From 5ba2007d69db26309c7dc6efabee620f861a659e Mon Sep 17 00:00:00 2001 From: tomsellers Date: Fri, 24 Aug 2012 10:32:44 +0000 Subject: [PATCH] Added or enhanced support for the following data types: SQLTEXT = 0x23 - text GUIDTYPE = 0x24 - uniqueidentifier NTEXTTYPE = 0x63 - unicode text (ntext) BITNTYPE = 0x68 - boolean DECIMALNTYPE = 0x6A - decimal NUMERICNTYPE = 0x6C - numeric FLTNTYPE = 0x6D - float/real/double MONEYNTYPE = 0x6E - money / smallmoeny BIGBINARYTYPE = 0xAD - binary BIGCHARTYPE = 0xAF - char SQLNCHAR = 0xEF - unicode char (nchar) Added detection and handling of null values when processing query responses from the server. Added DoneProc response token support Reordered ColumnData and ColumnInfo parsers by data type code to make updates easier. --- CHANGELOG | 4 + nselib/mssql.lua | 556 +++++++++++++++++++++++++++++++++++++++-------- 2 files changed, 469 insertions(+), 91 deletions(-) diff --git a/CHANGELOG b/CHANGELOG index 805b3b524..6443f8fbd 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -1,5 +1,9 @@ # Nmap Changelog ($Id$); -*-text-*- +o [NSE] Updated mssql.lua library to support additional data types, enchanced + some of the existing data types, added the DoneProc response token, and + reordered code for maintainability. [Tom Sellers] + o [NSE] Added http-slowloris-check script which checks if the server is vulnerable to a Slowloris DoS attack in a safe way. [Aleksandar Nikolic] diff --git a/nselib/mssql.lua b/nselib/mssql.lua index 470196764..ed3c8834e 100644 --- a/nselib/mssql.lua +++ b/nselib/mssql.lua @@ -130,6 +130,11 @@ _ENV = stdnse.module("mssql", stdnse.seeall) -- * added support for integrated NTLMv1 authentication -- -- (Patrik Karlsson, Chris Woodbury) +-- Revised 08/19/2012 - v0.6 - added multiple data types +-- * added detection and handling of null values when processing query responses from the server +-- * added DoneProc response token support +-- +-- (Tom Sellers) local HAVE_SSL, openssl = pcall(require, "openssl") @@ -674,30 +679,42 @@ PacketType = -- TDS response token types TokenType = { - ReturnStatus = 0x79, - TDS7Results = 0x81, - ErrorMessage = 0xAA, - InformationMessage = 0xAB, + ReturnStatus = 0x79, + TDS7Results = 0x81, + ErrorMessage = 0xAA, + InformationMessage = 0xAB, LoginAcknowledgement = 0xAD, - Row = 0xD1, - OrderBy = 0xA9, - EnvironmentChange = 0xE3, - NTLMSSP_CHALLENGE = 0xed, - Done = 0xFD, - DoneInProc = 0xFF, + Row = 0xD1, + OrderBy = 0xA9, + EnvironmentChange = 0xE3, + NTLMSSP_CHALLENGE = 0xed, + Done = 0xFD, + DoneProc = 0xFE, + DoneInProc = 0xFF, } -- SQL Server/Sybase data types DataTypes = { - SYBINTN = 0x26, - SYBINT2 = 0x34, - SYBINT4 = 0x38, - SYBDATETIME = 0x3D, - SYBDATETIMN = 0x6F, + SQLTEXT = 0x23, + GUIDTYPE = 0x24, + SYBINTN = 0x26, + SYBINT2 = 0x34, + SYBINT4 = 0x38, + SYBDATETIME = 0x3D, + NTEXTTYPE = 0x63, + BITNTYPE = 0x68, + DECIMALNTYPE = 0x6A, + NUMERICNTYPE = 0x6C, + FLTNTYPE = 0x6D, + MONEYNTYPE = 0x6E, + SYBDATETIMN = 0x6F, XSYBVARBINARY = 0xA5, - XSYBVARCHAR = 0xA7, - XSYBNVARCHAR = 0xE7, + XSYBVARCHAR = 0xA7, + BIGBINARYTYPE = 0xAD, + BIGCHARTYPE = 0xAF, + XSYBNVARCHAR = 0xE7, + SQLNCHAR = 0xEF, } -- SQL Server login error codes @@ -728,22 +745,27 @@ ColumnInfo = Parse = { - [DataTypes.XSYBNVARCHAR] = function( data, pos ) + + [DataTypes.SQLTEXT] = function( data, pos ) local colinfo = {} local tmp - pos, colinfo.lts, colinfo.codepage, colinfo.flags, colinfo.charset, - colinfo.msglen = bin.unpack("