Skip to content

Commit 3e2c385

Browse files
bdamelebdamele
committed
Make --live-test Metasploit integration cases work, added more test cases for PostgreSQL and code refactoring (issue #312)
1 parent 279f6cb commit 3e2c385

File tree

3 files changed

+107
-24
lines changed

3 files changed

+107
-24
lines changed

‎lib/core/testing.py

+13-11
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,6 @@
1010
import os
1111
import re
1212
import shutil
13-
import StringIO
1413
import sys
1514
import tempfile
1615
import time
@@ -172,18 +171,20 @@ def liveTest():
172171
logger.info("test passed")
173172
cleanCase()
174173
else:
175-
errMsg = "test failed"
174+
errMsg = "test failed "
175+
if failedTraceBack:
176+
errMsg += "(got a traceback)"
177+
traceback_fd = codecs.open("%s%straceback" % (paths.SQLMAP_OUTPUT_PATH, os.sep), "wb", UNICODE_ENCODING)
178+
traceback_fd.write(failedTraceBack)
179+
traceback_fd.close()
176180
if failedItem:
177-
errMsg += " at parsing item: %s - scan folder is %s" % (failedItem, paths.SQLMAP_OUTPUT_PATH)
181+
errMsg += "at parsing item: %s" % failedItem
182+
if failedParseOn:
178183
console_output_fd = codecs.open("%s%sconsole_output" % (paths.SQLMAP_OUTPUT_PATH, os.sep), "wb", UNICODE_ENCODING)
179184
console_output_fd.write(failedParseOn)
180185
console_output_fd.close()
181-
elif failedTraceBack:
182-
errMsg += ": got a traceback - scan folder is %s" % paths.SQLMAP_OUTPUT_PATH
183-
traceback_fd = codecs.open("%s%straceback" % (paths.SQLMAP_OUTPUT_PATH, os.sep), "wb", UNICODE_ENCODING)
184-
traceback_fd.write(failedTraceBack)
185-
traceback_fd.close()
186186

187+
errMsg += " - scan folder is %s" % paths.SQLMAP_OUTPUT_PATH
187188
logger.error(errMsg)
188189
beep()
189190

@@ -217,7 +218,6 @@ def initCase(switches=None):
217218
logger.debug("using output directory '%s' for this test case" % paths.SQLMAP_OUTPUT_PATH)
218219

219220
cmdLineOptions = cmdLineParser()
220-
cmdLineOptions.liveTest = cmdLineOptions.smokeTest = False
221221

222222
if switches:
223223
for key, value in switches.items():
@@ -236,7 +236,7 @@ def runCase(switches=None, parse=None):
236236

237237
initCase(switches)
238238

239-
LOGGER_HANDLER.stream = sys.stdout = StringIO.StringIO()
239+
LOGGER_HANDLER.stream = sys.stdout = tempfile.SpooledTemporaryFile(max_size=0, mode="w+b", prefix="sqlmapstdout-")
240240
retVal = True
241241
handled_exception = None
242242
unhandled_exception = None
@@ -269,8 +269,9 @@ def runCase(switches=None, parse=None):
269269
logger.error("the test did not run")
270270
retVal = False
271271

272+
console = getUnicode(console, system=True)
273+
272274
if parse and retVal:
273-
console = getUnicode(console, system=True)
274275
with codecs.open(conf.dumper.getOutputFile(), "rb", UNICODE_ENCODING) as f:
275276
content = f.read()
276277

@@ -292,6 +293,7 @@ def runCase(switches=None, parse=None):
292293
failedParseOn = console
293294

294295
elif retVal is False and tback is not None:
296+
failedParseOn = console
295297
failedTraceBack = tback
296298

297299
return retVal

‎lib/takeover/metasploit.py

+12
Original file line numberDiff line numberDiff line change
@@ -444,6 +444,7 @@ def _loadMetExtensions(self, proc, metSess):
444444

445445
def _controlMsfCmd(self, proc, func):
446446
stdin_fd = sys.stdin.fileno()
447+
initiated_properly = False
447448

448449
while True:
449450
returncode = proc.poll()
@@ -493,6 +494,14 @@ def _controlMsfCmd(self, proc, func):
493494
out = recv_some(proc, t=.1, e=0)
494495
blockingWriteToFD(sys.stdout.fileno(), out)
495496

