Skip to content

Unable to retrieve XP_Cmdshell Output #466

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
stamparm merged 3 commits into from
Jun 18, 2013
Merged

Unable to retrieve XP_Cmdshell Output #466

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
caa3267
Fallback to blind
Meatballs1 Jun 16, 2013
2c98507
Add better error msg
Meatballs1 Jun 16, 2013
c508739
Fix exception if init technique not available
Meatballs1 Jun 16, 2013
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 6 additions & 2 deletions lib/takeover/xp_cmdshell.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -106,14 +106,16 @@ def _xpCmdshellTest(self):

if output == "1":
logger.info("xp_cmdshell extended procedure is usable")
elif isNoneValue(output):
elif isNoneValue(output) and conf.dbmsCred:
errMsg = "it seems that the temporary directory ('%s') used for " % self.getRemoteTempPath()
errMsg += "storing console output within the back-end file system "
errMsg += "does not have writing permissions for the DBMS process. "
errMsg += "You are advised to manually adjust it with option "
errMsg += "--tmp-path switch or you will not be able to retrieve "
errMsg += "the commands output"
logger.error(errMsg)
elif isNoneValue(output):
logger.error("unable to retrieve xp_cmdshell output")
else:
logger.info("xp_cmdshell extended procedure is usable")

Expand Down Expand Up @@ -207,9 +209,11 @@ def xpCmdshellEvalCmd(self, cmd, first=None, last=None):

query = "SELECT %s FROM %s ORDER BY id" % (self.tblField, self.cmdTblName)

output = None
if any(isTechniqueAvailable(_) for _ in (PAYLOAD.TECHNIQUE.UNION, PAYLOAD.TECHNIQUE.ERROR, PAYLOAD.TECHNIQUE.QUERY)) or conf.direct:
output = inject.getValue(query, resumeValue=False, blind=False, time=False)
else:

if (output is None) or len(output)==0 or output[0] is None:
output = []
count = inject.getValue("SELECT COUNT(id) FROM %s" % self.cmdTblName, resumeValue=False, union=False, error=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS)

Expand Down