Update of tests

tests/test_generic_takeover.py

@@ -0,0 +1,600 @@
+#!/usr/bin/env python
+
+"""
+Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org)
+See the file 'LICENSE' for copying permission
+
+Unit tests for the generic plugin mixins covering:
+
+  * plugins/generic/custom.py   - sqlQuery SELECT/non-query/stacked branches, the
+    MSSQL FROM rewrite, METADB suffix stripping, SqlmapNoneDataException handling,
+    and sqlFile.
+  * plugins/generic/misc.py     - getRemoteTempPath (posix / windows-direct / MSSQL
+    ErrorLog), getVersionFromBanner, delRemoteFile, createSupportTbl, likeOrExact.
+  * plugins/generic/takeover.py - the PURE helpers only: Takeover.__init__ table
+    naming and the regRead/regAdd/regDel/osBof/osSmb control flow with the process/
+    network collaborators stubbed out (no metasploit/icmpsh/UDF spawning).
+
+The injection layer (lib.request.inject.{getValue,goStacked}) is patched per
+module, conf.direct=True selects the simple inband branches, conf.batch=True keeps
+prompts non-interactive, and conf.dumper is a recording stub. Every test restores
+all touched conf.* / kb.* / patched module attributes in tearDown so nothing leaks.
+"""
+
+import os
+import sys
+import unittest
+
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+from _testutils import bootstrap, set_dbms
+
+bootstrap()
+
+from lib.core.common import Backend
+from lib.core.data import conf, kb
+from lib.core.enums import OS
+from lib.core.settings import NULL
+
+import plugins.generic.entries as emod
+import plugins.generic.custom as cmod
+import plugins.generic.misc as mmod
+import plugins.generic.takeover as tmod
+from plugins.generic.custom import Custom
+from plugins.generic.misc import Miscellaneous
+
+
+class _RecordingDumper(object):
+    """Recording stand-in for conf.dumper (no printing / file writing)."""
+
+    def __init__(self):
+        self.tableValues = []
+        self.sqlQueries = []
+
+    def dbTableValues(self, tableValues):
+        self.tableValues.append(tableValues)
+
+    def sqlQuery(self, query, queryRes):
+        self.sqlQueries.append((query, queryRes))
+
+
+class _GenericBase(unittest.TestCase):
+    """Snapshot/restore for everything the generic mixins touch."""
+
+    _CONF_KEYS = (
+        "db", "tbl", "col", "direct", "batch", "exclude", "search",
+        "disableHashing", "noKeyset", "keyset", "forcePivoting", "dumpWhere",
+        "tmpPath", "sqlQuery", "sqlFile", "regKey", "regVal", "regData",
+        "regType", "osPwn", "osShell", "cleanup", "privEsc",
+    )
+
+    def setUp(self):
+        self._saved_conf = {k: conf.get(k) for k in self._CONF_KEYS}
+        self._saved_dumper = conf.get("dumper")
+
+        self._saved_getValue = {
+            emod: emod.inject.getValue,
+            cmod: cmod.inject.getValue,
+            mmod: mmod.inject.getValue,
+        }
+        self._saved_goStacked = {
+            cmod: cmod.inject.goStacked,
+            mmod: mmod.inject.goStacked,
+        }
+        self._saved_emod_readInput = emod.readInput
+        self._saved_mmod_readInput = mmod.readInput
+
+        self._saved_kb = {
+            "cachedColumns": kb.data.get("cachedColumns"),
+            "cachedTables": kb.data.get("cachedTables"),
