|
|
#!/usr/bin/env python
|
|
|
|
|
|
"""
|
|
|
Copyright (c) 2006-2024 sqlmap developers (https://sqlmap.org/)
|
|
|
See the file 'LICENSE' for copying permission
|
|
|
"""
|
|
|
|
|
|
# 1. 导入必要的模块
|
|
|
from lib.core.common import getLimitRange # 获取限制范围
|
|
|
from lib.core.common import isAdminFromPrivileges # 判断是否为管理员
|
|
|
from lib.core.common import isInferenceAvailable # 判断是否可以使用推断注入
|
|
|
from lib.core.common import isNoneValue # 判断是否为 None 值
|
|
|
from lib.core.common import isNumPosStrValue # 判断是否为数字正字符串值
|
|
|
from lib.core.common import isTechniqueAvailable # 判断是否可以使用特定注入技术
|
|
|
from lib.core.compat import xrange # 兼容 Python 2 和 3 的 xrange
|
|
|
from lib.core.data import conf # 全局配置信息
|
|
|
from lib.core.data import kb # 全局知识库
|
|
|
from lib.core.data import logger # 日志记录器
|
|
|
from lib.core.data import queries # SQL 查询语句
|
|
|
from lib.core.enums import CHARSET_TYPE # 字符集类型枚举
|
|
|
from lib.core.enums import DBMS # 数据库管理系统枚举
|
|
|
from lib.core.enums import EXPECTED # 预期返回类型枚举
|
|
|
from lib.core.enums import PAYLOAD # 注入类型枚举
|
|
|
from lib.core.exception import SqlmapNoneDataException # 没有数据异常
|
|
|
from lib.core.settings import CURRENT_USER # 当前用户
|
|
|
from lib.request import inject # 注入相关函数
|
|
|
from plugins.generic.enumeration import Enumeration as GenericEnumeration # 通用枚举类
|
|
|
|
|
|
# 2. 定义一个类 Enumeration，继承自 GenericEnumeration
|
|
|
class Enumeration(GenericEnumeration):
|
|
|
# 3. 获取数据库用户角色
|
|
|
def getRoles(self, query2=False):
|
|
|
# 4. 输出获取数据库用户角色信息
|
|
|
infoMsg = "fetching database users roles"
|
|
|
# 5. 从查询集中获取角色查询语句
|
|
|
rootQuery = queries[DBMS.ORACLE].roles
|
|
|
|
|
|
# 6. 如果用户名为当前用户，则获取当前用户名
|
|
|
if conf.user == CURRENT_USER:
|
|
|
infoMsg += " for current user"
|
|
|
conf.user = self.getCurrentUser()
|
|
|
|
|
|
logger.info(infoMsg)
|
|
|
|
|
|
# 7. 存储管理员用户的集合
|
|
|
areAdmins = set()
|
|
|
|
|
|
# 8. 检查是否存在可用的注入技术或直接连接
|
|
|
if any(isTechniqueAvailable(_) for _ in (PAYLOAD.TECHNIQUE.UNION, PAYLOAD.TECHNIQUE.ERROR, PAYLOAD.TECHNIQUE.QUERY)) or conf.direct:
|
|
|
# 9. 选择使用哪个查询语句
|
|
|
if query2:
|
|
|
query = rootQuery.inband.query2
|
|
|
condition = rootQuery.inband.condition2
|
|
|
else:
|
|
|
query = rootQuery.inband.query
|
|
|
condition = rootQuery.inband.condition
|
|
|
# 10. 如果指定了用户名，则添加到查询条件中
|
|
|
if conf.user:
|
|
|
users = conf.user.split(',')
|
|
|
query += " WHERE "
|
|
|
query += " OR ".join("%s = '%s'" % (condition, user) for user in sorted(users))
|
|
|
|
|
|
# 11. 执行查询语句，获取用户角色信息
|
|
|
values = inject.getValue(query, blind=False, time=False)
|
|
|
|
|
|
# 12. 如果没有获取到数据，尝试使用备用表 `USER_ROLE_PRIVS`
|
|
|
if not values and not query2:
|
|
|
infoMsg = "trying with table 'USER_ROLE_PRIVS'"
|
|
|
logger.info(infoMsg)
|
|
|
return self.getRoles(query2=True)
|
|
|
# 13. 处理获取到的用户角色信息
|
|
|
if not isNoneValue(values):
|
|
|
for value in values:
|
|
|
user = None
|
|
|
roles = set()
|
|
|
for count in xrange(0, len(value or [])):
