PenTest/sqlmap
1
0
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2025-12-07 13:11:29 +00:00
Code Issues Projects Releases Wiki Activity

Get rid of Churrasco (Token kidnapping technique to --priv-esc). Reasons why:

Browse Source 
1. there's kitrap0d (MS10-015) which is far more reliable, just recently fixed
2. works only to priv esc basically on MSSQL when it runs as NETWORK SERVICE and the machine is not patched against MS09-012 which is "rare" (hopefully) nowadays.
Now sqlmap relies on kitrap0d and incognito to privilege escalate the database process' user privileges to SYSTEM, both via Meterpreter.

Minor layout adjustments.
This commit is contained in:
Bernardo Damele
2010-03-12 22:43:35 +00:00
parent 6b1ae62753
commit 7d8cc1a482
7 changed files with 21 additions and 94 deletions
Download Patch File Download Diff File Expand all files Collapse all files

BIN
lib/contrib/tokenkidnapping/Churrasco.exe_
View File

Binary file not shown.

11
lib/contrib/tokenkidnapping/README.txt
View File

@@ -1,11 +0,0 @@
Due to the anti-virus positive detection of executable stored inside this
folder, we needed to somehow circumvent this. As from the plain sqlmap
users perspective nothing has to be done prior to its usage by sqlmap, but
if you want to have access to the original executable use the decrypt
functionality of the ../extra/cloak/cloak.py utility.
To prepare the executable to the cloaked form use this command:
python ../extra/cloak/cloak.py -i Churrasco.exe
To get back the original executable use this:
python ../extra/cloak/cloak.py -d -i Churrasco.exe_