D7net
Home
Console
Upload
information
Create File
Create Folder
About
Tools
:
/
usr
/
share
/
nmap
/
nselib
/
Filename :
mysql.lua
back
Copy
--- -- Simple MySQL Library supporting a very limited subset of operations. -- -- http://forge.mysql.com/wiki/MySQL_Internals_ClientServer_Protocol -- -- @copyright Same as Nmap--See http://nmap.org/book/man-legal.html -- -- @author "Patrik Karlsson <patrik@cqure.net>" local bin = require "bin" local bit = require "bit" local nmap = require "nmap" local stdnse = require "stdnse" local string = require "string" local table = require "table" _ENV = stdnse.module("mysql", stdnse.seeall) -- Version 0.3 -- -- Created 01/15/2010 - v0.1 - created by Patrik Karlsson <patrik@cqure.net> -- Revised 01/23/2010 - v0.2 - added query support, cleanup, documentation -- Revised 08/24/2010 - v0.3 - added error handling for recieveGreeting -- fixed a number of incorrect receives and changed -- them to receive_bytes instead. local tab = require('tab') local HAVE_SSL, openssl = pcall(require,'openssl') Capabilities = { LongPassword = 0x1, FoundRows = 0x2, LongColumnFlag = 0x4, ConnectWithDatabase = 0x8, DontAllowDatabaseTableColumn = 0x10, SupportsCompression = 0x20, ODBCClient = 0x40, SupportsLoadDataLocal = 0x80, IgnoreSpaceBeforeParenthesis = 0x100, Speaks41ProtocolNew = 0x200, InteractiveClient = 0x400, SwitchToSSLAfterHandshake = 0x800, IgnoreSigpipes = 0x1000, SupportsTransactions = 0x2000, Speaks41ProtocolOld = 0x4000, Support41Auth = 0x8000 } ExtCapabilities = { SupportsMultipleStatments = 0x1, SupportsMultipleResults = 0x2 } Charset = { latin1_COLLATE_latin1_swedish_ci = 0x8 } ServerStatus = { InTransaction = 0x1, AutoCommit = 0x2, MoreResults = 0x4, MultiQuery = 0x8, BadIndexUsed = 0x10, NoIndexUsed = 0x20, CursorExists = 0x40, LastRowSebd = 0x80, DatabaseDropped = 0x100, NoBackslashEscapes = 0x200 } Command = { Query = 3 } local MAXPACKET = 16777216 local HEADER_SIZE = 4 --- Parses a MySQL header -- -- @param data string of raw data -- @return response table containing the fields <code>len</code> and <code>packetno</code> local function decodeHeader( data, pos ) local response = {} local pos, tmp = pos or 1, 0 pos, tmp = bin.unpack( "I", data, pos ) response.len = bit.band( tmp,255 ) response.number = bit.rshift( tmp, 24 ) return pos, response end --- Recieves the server greeting upon intial connection -- -- @param socket already connected to the remote server -- @return status true on success, false on failure -- @return response table with the following fields <code>proto</code>, <code>version</code>, -- <code>threadid</code>, <code>salt</code>, <code>capabilities</code>, <code>charset</code> and -- <code>status</code> or error message on failure (status == false) function receiveGreeting( socket ) local catch = function() socket:close() stdnse.print_debug("receiveGreeting(): failed") end local try = nmap.new_try(catch) local data = try( socket:receive_bytes(HEADER_SIZE) ) local pos, response, tmp, _ pos, response = decodeHeader( data, 1 ) -- do we need to read the remainder if ( #data - HEADER_SIZE < response.len ) then local tmp = try( socket:receive_bytes( response.len - #data + HEADER_SIZE ) ) data = data .. tmp end local is_error pos, is_error = bin.unpack( "C", data, pos ) if ( is_error == 0xff ) then pos, response.errorcode = bin.unpack( "S", data, pos ) pos, response.errormsg = bin.unpack("A" .. (#data - pos + 1), data, pos ) return false, response.errormsg end pos, response.proto = bin.unpack( "C", data, pos ) pos, response.version = bin.unpack( "z", data, pos ) pos, response.threadid = bin.unpack( "I", data, pos ) pos, response.salt, _ = bin.unpack( "A8C", data, pos ) pos, response.capabilities = bin.unpack( "S", data, pos ) pos, response.charset = bin.unpack( "C", data, pos ) pos, response.status = bin.unpack( "S", data, pos ) pos, _ = bin.unpack( "A13", data, pos ) pos, tmp = bin.unpack( "A12", data, pos ) response.salt = response.salt .. tmp response.errorcode = 0 return true, response end --- Creates a hashed value of the password and salt according to MySQL authentication post version 4.1 -- -- @param pass string containing the users password -- @param salt string containing the servers salt as obtained from <code>receiveGreeting</code> -- @return reply string containing the raw hashed value local function createLoginHash(pass, salt) local hash_stage1 local hash_stage2 local hash_stage3 local reply = "" local pos, b1, b2, b3, _ = 1, 0, 0, 0 if ( not(HAVE_SSL) ) then return nil end hash_stage1 = openssl.sha1( pass ) hash_stage2 = openssl.sha1( hash_stage1 ) hash_stage3 = openssl.sha1( salt .. hash_stage2 ) for pos=1, hash_stage1:len() do _, b1 = bin.unpack( "C", hash_stage1, pos ) _, b2 = bin.unpack( "C", hash_stage3, pos ) reply = reply .. string.char( bit.bxor( b2, b1 ) ) end return reply end --- Attempts to Login to the remote mysql server -- -- @param socket already connected to the remote server -- @param params table with additional options to the loginrequest -- current supported fields are <code>charset</code> and <code>authversion</code> -- authversion is either "pre41" or "post41" (default is post41) -- currently only post41 authentication is supported -- @param username string containing the username of the user that is authenticating -- @param password string containing the users password or nil if empty -- @param salt string containing the servers salt as recieved from <code>receiveGreeting</code> -- @return status boolean -- @return response table or error message on failure function loginRequest( socket, params, username, password, salt ) local catch = function() socket:close() stdnse.print_debug("loginRequest(): failed") end local try = nmap.new_try(catch) local packetno = 1 local authversion = params.authversion or "post41" local username = username or "" if not(HAVE_SSL) then return false, "No OpenSSL" end if authversion ~= "post41" then return false, "Unsupported authentication version: " .. authversion end local clicap = Capabilities.LongPassword clicap = clicap + Capabilities.LongColumnFlag clicap = clicap + Capabilities.SupportsLoadDataLocal clicap = clicap + Capabilities.Speaks41ProtocolNew clicap = clicap + Capabilities.InteractiveClient clicap = clicap + Capabilities.SupportsTransactions clicap = clicap + Capabilities.Support41Auth local extcapabilities = ExtCapabilities.SupportsMultipleStatments extcapabilities = extcapabilities + ExtCapabilities.SupportsMultipleResults local packet = bin.pack( "S", clicap ) packet = packet .. bin.pack( "S", extcapabilities ) packet = packet .. bin.pack( "I", MAXPACKET ) packet = packet .. bin.pack( "C", Charset.latin1_COLLATE_latin1_swedish_ci ) packet = packet .. bin.pack( "A", string.char(0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0) ) packet = packet .. bin.pack( "z", username ) if ( password ~= nil and password:len() > 0 ) then local hash = createLoginHash( password, salt ) packet = packet .. bin.pack( "A", string.char( 0x14 ) .. hash ) else packet = packet .. bin.pack( "C", 0 ) end local tmp = packet:len() + bit.lshift( packetno, 24 ) packet = bin.pack( "I", tmp ) .. packet try( socket:send(packet) ) packet = try( socket:receive_bytes(HEADER_SIZE) ) local pos, response = decodeHeader( packet ) -- do we need to read the remainder if ( #packet - HEADER_SIZE < response.len ) then local tmp = try( socket:receive_bytes( response.len - #packet + HEADER_SIZE ) ) packet = packet .. tmp end local is_error pos, is_error = bin.unpack( "C", packet, pos ) if is_error > 0 then pos, response.errorcode = bin.unpack( "S", packet, pos ) local