|
|
|
# 14. 第一列为用户名
|
|
|
if count == 0:
|
|
|
user = value[count]
|
|
|
# 15. 其他列为角色
|
|
|
else:
|
|
|
role = value[count]
|
|
|
roles.add(role)
|
|
|
# 16. 将用户角色信息添加到缓存中
|
|
|
if user in kb.data.cachedUsersRoles:
|
|
|
kb.data.cachedUsersRoles[user] = list(roles.union(kb.data.cachedUsersRoles[user]))
|
|
|
else:
|
|
|
kb.data.cachedUsersRoles[user] = list(roles)
|
|
|
|
|
|
# 17. 如果没有获取到用户角色信息，尝试使用推断注入
|
|
|
if not kb.data.cachedUsersRoles and isInferenceAvailable() and not conf.direct:
|
|
|
# 18. 获取用户名列表
|
|
|
if conf.user:
|
|
|
users = conf.user.split(',')
|
|
|
else:
|
|
|
if not len(kb.data.cachedUsers):
|
|
|
users = self.getUsers()
|
|
|
else:
|
|
|
users = kb.data.cachedUsers
|
|
|
|
|
|
retrievedUsers = set()
|
|
|
# 19. 遍历用户列表，获取每个用户的角色信息
|
|
|
for user in users:
|
|
|
unescapedUser = None
|
|
|
if user in retrievedUsers:
|
|
|
continue
|
|
|
infoMsg = "fetching number of roles "
|
|
|
infoMsg += "for user '%s'" % user
|
|
|
logger.info(infoMsg)
|
|
|
|
|
|
if unescapedUser:
|
|
|
queryUser = unescapedUser
|
|
|
else:
|
|
|
queryUser = user
|
|
|
|
|
|
if query2:
|
|
|
query = rootQuery.blind.count2 % queryUser
|
|
|
else:
|
|
|
query = rootQuery.blind.count % queryUser
|
|
|
# 20. 获取每个用户的角色数量
|
|
|
count = inject.getValue(query, union=False, error=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS)
|
|
|
# 21. 如果没有获取到角色数量，尝试使用备用表 `USER_SYS_PRIVS`
|
|
|
if not isNumPosStrValue(count):
|
|
|
if count != 0 and not query2:
|
|
|
infoMsg = "trying with table 'USER_SYS_PRIVS'"
|
|
|
logger.info(infoMsg)
|
|
|
return self.getPrivileges(query2=True)
|
|
|
|
|
|
warnMsg = "unable to retrieve the number of "
|
|
|
warnMsg += "roles for user '%s'" % user
|
|
|
logger.warning(warnMsg)
|
|
|
continue
|
|
|
|
|
|
infoMsg = "fetching roles for user '%s'" % user
|
|
|
logger.info(infoMsg)
|
|
|
|
|
|
roles = set()
|
|
|
|
|
|
indexRange = getLimitRange(count, plusOne=True)
|
|
|
# 22. 遍历角色索引，获取每个角色信息
|
|
|
for index in indexRange:
|
|
|
if query2:
|
|
|
query = rootQuery.blind.query2 % (queryUser, index)
|
|
|
else:
|
|
|
query = rootQuery.blind.query % (queryUser, index)
|
|
|
|
|
|
role = inject.getValue(query, union=False, error=False)
|
|
|
roles.add(role)
|
|
|
|
|
|
# 23. 将获取到的角色信息添加到缓存中
|
|
|
if roles:
|
|
|
kb.data.cachedUsersRoles[user] = list(roles)
|
|
|
else:
|
|
|
warnMsg = "unable to retrieve the roles "
|
|
|
warnMsg += "for user '%s'" % user
|
|
|
logger.warning(warnMsg)
|
|
|
retrievedUsers.add(user)
|
|
|
# 24. 如果没有获取到用户角色信息，抛出异常
|
|
|
if not kb.data.cachedUsersRoles:
|
|
|
errMsg = "unable to retrieve the roles "
|
|
|
errMsg += "for the database users"
|
|
|
raise SqlmapNoneDataException(errMsg)
|
|
|
|
|
|
# 25. 从角色信息中判断管理员用户
|
|
|
for user, privileges in kb.data.cachedUsersRoles.items():
|
|
|
if isAdminFromPrivileges(privileges):
|
|
|
areAdmins.add(user)
|
|
|
# 26. 返回用户角色信息和管理员用户
|
|
|
return kb.data.cachedUsersRoles, areAdmins |