497+
# Dirty hack to allow Metasploit integration to be tested
498+
# in --live-test mode
499+
if initiated_properly and conf.liveTest:
500+
try:
501+
send_all(proc, "exit\n")
502+
except TypeError:
503+
continue
504+
496505
# For --os-pwn and --os-bof
497506
pwnBofCond = self.connectionStr.startswith("reverse")
498507
pwnBofCond &= "Starting the payload handler" in out
@@ -509,6 +518,9 @@ def _controlMsfCmd(self, proc, func):
509518
else:
510519
send_all(proc, "uname -a ; id\n")
511520

521+
time.sleep(2)
522+
initiated_properly = True
523+
512524
metSess = re.search("Meterpreter session ([\d]+) opened", out)
513525

514526
if metSess:

‎xml/livetests.xml

+82-13
Original file line numberDiff line numberDiff line change
@@ -1242,39 +1242,37 @@
12421242
<item value="r'SELECT \* FROM users ORDER BY name \[5\].+1, luther, blissett.+2, fluffy, bunny.+3, wu, ming'"/>
12431243
</parse>
12441244
</case>
1245-
1246-
12471245
<case name="PostgreSQL boolean-based multi-threaded custom SQL query enumeration">
12481246
<switches>
12491247
<url value="http://debiandev/sqlmap/pgsql/get_int.php?id=1"/>
12501248
<threads value="4"/>
12511249
<tech value="B"/>
1252-
<query value="SELECT * FROM users LIMIT 0, 2"/>
1250+
<query value="SELECT * FROM users OFFSET 0 LIMIT 2"/>
12531251
</switches>
12541252
<parse>
1255-
<item value="r'SELECT \* FROM users LIMIT 0, 2 \[2\].+1, luther, blissett.+2, fluffy, bunny'"/>
1253+
<item value="r'SELECT \* FROM users OFFSET 0 LIMIT 2 \[2\].+1, luther, blissett.+2, fluffy, bunny'"/>
12561254
</parse>
12571255
</case>
12581256
<case name="PostgreSQL error-based multi-threaded custom SQL query enumeration">
12591257
<switches>
12601258
<url value="http://debiandev/sqlmap/pgsql/get_int.php?id=1"/>
12611259
<threads value="4"/>
12621260
<tech value="E"/>
1263-
<query value="SELECT * FROM users LIMIT 0, 2"/>
1261+
<query value="SELECT * FROM users OFFSET 0 LIMIT 2"/>
12641262
</switches>
12651263
<parse>
1266-
<item value="r'SELECT \* FROM users LIMIT 0, 2 \[2\].+1, luther, blissett.+2, fluffy, bunny'"/>
1264+
<item value="r'SELECT \* FROM users OFFSET 0 LIMIT 2 \[2\].+1, luther, blissett.+2, fluffy, bunny'"/>
12671265
</parse>
12681266
</case>
12691267
<case name="PostgreSQL UNION query multi-threaded custom SQL query enumeration">
12701268
<switches>
12711269
<url value="http://debiandev/sqlmap/pgsql/get_int.php?id=1"/>
12721270
<threads value="4"/>
12731271
<tech value="U"/>
1274-
<query value="SELECT * FROM users LIMIT 0, 2"/>
1272+
<query value="SELECT * FROM users OFFSET 0 LIMIT 2"/>
12751273
</switches>
12761274
<parse>
1277-
<item value="r'SELECT \* FROM users LIMIT 0, 2 \[2\].+1, luther, blissett.+2, fluffy, bunny'"/>
1275+
<item value="r'SELECT \* FROM users OFFSET 0 LIMIT 2 \[2\].+1, luther, blissett.+2, fluffy, bunny'"/>
12781276
</parse>
12791277
</case>
12801278
<case name="PostgreSQL boolean-based multi-threaded custom ordered SQL query enumeration">
@@ -1360,6 +1358,56 @@
13601358
<item value="the remote file /tmp/passwd-${random} is larger than the local file /etc/passwd" console_output="True"/>
13611359
</parse>
13621360
</case>
1361+
<case name="PostgreSQL boolean-based multi-threaded file read">
1362+
<switches>
1363+
<url value="http://debiandev/sqlmap/pgsql/get_int.php?id=1"/>
1364+
<threads value="4"/>
1365+
<tech value="BS"/>
1366+
<timeSec value="2"/>
1367+
<rFile value="/etc/hosts,/tmp/invalidfile"/>
1368+
<answers value="do you want to overwrite it=Y"/>
1369+
</switches>
1370+
<parse>
1371+
<item value="r'files saved to.+files/_etc_hosts \(same file\)'"/>
1372+
</parse>
1373+
</case>
1374+
<case name="PostgreSQL error-based multi-threaded file read">
1375+
<switches>
1376+
<url value="http://debiandev/sqlmap/pgsql/get_int.php?id=1"/>
1377+
<threads value="4"/>
1378+
<tech value="ES"/>
1379+
<rFile value="/etc/hosts,/tmp/invalidfile"/>
1380+
<answers value="do you want to overwrite it=Y"/>
1381+
</switches>
1382+
<parse>
1383+
<item value="r'files saved to.+files/_etc_hosts \(same file\)'"/>
1384+
</parse>
1385+
</case>
1386+
<case name="PostgreSQL UNION query multi-threaded file read">
1387+
<switches>
1388+
<url value="http://debiandev/sqlmap/pgsql/get_int.php?id=1"/>
1389+
<threads value="4"/>
1390+
<tech value="US"/>
1391+
<rFile value="/etc/hosts,/tmp/invalidfile"/>
1392+
<answers value="do you want to overwrite it=Y"/>
1393+
</switches>
1394+
<parse>
1395+
<item value="r'files saved to.+files/_etc_hosts \(same file\)'"/>
1396+
</parse>
1397+
</case>
1398+
<case name="PostgreSQL multi-threaded file write">
1399+
<switches>
1400+
<verbose value="2"/>
1401+
<url value="http://debiandev/sqlmap/pgsql/get_int.php?id=1"/>
1402+
<threads value="4"/>
1403+
<wFile value="/etc/passwd"/>
1404+
<dFile value="/tmp/passwd-${random}"/>
1405+
<answers value="do you want to overwrite it=Y"/>
1406+
</switches>
1407+
<parse>
1408+
<item value="the local file /etc/passwd and the remote file /tmp/passwd-${random} have the same size" console_output="True"/>
1409+
</parse>
1410+
</case>
13631411
<!-- End of file system access switches -->
13641412