+            "dumpedTable": kb.data.get("dumpedTable"),
+            "has_information_schema": kb.data.get("has_information_schema"),
+            "dumpKeyboardInterrupt": kb.get("dumpKeyboardInterrupt"),
+            "permissionFlag": kb.get("permissionFlag"),
+            "hintValue": kb.get("hintValue"),
+            "injection_data": kb.injection.data,
+            "bannerFp": kb.get("bannerFp"),
+            "os": kb.get("os"),
+        }
+        self._saved_forceDbms = kb.get("forcedDbms")
+
+        conf.direct = True
+        conf.batch = True
+        conf.exclude = None
+        conf.search = False
+        conf.disableHashing = True
+        conf.noKeyset = True
+        conf.keyset = False
+        conf.forcePivoting = False
+        conf.dumpWhere = None
+        conf.dumper = _RecordingDumper()
+
+        kb.data.cachedColumns = {}
+        kb.data.cachedTables = {}
+        kb.data.dumpedTable = {}
+        kb.data.has_information_schema = True
+        kb.dumpKeyboardInterrupt = False
+        kb.permissionFlag = False
+
+        def _readInput(message, default=None, checkBatch=True, boolean=False):
+            if boolean:
+                return default in (None, 'Y', 'y', True)
+            return default
+
+        emod.readInput = _readInput
+        mmod.readInput = _readInput
+
+    def tearDown(self):
+        for k, v in self._saved_conf.items():
+            conf[k] = v
+        conf.dumper = self._saved_dumper
+
+        for mod, fn in self._saved_getValue.items():
+            mod.inject.getValue = fn
+        for mod, fn in self._saved_goStacked.items():
+            mod.inject.goStacked = fn
+        emod.readInput = self._saved_emod_readInput
+        mmod.readInput = self._saved_mmod_readInput
+
+        kb.data.cachedColumns = self._saved_kb["cachedColumns"]
+        kb.data.cachedTables = self._saved_kb["cachedTables"]
+        kb.data.dumpedTable = self._saved_kb["dumpedTable"]
+        kb.data.has_information_schema = self._saved_kb["has_information_schema"]
+        kb.dumpKeyboardInterrupt = self._saved_kb["dumpKeyboardInterrupt"]
+        kb.permissionFlag = self._saved_kb["permissionFlag"]
+        kb.hintValue = self._saved_kb["hintValue"]
+        kb.injection.data = self._saved_kb["injection_data"]
+        kb.bannerFp = self._saved_kb["bannerFp"]
+        kb.os = self._saved_kb["os"]
+        kb.forcedDbms = self._saved_forceDbms
+
+    @staticmethod
+    def _force_os(os_name):
+        # Backend.setOs only assigns when kb.os is currently None; reset first so
+        # tests can deterministically pin the back-end OS.
+        kb.os = None
+        Backend.setOs(os_name)
+
+
+# --------------------------------------------------------------------------- #
+# custom.py
+# --------------------------------------------------------------------------- #
+
+class TestCustomSqlQuery(_GenericBase):
+    def test_select_joins_listlike_rows(self):
+        set_dbms("MySQL")
+        c = Custom()
+        cmod.inject.getValue = lambda query, **k: [["1", "alice"], ["2", "bob"]]
+        out = c.sqlQuery("SELECT id, name FROM users;")
+        # SELECT + list-like rows => each row joined into a single scalar string.
