Skip to content

Commit 36afa9b

Browse files
EndikaEndika
committed
Merge pull request #14 from sqlmapproject/master
Merge
2 parents d92da7c + 7b95a2d commit 36afa9b

File tree

3 files changed

+58
-17
lines changed

3 files changed

+58
-17
lines changed

‎lib/core/agent.py‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -174,7 +174,10 @@ def _(pattern, repl, string):
174174
while True:
175175
_ = re.search(r"\\g<([^>]+)>", repl)
176176
if _:
177-
repl = repl.replace(_.group(0), match.group(int(_.group(1)) if _.group(1).isdigit() else _.group(1)))
177+
try:
178+
repl = repl.replace(_.group(0), match.group(int(_.group(1)) if _.group(1).isdigit() else _.group(1)))
179+
except IndexError:
180+
break
178181
else:
179182
break
180183
retVal = string[:match.start()] + repl + string[match.end():]
@@ -185,6 +188,7 @@ def _(pattern, repl, string):
185188
retVal = _(regex, "%s=%s" % (parameter, self.addPayloadDelimiters(newValue.replace("\\", "\\\\"))), paramString)
186189
else:
187190
retVal = _(r"(\A|\b)%s=%s(\Z|%s|%s|\s)" % (re.escape(parameter), re.escape(origValue), DEFAULT_GET_POST_DELIMITER, DEFAULT_COOKIE_DELIMITER), "%s=%s\g<2>" % (parameter, self.addPayloadDelimiters(newValue.replace("\\", "\\\\"))), paramString)
191+
188192
if retVal == paramString and urlencode(parameter) != parameter:
189193
retVal = _(r"(\A|\b)%s=%s" % (re.escape(urlencode(parameter)), re.escape(origValue)), "%s=%s" % (urlencode(parameter), self.addPayloadDelimiters(newValue.replace("\\", "\\\\"))), paramString)
190194

@@ -213,6 +217,9 @@ def prefixQuery(self, expression, prefix=None, where=None, clause=None):
213217
if conf.direct:
214218
return self.payloadDirect(expression)
215219

220+
if expression is None:
221+
return None
222+
216223
expression = self.cleanupPayload(expression)
217224
expression = unescaper.escape(expression)
218225
query = None
@@ -241,7 +248,7 @@ def prefixQuery(self, expression, prefix=None, where=None, clause=None):
241248
if not (expression and expression[0] == ';') and not (query and query[-1] in ('(', ')') and expression and expression[0] in ('(', ')')) and not (query and query[-1] == '('):
242249
query += " "
243250

244-
query = "%s%s" % (query.replace('\\', BOUNDARY_BACKSLASH_MARKER), expression)
251+
query = "%s%s" % ((query or "").replace('\\', BOUNDARY_BACKSLASH_MARKER), expression)
245252

246253
return query
247254

@@ -254,6 +261,9 @@ def suffixQuery(self, expression, comment=None, suffix=None, where=None):
254261
if conf.direct:
255262
return self.payloadDirect(expression)
256263

264+
if expression is None:
265+
return None
266+
257267
expression = self.cleanupPayload(expression)
258268

259269
# Take default values if None

‎lib/core/option.py‎

Lines changed: 24 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -289,7 +289,7 @@ def _parseBurpLog(content):
289289
line = line.strip('\r')
290290
match = re.search(r"\A(%s) (.+) HTTP/[\d.]+\Z" % "|".join(getPublicTypeMembers(HTTPMETHOD, True)), line) if not method else None
291291

292-
if len(line) == 0 and method and method != HTTPMETHOD.GET and data is None:
292+
if len(line.strip()) == 0 and method and method != HTTPMETHOD.GET and data is None:
293293
data = ""
294294
params = True
295295

@@ -766,8 +766,14 @@ def _(key, value):
766766

767767
if conf.msfPath:
768768
for path in (conf.msfPath, os.path.join(conf.msfPath, "bin")):
769-
if all(os.path.exists(normalizePath(os.path.join(path, _))) for _ in ("", "msfcli", "msfconsole", "msfencode", "msfpayload")):
769+
if all(os.path.exists(normalizePath(os.path.join(path, _))) for _ in ("", "msfcli", "msfconsole")):
770770
msfEnvPathExists = True
771+
if all(os.path.exists(normalizePath(os.path.join(path, _))) for _ in ("msfvenom",)):
772+
kb.msfVenom = True
773+
elif all(os.path.exists(normalizePath(os.path.join(path, _))) for _ in ("msfencode", "msfpayload")):
774+
kb.msfVenom = False
775+
else:
776+
msfEnvPathExists = False
771777
conf.msfPath = path
772778
break
773779

@@ -798,15 +804,23 @@ def _(key, value):
798804
for envPath in envPaths:
799805
envPath = envPath.replace(";", "")
800806

