # These are TABLESPACE_NAME
60+
MSSQL_SYSTEM_DBS = ( "Northwind", "model", "msdb", "pubs", "tempdb" )
61+
MYSQL_SYSTEM_DBS = ( "information_schema", "mysql" ) # Before MySQL 5.0 only "mysql"
62+
PGSQL_SYSTEM_DBS = ( "information_schema", "pg_catalog", "pg_toast" )
63+
ORACLE_SYSTEM_DBS = ( "SYSTEM", "SYSAUX" ) # These are TABLESPACE_NAME
6464
SQLITE_SYSTEM_DBS = ( "sqlite_master", "sqlite_temp_master" )
6565
ACCESS_SYSTEM_DBS = ( "MSysAccessObjects", "MSysACEs", "MSysObjects", "MSysQueries", "MSysRelationships", "MSysAccessStorage",\
6666
"MSysAccessXML", "MSysModules", "MSysModules2" )
@@ -70,19 +70,21 @@
7070
"RDB$LOG_FILES", "RDB$PAGES", "RDB$PROCEDURES", "RDB$PROCEDURE_PARAMETERS", "RDB$REF_CONSTRAINTS", "RDB$RELATIONS",\
7171
"RDB$RELATION_CONSTRAINTS", "RDB$RELATION_FIELDS", "RDB$ROLES", "RDB$SECURITY_CLASSES", "RDB$TRANSACTIONS", "RDB$TRIGGERS",\
7272
"RDB$TRIGGER_MESSAGES", "RDB$TYPES", "RDB$USER_PRIVILEGES", "RDB$VIEW_RELATIONS" )
73+
MAXDB_SYSTEM_DBS = ( "SYSINFO", "DOMAIN" )
7374

74-
MSSQL_ALIASES = [ "microsoft sql server", "mssqlserver", "mssql", "ms" ]
75-
MYSQL_ALIASES = [ "mysql", "my" ]
76-
PGSQL_ALIASES = [ "postgresql", "postgres", "pgsql", "psql", "pg" ]
77-
ORACLE_ALIASES = [ "oracle", "orcl", "ora", "or" ]
78-
SQLITE_ALIASES = [ "sqlite", "sqlite3" ]
79-
ACCESS_ALIASES = [ "access", "jet", "microsoft access", "msaccess" ]
80-
FIREBIRD_ALIASES = [ "firebird", "mozilla firebird", "interbase", "ibase", "fb" ]
75+
MSSQL_ALIASES = [ "microsoft sql server", "mssqlserver", "mssql", "ms" ]
76+
MYSQL_ALIASES = [ "mysql", "my" ]
77+
PGSQL_ALIASES = [ "postgresql", "postgres", "pgsql", "psql", "pg" ]
78+
ORACLE_ALIASES = [ "oracle", "orcl", "ora", "or" ]
79+
SQLITE_ALIASES = [ "sqlite", "sqlite3" ]
80+
ACCESS_ALIASES = [ "access", "jet", "microsoft access", "msaccess" ]
81+
FIREBIRD_ALIASES = [ "firebird", "mozilla firebird", "interbase", "ibase", "fb" ]
82+
MAXDB_ALIASES = [ "maxdb", "sap maxdb", "sap db" ]
8183

82-
SUPPORTED_DBMS = MSSQL_ALIASES + MYSQL_ALIASES + PGSQL_ALIASES + ORACLE_ALIASES + SQLITE_ALIASES + ACCESS_ALIASES + FIREBIRD_ALIASES
83-
SUPPORTED_OS = ( "linux", "windows" )
84+
SUPPORTED_DBMS = MSSQL_ALIASES + MYSQL_ALIASES + PGSQL_ALIASES + ORACLE_ALIASES + SQLITE_ALIASES + ACCESS_ALIASES + FIREBIRD_ALIASES + MAXDB_ALIASES
85+
SUPPORTED_OS = ( "linux", "windows" )
8486

85-
SQL_STATEMENTS = {
87+
SQL_STATEMENTS = {
8688
"SQL SELECT statement": (
8789
"select ",
8890
"show ",