13651413
<!-- Operating system access switches -->
@@ -1374,20 +1422,41 @@
13741422
<item value="command standard output: 'uid="/>
13751423
</parse>
13761424
</case>
1377-
<!-- TODO: integration with Metasploit cannot be called yet from live testing
13781425
<case name="MySQL shell via Metasploit integration - command execution">
13791426
<switches>
13801427
<url value="http://debiandev/sqlmap/mysql/get_int.php?id=1"/>
1381-
<tech value="B"/>
1428+
<tech value="BU"/>
13821429
<osPwn value="True"/>
13831430
<msfPath value="/usr/local/bin/"/>
1384-
<answers value="please provide any additional web server=/var/www/test"/>
1431+
<answers value="please provide any additional web server=/var/www/test,do you want to overwrite it=Y"/>
1432+
</switches>
1433+
<parse>
1434+
<item value="r'Sending stage.+Linux.+uid=.+www-data'" console_output="True"/>
1435+
</parse>
1436+
</case>
1437+
<case name="PostgreSQL User-Defined Function (UDF) injection - command execution">
1438+
<switches>
1439+
<url value="http://debiandev/sqlmap/pgsql/get_int.php?id=1"/>
1440+
<tech value="US"/>
1441+
<osCmd value="id"/>
1442+
<answers value="do you want to overwrite it=Y"/>
1443+
</switches>
1444+
<parse>
1445+
<item value="command standard output: 'uid="/>
1446+
</parse>
1447+
</case>
1448+
<case name="PostgreSQL shell via Metasploit integration - command execution">
1449+
<switches>
1450+
<url value="http://debiandev/sqlmap/pgsql/get_int.php?id=1"/>
1451+
<tech value="US"/>
1452+
<osPwn value="True"/>
1453+
<msfPath value="/usr/local/bin/"/>
1454+
<answers value="do you want to overwrite it=Y"/>
13851455
</switches>
13861456
<parse>
1387-
<item value="r'Sending stage.+Command shell session.+Linux.+uid='"/>
1457+
<item value="r'Sending stage.+Linux.+uid=.+postgres'" console_output="True"/>
13881458
</parse>
13891459
</case>
1390-
-->
13911460
<!-- End of operating system access switches -->
13921461

13931462
<!-- Technique switches and corner cases -->

0 commit comments

Comments
 (0)