doing a dummy test for --os-shell in case of xp_cmdshell

stamparm · stamparm · commit c878dd3e5a32 · 2012-03-09T14:21:41.000Z
diff --git a/lib/controller/checks.py b/lib/controller/checks.py
@@ -562,7 +562,7 @@ def _():
             retVal = None
 
         if retVal is None:
-            warnMsg = "false positive and/or unexploitable injection point detected"
+            warnMsg = "false positive or unexploitable injection point detected"
             logger.warn(warnMsg)
 
         kb.injection = popValue()
diff --git a/lib/takeover/abstraction.py b/lib/takeover/abstraction.py
@@ -10,14 +10,19 @@
 from extra.safe2bin.safe2bin import safechardecode
 from lib.core.common import dataToStdout
 from lib.core.common import Backend
+from lib.core.common import isNoneValue
 from lib.core.common import isTechniqueAvailable
+from lib.core.common import pushValue
 from lib.core.common import readInput
+from lib.core.common import popValue
 from lib.core.data import conf
 from lib.core.data import logger
 from lib.core.enums import DBMS
 from lib.core.enums import PAYLOAD
+from lib.core.exception import sqlmapGenericException
 from lib.core.exception import sqlmapUnsupportedFeatureException
 from lib.core.shell import autoCompletion
+from lib.core.threads import getCurrentThreadData
 from lib.takeover.udf import UDF
 from lib.takeover.web import Web
 from lib.takeover.xp_cmdshell import xp_cmdshell
@@ -108,6 +113,19 @@ def shell(self):
                 infoMsg += "operating system command execution"
                 logger.info(infoMsg)
 
+                threadData = getCurrentThreadData()
+                pushValue(threadData.disableStdOut)
+                threadData.disableStdOut = True
+
+                output = self.evalCmd("echo 1")
+                if isNoneValue(output):
+                    errMsg = "it seems that the temporary directory ('%s') used for storing " % self.getRemoteTempPath()
+                    errMsg += "console output at the back-end OS does not have "
+                    errMsg += "writing permissions for the DBMS process. You are advised "
+                    errMsg += "to manually adjust it with option '--tmp-path'"
+                    raise sqlmapGenericException, errMsg
+
+                threadData.disableStdOut = popValue()
             else:
                 errMsg = "feature not yet implemented for the back-end DBMS"
                 raise sqlmapUnsupportedFeatureException, errMsg
diff --git a/plugins/generic/misc.py b/plugins/generic/misc.py
@@ -60,6 +60,8 @@ def getRemoteTempPath(self):
 
         hashDBWrite(HASHDB_KEYS.CONF_TMP_PATH, conf.tmpPath)
 
+        return conf.tmpPath
+
     def getVersionFromBanner(self):
         if "dbmsVersion" in kb.bannerFp:
             return