+        self.assertEqual(len(out), 2)
+        self.assertTrue(all(isinstance(_, str) for _ in out))
+
+    def test_select_scalar_passthrough(self):
+        set_dbms("MySQL")
+        c = Custom()
+        captured = {}
+
+        def gv(query, **k):
+            captured["query"] = query
+            captured["fromUser"] = k.get("fromUser")
+            return "42"
+
+        cmod.inject.getValue = gv
+        out = c.sqlQuery("SELECT COUNT(*) FROM users")
+        self.assertEqual(out, "42")
+        self.assertTrue(captured["fromUser"])
+
+    def test_metadb_suffix_stripped(self):
+        from lib.core.settings import METADB_SUFFIX
+        set_dbms("MySQL")
+        c = Custom()
+        captured = {}
+
+        def gv(query, **k):
+            captured["query"] = query
+            return "x"
+
+        cmod.inject.getValue = gv
+        c.sqlQuery("SELECT * FROM foo%s.bar" % METADB_SUFFIX)
+        # the METADB-suffixed schema qualifier is stripped before injection
+        self.assertNotIn(METADB_SUFFIX, captured["query"])
+
+    def test_mssql_from_dbo_rewrite(self):
+        set_dbms("Microsoft SQL Server")
+        c = Custom()
+        captured = {}
+
+        def gv(query, **k):
+            captured["query"] = query
+            return "x"
+
+        cmod.inject.getValue = gv
+        c.sqlQuery("SELECT * FROM mydb.users")
+        # single-dot FROM target gets the .dbo. schema spliced in for MSSQL
+        self.assertIn("mydb.dbo.users", captured["query"])
+
+    def test_nonquery_without_stacking_warns_none(self):
+        set_dbms("MySQL")
+        conf.direct = False
+        kb.injection.data = {}        # no stacking technique available
+        c = Custom()
+        cmod.inject.getValue = lambda *a, **k: self.fail("must not run a query")
+        out = c.sqlQuery("DELETE FROM users")
+        self.assertIsNone(out)
+
+    def test_nonquery_stacked_returns_null(self):
+        set_dbms("MySQL")
+        conf.direct = True            # direct => stacked execution allowed
+        c = Custom()
+        calls = {}
+
+        def go(query, *a, **k):
+            calls["query"] = query
+
+        cmod.inject.goStacked = go
+        out = c.sqlQuery("DROP TABLE users")
+        self.assertEqual(out, NULL)
+        self.assertIn("DROP TABLE users", calls["query"])
+
+    def test_nonedata_exception_handled(self):
+        from lib.core.exception import SqlmapNoneDataException
+        set_dbms("MySQL")
+        c = Custom()
+
+        def boom(*a, **k):
+            raise SqlmapNoneDataException("no data")
+
+        cmod.inject.getValue = boom
+        # exception is swallowed and logged; output stays None
+        self.assertIsNone(c.sqlQuery("SELECT 1"))
+
+
+class TestCustomSqlFile(_GenericBase):
+    def test_sqlfile_select_snippets(self):
+        set_dbms("MySQL")
+        c = Custom()
+        cmod.inject.getValue = lambda query, **k: "r"
+
+        # getSQLSnippet reads from disk; patch it to return inline SQL.
+        saved = cmod.getSQLSnippet
+        try:
+            cmod.getSQLSnippet = lambda dbms, filename, **kw: "SELECT 1;SELECT 2"
+            conf.sqlFile = "dummy.sql"
+            c.sqlFile()
+            # two SELECT statements => two recorded dumper.sqlQuery calls
+            self.assertEqual(len(conf.dumper.sqlQueries), 2)
+        finally:
+            cmod.getSQLSnippet = saved
+
+    def test_sqlfile_nonselect_snippet(self):
+        set_dbms("MySQL")
+        conf.direct = True
+        c = Custom()
+        cmod.inject.goStacked = lambda *a, **k: None
+
+        saved = cmod.getSQLSnippet
+        try:
+            cmod.getSQLSnippet = lambda dbms, filename, **kw: "DROP TABLE x"
+            conf.sqlFile = "dummy.sql"
+            c.sqlFile()
+            # non-SELECT => single recorded call with the whole snippet
+            self.assertEqual(len(conf.dumper.sqlQueries), 1)
+            self.assertEqual(conf.dumper.sqlQueries[0][0], "DROP TABLE x")
+        finally:
+            cmod.getSQLSnippet = saved
+
+
+# --------------------------------------------------------------------------- #
+# misc.py
+# --------------------------------------------------------------------------- #
+
+class _TestMisc(Miscellaneous):
+    """Miscellaneous with the OS/exec collaborators stubbed."""
