From c42c4982c39fffe402d2397f02983b3f2f98dae4 Mon Sep 17 00:00:00 2001
From: Bernardo Damele
Date: Fri, 12 Mar 2010 22:59:03 +0000
Subject: [PATCH] Updated documentation according to r1460
---
doc/README.html | 48 +-
doc/README.pdf | 7295 +++++++++++++++++++++++------------------------
doc/README.sgml | 24 +-
3 files changed, 3669 insertions(+), 3698 deletions(-)
diff --git a/doc/README.html b/doc/README.html
index 2a0b33521..559fe37fa 100644
--- a/doc/README.html
+++ b/doc/README.html
@@ -247,7 +247,7 @@ and the session user privileges.
You can watch several demo videos, they are hosted on
-YouTube and linked
+YouTube and linked
from
here.
@@ -276,13 +276,12 @@ blind SQL injection.
targets from
Burp proxy
requests log file or
-WebScarab proxy
-conversations/ folder, get the whole HTTP request from a text
-file or get the list of targets by providing sqlmap with a Google dork
-which queries
-Google search engine and
-parses its results page. You can also define a regular-expression based
-scope that is used to identify which of the parsed addresses to test.
+WebScarab proxy conversations/ folder, get the whole HTTP
+request from a text file or get the list of targets by providing sqlmap
+with a Google dork which queries
+Google search engine and parses its results page. You can also
+define a regular-expression based scope that is used to identify which of
+the parsed addresses to test.
Automatically tests all provided GET parameters,
POST parameters, HTTP Cookie header values and HTTP
@@ -457,10 +456,8 @@ Metasploit's getsystem command which include, among others,
the
kitrap0d technique (
MS10-015) or via
-Windows Access Tokens kidnapping by using either Meterpreter's
-incognito extension or Churrasco (
-MS09-012) stand-alone executable
-as per user's choice.
+Windows Access Tokens kidnapping by using Meterpreter's
+incognito extension.
Support to access (read/add/delete) Windows registry hives.
@@ -538,10 +535,8 @@ contains the working copy from the Subversion repository updated at the
time the sqlmap new version has been released.
The Debian and Red Hat installation packages (deb and rpm) are
compliant with the Linux distributions' packaging guidelines. This implies
-that they do not support the update features and do not include
-third-party softwares Churrasco (used to perform Windows token kidnapping,
-see below) and UPX (used to pack the Metasploit payload stager in some
-cases, see below).
+that they do not support the update features and do not include UPX (used
+to pack the Metasploit payload stager in some cases, see below).
The Windows binary package (exe) can't update itself and does not
support the takeover out-of-band features because they rely on
Metasploit's msfcli which is not available for Windows.
@@ -694,7 +689,7 @@ Options:
--os-pwn Prompt for an out-of-band shell, meterpreter or VNC
--os-smbrelay One click prompt for an OOB shell, meterpreter or VNC
--os-bof Stored procedure buffer overflow exploitation
- --priv-esc User priv escalation by abusing Windows access tokens
+ --priv-esc Database process' user privilege escalation
--msf-path=MSFPATH Local path where Metasploit Framework 3 is installed
--tmp-path=TMPPATH Remote absolute path of temporary files directory
@@ -4968,11 +4963,8 @@ via Metasploit's getsystem command which include, among others,
the
kitrap0d technique (
MS10-015) or via
-Windows Access Tokens kidnapping by using either Meterpreter's
-incognito extension or
-Churrasco
-(
-MS09-012) stand-alone executable as per user's choice.
+Windows Access Tokens kidnapping by using Meterpreter's
+incognito extension.
Example on a Microsoft SQL Server 2005 Service Pack 0 running as
NETWORK SERVICE on the target:
@@ -5023,9 +5015,7 @@ which payload encoding do you want to use?
[hh:mm:53] [INFO] creation in progress ..... done
[hh:mm:58] [INFO] compression in progress . done
[hh:mm:59] [INFO] uploading payload stager to 'C:/WINDOWS/Temp/tmpmqyws.exe'
-do you want sqlmap to upload Churrasco and call the Metasploit payload stager as its
-argument so that it will be started as SYSTEM? [y/N]
-[hh:mm:22] [INFO] running Metasploit Framework 3 command line interface locally, wait..
+[hh:mm:05] [INFO] running Metasploit Framework 3 command line interface locally, wait..
[*] Please wait while we load the module tree...
[*] Started reverse handler on 172.16.213.1:44780
[*] Starting the payload handler...
@@ -5144,11 +5134,9 @@ send the NTLM session hash when connecting to a SMB service
[hh:mm:16] [INFO] which is the back-end DBMS address? [172.16.213.131] 172.16.213.131
[hh:mm:16] [INFO] which remote port numer do you want to use? [4907] 4907
[hh:mm:16] [INFO] which payload do you want to use?
-[1] Reflective Meterpreter (default)
-[2] PatchUp Meterpreter (only from Metasploit development revision 6742)
-[3] Shell
-[4] Reflective VNC
-[5] PatchUp VNC (only from Metasploit development revision 6742)
+[1] Meterpreter (default)
+[2] Shell
+[3] VNC
> 1
[hh:mm:16] [INFO] which SMB port do you want to use?