‎plugins/dbms/firebird/fingerprint.py‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -91,7 +91,7 @@ def __sysTablesCheck(self):
9191
("2.0", [" AND EXISTS(SELECT CURRENT_TIME(0) FROM RDB$DATABASE)", " AND BIT_LENGTH(%d)>0", " AND CHAR_LENGTH(%d)>0"]),
9292
("2.1", [" AND BIN_XOR(%d,%d)=0", " AND PI()>0.%d", " AND RAND()<1.%d", " AND FLOOR(1.%d)>=0"])
9393
)
94-
94+
9595
for i in xrange(len(table)):
9696
version, checks = table[i]
9797
failed = False
@@ -105,7 +105,7 @@ def __sysTablesCheck(self):
105105
break
106106
if failed:
107107
break
108-
108+
109109
return retVal
110110

111111
def __dialectCheck(self):
@@ -115,7 +115,7 @@ def __dialectCheck(self):
115115
result = Request.queryPage(payload)
116116
retVal = "dialect 3" if result else "dialect 1"
117117
return retVal
118-
118+
119119
def checkDbms(self):
120120
if conf.dbms in FIREBIRD_ALIASES:
121121
setDbms("Firebird")
@@ -127,7 +127,7 @@ def checkDbms(self):
127127

128128
logMsg = "testing Firebird"
129129
logger.info(logMsg)
130-
130+
131131
randInt = randomInt()
132132

133133
payload = agent.fullPayload(" AND EXISTS(SELECT * FROM RDB$DATABASE WHERE %d=%d)" % (randInt, randInt))

‎plugins/dbms/maxdb/__init__.py‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
#!/usr/bin/env python
2+
3+
"""
4+
$Id$
5+
6+
This file is part of the sqlmap project, http://sqlmap.sourceforge.net.
7+
8+
Copyright (c) 2007-2009 Bernardo Damele A. G. <bernardo.damele@gmail.com>
9+
Copyright (c) 2006 Daniele Bellucci <daniele.bellucci@gmail.com>
10+
11+
sqlmap is free software; you can redistribute it and/or modify it under
12+
the terms of the GNU General Public License as published by the Free
13+
Software Foundation version 2 of the License.
14+
15+
sqlmap is distributed in the hope that it will be useful, but WITHOUT ANY
16+
WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
17+
FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
18+
details.
19+
20+
You should have received a copy of the GNU General Public License along
21+
with sqlmap; if not, write to the Free Software Foundation, Inc., 51
22+
Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
23+
"""
24+
25+
from lib.core.settings import MAXDB_SYSTEM_DBS
26+
from lib.core.unescaper import unescaper
27+
28+
from plugins.dbms.maxdb.enumeration import Enumeration
29+
from plugins.dbms.maxdb.filesystem import Filesystem
30+
from plugins.dbms.maxdb.fingerprint import Fingerprint
31+
from plugins.dbms.maxdb.syntax import Syntax
32+
from plugins.dbms.maxdb.takeover import Takeover
33+
from plugins.generic.misc import Miscellaneous
34+
35+
class MaxDBMap(Syntax, Fingerprint, Enumeration, Filesystem, Miscellaneous, Takeover):
36+
"""
37+
This class defines SAP MaxDB methods
38+
"""
39+
40+
def __init__(self):
41+
self.excludeDbsList = MAXDB_SYSTEM_DBS
42+
43+
Syntax.__init__(self)
44+
Fingerprint.__init__(self)
45+
Enumeration.__init__(self)
46+
Filesystem.__init__(self)
47+
Miscellaneous.__init__(self)
48+
Takeover.__init__(self)
49+
50+
unescaper.setUnescape(MaxDBMap.unescape)

‎plugins/dbms/maxdb/connector.py‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
#!/usr/bin/env python
2+
3+
"""
4+
$Id$
5+
6+
This file is part of the sqlmap project, http://sqlmap.sourceforge.net.
7+
8+
Copyright (c) 2007-2010 Bernardo Damele A. G. <bernardo.damele@gmail.com>
9+
Copyright (c) 2006 Daniele Bellucci <daniele.bellucci@gmail.com>
10+
11+
sqlmap is free software; you can redistribute it and/or modify it under
12+
the terms of the GNU General Public License as published by the Free
13+
Software Foundation version 2 of the License.
14+
15+
sqlmap is distributed in the hope that it will be useful, but WITHOUT ANY
16+
WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
17+
FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
18+
details.
19+
20+
You should have received a copy of the GNU General Public License along
21+
with sqlmap; if not, write to the Free Software Foundation, Inc., 51
22+
Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
23+
"""
24+
25+
from lib.core.exception import sqlmapUnsupportedFeatureException
26+
27+
from plugins.generic.connector import Connector as GenericConnector
28+
29+
class Connector(GenericConnector):
30+
def __init__(self):
31+
GenericConnector.__init__(self)
32+
33+
def connect(self):
34+
errMsg = "on SAP MaxDB it is not possible to establish an "
35+
errMsg += "direct connection"
36+
raise sqlmapUnsupportedFeatureException, errMsg