+
+    cmdTblName = "sqlmapoutput"
+
+    def __init__(self):
+        Miscellaneous.__init__(self)
+        self.checkDbmsOsCalls = 0
+        self.execCmdCalls = []
+
+    def checkDbmsOs(self, detailed=False, vatch=False):
+        self.checkDbmsOsCalls += 1
+
+    def execCmd(self, cmd, silent=False):
+        self.execCmdCalls.append((cmd, silent))
+
+
+class TestMisc(_GenericBase):
+    def test_remote_temp_path_posix(self):
+        set_dbms("MySQL")
+        self._force_os(OS.LINUX)
+        conf.tmpPath = None
+        m = _TestMisc()
+        out = m.getRemoteTempPath()
+        self.assertEqual(out, "/tmp")
+        self.assertEqual(conf.tmpPath, "/tmp")
+
+    def test_remote_temp_path_windows_direct(self):
+        set_dbms("MySQL")
+        self._force_os(OS.WINDOWS)
+        conf.tmpPath = None
+        conf.direct = True
+        m = _TestMisc()
+        out = m.getRemoteTempPath()
+        self.assertEqual(out, "%TEMP%")
+
+    def test_remote_temp_path_explicit_windows_drive(self):
+        # An explicit Windows-style drive path flips Backend OS to Windows.
+        set_dbms("MySQL")
+        conf.tmpPath = "C:\\Temp"
+        m = _TestMisc()
+        out = m.getRemoteTempPath()
+        self.assertTrue(Backend.isOs(OS.WINDOWS))
+        self.assertIn("Temp", out)
+        self.assertNotIn("\\", out)   # ntToPosixSlashes normalized the path
+
+    def test_remote_temp_path_mssql_errorlog(self):
+        set_dbms("Microsoft SQL Server")
+        conf.tmpPath = None
+        mmod.inject.getValue = lambda query, **k: "C:\\Logs\\ERRORLOG"
+        m = _TestMisc()
+        out = m.getRemoteTempPath()
+        # ntpath.dirname strips the ERRORLOG filename, then ntToPosixSlashes
+        # normalizes the slashes: the exact temp dir must be "C:/Logs". Asserting
+        # the full path (and that the filename is gone) proves dirname ran.
+        self.assertEqual(out, "C:/Logs")
+        self.assertNotIn("ERRORLOG", out)
+
+    def test_get_version_from_banner(self):
+        set_dbms("MySQL")
+        conf.direct = True
+        kb.bannerFp = {}
+        mmod.inject.getValue = lambda query, **k: "5.7.31-log"
+        m = _TestMisc()
+        m.getVersionFromBanner()
+        # regex \d[\d.-]* extracts the leading numeric-ish run (trailing '-' kept)
+        self.assertEqual(kb.bannerFp["dbmsVersion"], "5.7.31-")
+
+    def test_get_version_from_banner_cached(self):
+        set_dbms("MySQL")
+        kb.bannerFp = {"dbmsVersion": "8.0"}
+        mmod.inject.getValue = lambda *a, **k: self.fail("must not query when cached")
+        m = _TestMisc()
+        m.getVersionFromBanner()
+        self.assertEqual(kb.bannerFp["dbmsVersion"], "8.0")
+
+    def test_del_remote_file_posix(self):
+        set_dbms("MySQL")
+        self._force_os(OS.LINUX)
+        m = _TestMisc()
+        m.delRemoteFile("/tmp/foo")
+        self.assertEqual(m.execCmdCalls[-1], ("rm -f /tmp/foo", True))
+
+    def test_del_remote_file_windows(self):
+        set_dbms("MySQL")
+        self._force_os(OS.WINDOWS)
+        m = _TestMisc()
+        m.delRemoteFile("C:/tmp/foo")
+        cmd, silent = m.execCmdCalls[-1]
+        self.assertTrue(cmd.startswith("del /F /Q"))
+        self.assertTrue(silent)
+
+    def test_del_remote_file_empty_noop(self):
+        set_dbms("MySQL")
+        m = _TestMisc()
+        m.delRemoteFile(None)
+        self.assertEqual(m.execCmdCalls, [])
+        self.assertEqual(m.checkDbmsOsCalls, 0)
+
+    def test_create_support_tbl(self):
+        set_dbms("MySQL")
+        m = _TestMisc()
+        stacked = []
+        mmod.inject.goStacked = lambda query, **k: stacked.append(query)