801-
if all(os.path.exists(normalizePath(os.path.join(envPath, _))) for _ in ("", "msfcli", "msfconsole", "msfencode", "msfpayload")):
802-
infoMsg = "Metasploit Framework has been found "
803-
infoMsg += "installed in the '%s' path" % envPath
804-
logger.info(infoMsg)
805-
807+
if all(os.path.exists(normalizePath(os.path.join(envPath, _))) for _ in ("", "msfcli", "msfconsole")):
806808
msfEnvPathExists = True
807-
conf.msfPath = envPath
809+
if all(os.path.exists(normalizePath(os.path.join(envPath, _))) for _ in ("msfvenom",)):
810+
kb.msfVenom = True
811+
elif all(os.path.exists(normalizePath(os.path.join(envPath, _))) for _ in ("msfencode", "msfpayload")):
812+
kb.msfVenom = False
813+
else:
814+
msfEnvPathExists = False
808815

809-
break
816+
if msfEnvPathExists:
817+
infoMsg = "Metasploit Framework has been found "
818+
infoMsg += "installed in the '%s' path" % envPath
819+
logger.info(infoMsg)
820+
821+
conf.msfPath = envPath
822+
823+
break
810824

811825
if not msfEnvPathExists:
812826
errMsg = "unable to locate Metasploit Framework installation. "
@@ -1794,6 +1808,7 @@ def _setKnowledgeBaseAttributes(flushAll=True):
17941808
kb.matchRatio = None
17951809
kb.maxConnectionsFlag = False
17961810
kb.mergeCookies = None
1811+
kb.msfVenom = False
17971812
kb.multiThreadMode = False
17981813
kb.negativeLogic = False
17991814
kb.nullConnection = None

‎lib/takeover/metasploit.py‎

Lines changed: 22 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@
2424
from lib.core.common import randomStr
2525
from lib.core.common import readInput
2626
from lib.core.data import conf
27+
from lib.core.data import kb
2728
from lib.core.data import logger
2829
from lib.core.data import paths
2930
from lib.core.enums import DBMS
@@ -63,6 +64,7 @@ def _initVars(self):
6364
self._msfCli = normalizePath(os.path.join(conf.msfPath, "msfcli"))
6465
self._msfEncode = normalizePath(os.path.join(conf.msfPath, "msfencode"))
6566
self._msfPayload = normalizePath(os.path.join(conf.msfPath, "msfpayload"))
67+
self._msfVenom = normalizePath(os.path.join(conf.msfPath, "msfvenom"))
6668

6769
if IS_WIN:
6870
_ = conf.msfPath
@@ -78,6 +80,7 @@ def _initVars(self):
7880
self._msfCli = "%s & ruby %s" % (_, self._msfCli)
7981
self._msfEncode = "ruby %s" % self._msfEncode
8082
self._msfPayload = "%s & ruby %s" % (_, self._msfPayload)
83+
self._msfVenom = "%s & ruby %s" % (_, self._msfVenom)
8184

8285
self._msfPayloadsList = {
8386
"windows": {
@@ -361,7 +364,11 @@ def _forgeMsfCliCmdForSmbrelay(self):
361364
self._cliCmd += " E"
362365

363366
def _forgeMsfPayloadCmd(self, exitfunc, format, outFile, extra=None):
364-
self._payloadCmd = "%s %s" % (self._msfPayload, self.payloadConnStr)
367+
if kb.msfVenom:
368+
self._payloadCmd = "%s -p" % self._msfVenom
369+
else:
370+
self._payloadCmd = self._msfPayload
371+
self._payloadCmd += " %s" % self.payloadConnStr
365372
self._payloadCmd += " EXITFUNC=%s" % exitfunc
366373
self._payloadCmd += " LPORT=%s" % self.portStr
367374

@@ -373,13 +380,22 @@ def _forgeMsfPayloadCmd(self, exitfunc, format, outFile, extra=None):
373380
if Backend.isOs(OS.LINUX) and conf.privEsc:
374381
self._payloadCmd += " PrependChrootBreak=true PrependSetuid=true"
375382

376-
if extra == "BufferRegister=EAX":
377-
self._payloadCmd += " R | %s -a x86 -e %s -o \"%s\" -t %s" % (self._msfEncode, self.encoderStr, outFile, format)
383+
if kb.msfVenom:
384+
if extra == "BufferRegister=EAX":
385+
self._payloadCmd += " -a x86 -e %s -f %s > \"%s\"" % (self.encoderStr, format, outFile)
378386

379-
if extra is not None:
380-
self._payloadCmd += " %s" % extra
387+
if extra is not None:
388+
self._payloadCmd += " %s" % extra
389+
else:
390+
self._payloadCmd += " -f exe > \"%s\"" % outFile
381391
else:
382-
self._payloadCmd += " X > \"%s\"" % outFile
392+
if extra == "BufferRegister=EAX":
393+
self._payloadCmd += " R | %s -a x86 -e %s -o \"%s\" -t %s" % (self._msfEncode, self.encoderStr, outFile, format)
394+
395+
if extra is not None:
396+
self._payloadCmd += " %s" % extra
397+
else:
398+
self._payloadCmd += " X > \"%s\"" % outFile
383399

384400
def _runMsfCliSmbrelay(self):
385401
self._forgeMsfCliCmdForSmbrelay()

0 commit comments

Comments
 (0)