‎plugins/dbms/maxdb/enumeration.py‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
#!/usr/bin/env python
2+
3+
"""
4+
$Id$
5+
6+
This file is part of the sqlmap project, http://sqlmap.sourceforge.net.
7+
8+
Copyright (c) 2007-2010 Bernardo Damele A. G. <bernardo.damele@gmail.com>
9+
Copyright (c) 2006 Daniele Bellucci <daniele.bellucci@gmail.com>
10+
11+
sqlmap is free software; you can redistribute it and/or modify it under
12+
the terms of the GNU General Public License as published by the Free
13+
Software Foundation version 2 of the License.
14+
15+
sqlmap is distributed in the hope that it will be useful, but WITHOUT ANY
16+
WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
17+
FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
18+
details.
19+
20+
You should have received a copy of the GNU General Public License along
21+
with sqlmap; if not, write to the Free Software Foundation, Inc., 51
22+
Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
23+
"""
24+
25+
from plugins.generic.enumeration import Enumeration as GenericEnumeration
26+
27+
class Enumeration(GenericEnumeration):
28+
def __init__(self):
29+
GenericEnumeration.__init__(self, "SAP MaxDB")
30+
31+
def getDbs(self):
32+
warnMsg = "on SAP MaxDB it is not possible to enumerate databases"
33+
logger.warn(warnMsg)
34+
35+
return []
36+
37+
def getBanner(self):
38+
warnMsg = "on SAP MaxDB it is not possible to get a banner"
39+
logger.warn(warnMsg)
40+
41+
return None
42+
43+
def getPasswordHashes(self):
44+
warnMsg = "on SAP MaxDB it is not possible to enumerate the user password hashes"
45+
logger.warn(warnMsg)
46+
47+
return {}
48+
49+
def searchDb(self):
50+
warnMsg = "on SAP MaxDB it is not possible to search databases"
51+
logger.warn(warnMsg)
52+
53+
return []

‎plugins/dbms/maxdb/filesystem.py‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
#!/usr/bin/env python
2+
3+
"""
4+
$Id$
5+
6+
This file is part of the sqlmap project, http://sqlmap.sourceforge.net.
7+
8+
Copyright (c) 2007-2010 Bernardo Damele A. G. <bernardo.damele@gmail.com>
9+
Copyright (c) 2006 Daniele Bellucci <daniele.bellucci@gmail.com>
10+
11+
sqlmap is free software; you can redistribute it and/or modify it under
12+
the terms of the GNU General Public License as published by the Free
13+
Software Foundation version 2 of the License.
14+
15+
sqlmap is distributed in the hope that it will be useful, but WITHOUT ANY
16+
WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
17+
FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
18+
details.
19+
20+
You should have received a copy of the GNU General Public License along
21+
with sqlmap; if not, write to the Free Software Foundation, Inc., 51
22+
Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
23+
"""
24+
25+
from lib.core.exception import sqlmapUnsupportedFeatureException
26+
27+
from plugins.generic.filesystem import Filesystem as GenericFilesystem
28+
29+
class Filesystem(GenericFilesystem):
30+
def __init__(self):
31+
GenericFilesystem.__init__(self)
32+
33+
def readFile(self, rFile):
34+
errMsg = "on SAP MaxDB reading of files is not supported"
35+
raise sqlmapUnsupportedFeatureException, errMsg
36+
37+
def writeFile(self, wFile, dFile, fileType=None, confirm=True):
38+
errMsg = "on SAP MaxDB writing of files is not supported"
39+
raise sqlmapUnsupportedFeatureException, errMsg

0 commit comments

Comments
 (0)