+        m.createSupportTbl("mytbl", "data", "TEXT")
+        joined = " | ".join(stacked)
+        self.assertIn("DROP TABLE mytbl", joined)
+        self.assertIn("CREATE TABLE mytbl(data TEXT)", joined)
+
+    def test_create_support_tbl_mssql_cmdtbl(self):
+        set_dbms("Microsoft SQL Server")
+        m = _TestMisc()
+        stacked = []
+        mmod.inject.goStacked = lambda query, **k: stacked.append(query)
+        m.createSupportTbl(m.cmdTblName, "data", "NVARCHAR(4000)")
+        joined = " | ".join(stacked)
+        # MSSQL cmd output table gets an IDENTITY id column
+        self.assertIn("IDENTITY", joined)
+
+    def test_like_or_exact_default(self):
+        m = _TestMisc()
+        mmod.readInput = lambda *a, **k: '1'
+        choice, cond = m.likeOrExact("table")
+        self.assertEqual(choice, '1')
+        self.assertIn("LIKE", cond)
+
+    def test_like_or_exact_exact(self):
+        m = _TestMisc()
+        mmod.readInput = lambda *a, **k: '2'
+        choice, cond = m.likeOrExact("table")
+        self.assertEqual(choice, '2')
+        self.assertEqual(cond, "='%s'")
+
+    def test_like_or_exact_invalid(self):
+        from lib.core.exception import SqlmapNoneDataException
+        m = _TestMisc()
+        mmod.readInput = lambda *a, **k: '9'
+        self.assertRaises(SqlmapNoneDataException, m.likeOrExact, "table")
+
+
+# --------------------------------------------------------------------------- #
+# takeover.py (pure helpers only)
+# --------------------------------------------------------------------------- #
+
+class _TestTakeover(tmod.Takeover):
+    """Takeover with all process/network collaborators stubbed.
+
+    Only the pure control-flow helpers (table naming, reg read/add/del dispatch,
+    osBof/osSmb guards) are exercised; metasploit/icmpsh/UDF spawning is replaced
+    with recorders so no external process or socket is ever created.
+    """
+
+    def __init__(self):
+        tmod.Takeover.__init__(self)
+        self.regCalls = []
+        self.osVal = OS.WINDOWS
+        self.smbCalled = False
+        self.bofCalled = False
+        self._regInitCalled = 0
+
+    # neutralize environment setup / OS detection
+    def _regInit(self):
+        self._regInitCalled += 1
+
+    def checkDbmsOs(self, detailed=False, vatch=False):
+        pass
+
+    def initEnv(self, *a, **k):
+        pass
+
+    def getRemoteTempPath(self):
+        return "/tmp"
+
+    def createMsfShellcode(self, *a, **k):
+        pass
+
+    def readRegKey(self, regKey, regValue, parse=False):
+        self.regCalls.append(("read", regKey, regValue))
+        return "value"
+
+    def addRegKey(self, regKey, regValue, regType, regData):
+        self.regCalls.append(("add", regKey, regValue, regType, regData))
+
+    def delRegKey(self, regKey, regValue):
+        self.regCalls.append(("del", regKey, regValue))
+
+    def smb(self):
+        self.smbCalled = True
+
+    def bof(self):
+        self.bofCalled = True
+
+
+class TestTakeover(_GenericBase):
+    def _saved_takeover_readInput(self):
+        return tmod.readInput
+
+    def setUp(self):
+        _GenericBase.setUp(self)
+        self._saved_t_readInput = tmod.readInput
+
+    def tearDown(self):
+        tmod.readInput = self._saved_t_readInput
+        _GenericBase.tearDown(self)
+
+    def test_init_cmd_table_name(self):
+        set_dbms("MySQL")
+        t = _TestTakeover()
+        self.assertEqual(t.cmdTblName, "%soutput" % conf.tablePrefix)
+        self.assertEqual(t.tblField, "data")
+
+    def test_reg_read_from_conf(self):
+        set_dbms("Microsoft SQL Server")