[1] 139/TCP (default)
diff --git a/doc/README.pdf b/doc/README.pdf
index e2910ff5c..9ab44bd6c 100644
--- a/doc/README.pdf
+++ b/doc/README.pdf
@@ -1077,7 +1077,7 @@ endobj
/ProcSet [ /PDF /Text ]
>> endobj
481 0 obj <<
-/Length 1883
+/Length 1880
/Filter /FlateDecode
>>
stream
@@ -1086,7 +1086,9 @@ x
8Zޞ,8W$[R=K&n!F9
D^h`~M}[G
6mtS<I]}4_M
ndn_'EɽIvuUyx`7?NC3Z[mE"~*8A}o~6'u 6_XV)Y4B-0t|.qy)$>h1]
-*ŗ }(]';]c6V$5Jٌ5K#Җ'~Q|f;l(rPwUMcɲ?udzi"tWkg0C/Z5ׂwg7xd?2s7bUWT"R4F~W6ޅ1I!Je5$S8Ҽs(bikINƧXno
<5B^48F
,391y){=L
ƃ xاKPOZ}RS'.&0#wnôuh.P1Y8ex_q=G;omB]{gS*X[ jjl0:}Q4}kcjvẦk;sѴdRb!Mq;0 }:x7Ġ)I 1B>#C&Ts3՜hyi{>/K`\·4Ugj{,nl>ފՍA90Z*0Ć#F~ddLf%0iǸ0vkC+TC~0&^]͓`_
tegPFF3O\\U8tHyN>0Ɲ$'+?ē\r8w.ګ˄Q79Hj+#d e(j` ٙ*'xeI]FU^(QCLl܂`8.^r3*P>T0%0gqTS3q%oаEx2aD]جPL maVGyV O'u
+*ŗ }(]';]c6V$5Jٌ5K#Җ'~Q|f;l(rPwUMcɲ?udzi"tWkg0C/Z5ׂwgwsi r1`U]rTRT竆K(6]x"H'(Ou{ KΙT@%}:bn6֬NXDyk5XldXr f$A$~`T0Y6B'a2,9B=qv"_?jIN@Ìa<=rסId@dx}%rM 1wMAMݪTbodղxAGA'BeH
l;뚮9EӒI-Ӌ;4
+ę0')[ GW$@Ў-Zb*h
+ R1$Ws^"1L\c.er}BߪZДJTUB,{+.V7ìjHPZ;iᓑ0퇺h> @حPUwxu5OwN|a4EAh{<۟sqIBZWR!9Itw?JOjsߍO'cx:*2j.FGݸ u |WS%6ggV%QwT GxDYi2qN<OOx 8H$BRÜIǁReNĕgEhCBÆBɄuUcBB53_WXy30Zm'|?=]t
endstream
endobj
480 0 obj <<
@@ -1478,7 +1480,7 @@ endobj
/Type /Annot
/Border[0 0 0]/H/I/C[0 1 1]
/Rect [315.25 722.345 356.53 733.135]
-/Subtype/Link/A<>
+/Subtype/Link/A<>
>> endobj
502 0 obj <<
/Type /Annot
@@ -1628,356 +1630,357 @@ endobj
/Font << /F21 408 0 R /F15 404 0 R /F14 508 0 R /F24 483 0 R >>
/ProcSet [ /PDF /Text ]
>> endobj
-547 0 obj <<
-/Length 2791
+546 0 obj <<
+/Length 2724
/Filter /FlateDecode
>>
stream
-xr8_oUDqZ;g=cg
r7kv_H4L!npFjb7'O8_%*ɘϳlUO>V%^1_d`W"N^]r뀯2?xuyEg~Fru e{mSyyoy=yO_hrCp91Efw"Y"Տ'.U: ,HVH`-7c8"ؗYDxTmv}h؇v*y;Y)ZPseۡ~AHaQ8Jm,;Ioɵ
-YZЏ^Rݜ\xCSJUU͖-#y?ַ;&^K [+4]ot)\~$ ZΪB(Y ;P
)~Deu zV86
]kS0Α)3 A*-'.GF֞\5=]i GY][<4VfE'0[ÜYLIMTu`zf"/ݧb_jG1,= @IU(1SBy0~uf%"K4nOB11%ײ7SuEeG(8*.%~ԪjxR;H}`byyGQN('c+
t-#Mj1 @Psm8[eo2 ҞH
-!QvUcC%m"@N#MËԂ}q2FiRNa0= uaG&Crs&EO6tmAN99_Gތa0}cd): @XH9m*v&QFBCt{a<ٹ&'0H2mU
-}RHW$%բYuWUOpY'O0z BL5ɫ02]-8=-+ȡTNK>ҾB$@GPLK\
-%#mv=w3%rR8U9ĪY!rr'(&`bp#Ո1
8\.A$,f
m+E,EU2f*|di&7d'@("iuy8TCW;8*]$ р:q4O*xr6b:jLx3 i,ip79fЮ>2ږckI &{ ^A(Ns[, a*=FK*p{*mpD[$5yr AsZT|| y09RXK4 %ÅX$15vjk_ߜӳY