+        conf.regKey = "HKLM\\Soft"
+        conf.regVal = "Name"
+        t = _TestTakeover()
+        out = t.regRead()
+        self.assertEqual(out, "value")
+        self.assertEqual(t.regCalls[-1], ("read", "HKLM\\Soft", "Name"))
+        self.assertEqual(t._regInitCalled, 1)
+
+    def test_reg_read_defaults(self):
+        set_dbms("Microsoft SQL Server")
+        conf.regKey = None
+        conf.regVal = None
+        tmod.readInput = lambda message, default=None, **k: default
+        t = _TestTakeover()
+        t.regRead()
+        kind, regKey, regVal = t.regCalls[-1]
+        self.assertEqual(kind, "read")
+        self.assertIn("CurrentVersion", regKey)
+        self.assertEqual(regVal, "ProductName")
+
+    def test_reg_add_from_conf(self):
+        set_dbms("Microsoft SQL Server")
+        conf.regKey = "HKLM\\Soft"
+        conf.regVal = "Name"
+        conf.regData = "data"
+        conf.regType = "REG_SZ"
+        t = _TestTakeover()
+        t.regAdd()
+        self.assertEqual(t.regCalls[-1], ("add", "HKLM\\Soft", "Name", "REG_SZ", "data"))
+
+    def test_reg_add_missing_key_raises(self):
+        from lib.core.exception import SqlmapMissingMandatoryOptionException
+        set_dbms("Microsoft SQL Server")
+        conf.regKey = None
+        conf.regVal = None
+        conf.regData = None
+        conf.regType = None
+        tmod.readInput = lambda *a, **k: ""    # empty -> missing mandatory option
+        t = _TestTakeover()
+        self.assertRaises(SqlmapMissingMandatoryOptionException, t.regAdd)
+
+    def test_reg_del_confirmed(self):
+        set_dbms("Microsoft SQL Server")
+        conf.regKey = "HKLM\\Soft"
+        conf.regVal = "Name"
+        tmod.readInput = lambda message, default=None, boolean=False, **k: True if boolean else default
+        t = _TestTakeover()
+        t.regDel()
+        self.assertEqual(t.regCalls[-1], ("del", "HKLM\\Soft", "Name"))
+
+    def test_reg_del_declined(self):
+        set_dbms("Microsoft SQL Server")
+        conf.regKey = "HKLM\\Soft"
+        conf.regVal = "Name"
+        tmod.readInput = lambda message, default=None, boolean=False, **k: False if boolean else default
+        t = _TestTakeover()
+        t.regDel()
+        # declined => no delRegKey call recorded
+        self.assertEqual([c for c in t.regCalls if c[0] == "del"], [])
+
+    def test_osbof_wrong_dbms_raises(self):
+        from lib.core.exception import SqlmapUnsupportedDBMSException
+        set_dbms("MySQL")
+        conf.direct = True
+        t = _TestTakeover()
+        self.assertRaises(SqlmapUnsupportedDBMSException, t.osBof)
+
+    def test_osbof_no_stacking_returns(self):
+        set_dbms("Microsoft SQL Server")
+        conf.direct = False
+        kb.injection.data = {}        # no stacking, not direct => early return
+        t = _TestTakeover()
+        self.assertIsNone(t.osBof())
+        self.assertFalse(t.bofCalled)
+
+    def test_ossmb_non_windows_raises(self):
+        from lib.core.exception import SqlmapUnsupportedDBMSException
+        set_dbms("MySQL")
+        conf.direct = True
+        t = _TestTakeover()
+
+        # checkDbmsOs is a no-op here, so force the non-Windows OS explicitly
+        self._force_os(OS.LINUX)
+        self.assertRaises(SqlmapUnsupportedDBMSException, t.osSmb)
+        self.assertFalse(t.smbCalled)
+
+    def test_ossmb_windows_invokes_smb(self):
+        set_dbms("MySQL")
+        conf.direct = True
+        self._force_os(OS.WINDOWS)
+        t = _TestTakeover()
+        t.osSmb()
+        self.assertTrue(t.smbCalled)
+
+
+if __name__ == "__main__":
+    unittest.main()