has_sqlstate pos, has_sqlstate = bin.unpack( "C", packet, pos ) if has_sqlstate == 35 then pos, response.sqlstate = bin.unpack( "A5", packet, pos ) end pos, response.errormessage = bin.unpack( "z", packet, pos ) return false, response.errormessage else response.errorcode = 0 pos, response.affectedrows = bin.unpack( "C", packet, pos ) pos, response.serverstatus = bin.unpack( "S", packet, pos ) pos, response.warnings = bin.unpack( "S", packet, pos ) end return true, response end --- Decodes a single column field -- -- http://forge.mysql.com/wiki/MySQL_Internals_ClientServer_Protocol#Field_Packet -- -- @param data string containing field packets -- @param pos number containing position from which to start decoding -- the position should point to the data in this buffer (ie. after the header) -- @return pos number containing the position after the field was decoded -- @return field table containing <code>catalog</code>, <code>database</code>, <code>table</code>, -- <code>origt_table</code>, <code>name</code>, <code>orig_name</code>, -- <code>length</code> and <code>type</code> function decodeField( data, pos ) local header, len local def, _ local field = {} pos, len = bin.unpack( "C", data, pos ) pos, field.catalog = bin.unpack( "A" .. len, data, pos ) pos, len = bin.unpack( "C", data, pos ) pos, field.database = bin.unpack( "A" .. len, data, pos ) pos, len = bin.unpack( "C", data, pos ) pos, field.table = bin.unpack( "A" .. len, data, pos ) pos, len = bin.unpack( "C", data, pos ) pos, field.orig_table = bin.unpack( "A" .. len, data, pos ) pos, len = bin.unpack( "C", data, pos ) pos, field.name = bin.unpack( "A" .. len, data, pos ) pos, len = bin.unpack( "C", data, pos ) pos, field.orig_name = bin.unpack( "A" .. len, data, pos ) -- should be 0x0C pos, _ = bin.unpack( "C", data, pos ) -- charset, in my case 0x0800 pos, _ = bin.unpack( "S", data, pos ) pos, field.length = bin.unpack( "I", data, pos ) pos, field.type = bin.unpack( "A6", data, pos ) return pos, field end --- Decodes the result set header packet into it's sub components -- -- ref: http://forge.mysql.com/wiki/MySQL_Internals_ClientServer_Protocol#Result_Set_Header_Packet -- -- @param socket socket already connected to MySQL server -- @return table containing the following <code>header</code>, <code>fields</code> and <code>data</code> function decodeQueryResponse( socket ) local catch = function() socket:close() stdnse.print_debug("decodeQueryResponse(): failed") end local try = nmap.new_try(catch) local data, header, pos local rs, blocks = {}, {} local block_start, block_end local EOF_MARKER = 254 data = try( socket:receive_bytes(HEADER_SIZE) ) pos, header = decodeHeader( data, pos ) -- -- First, Let's attempt to read the "Result Set Header Packet" -- if data:len() < header.len then data = data .. try( socket:receive_bytes( header.len - #data + HEADER_SIZE ) ) end rs.header = data:sub( 1, HEADER_SIZE + header.len ) -- abort on MySQL error if rs.header:sub(HEADER_SIZE + 1, HEADER_SIZE + 1) == string.char(0xFF) then -- is this a 4.0 or 4.1 error message if rs.header:find("#") then return false, rs.header:sub(HEADER_SIZE+10) else return false, rs.header:sub(HEADER_SIZE+4) end end pos = HEADER_SIZE + header.len + 1 -- Second, Let's attempt to read the "Field Packets" and "Row Data Packets" -- They're separated by an "EOF Packet" for i=1,2 do -- marks the start of our block block_start = pos while true do if data:len() - pos < HEADER_SIZE then data = data .. try( socket:receive_bytes( HEADER_SIZE - ( data:len() - pos ) ) ) end pos, header = decodeHeader( data, pos ) if data:len() - pos < header.len - 1 then data = data .. try( socket:receive_bytes( header.len - ( data:len() - pos ) ) ) end if header.len > 0 then local _, b = bin.unpack("C", data, pos ) -- Is this the EOF packet? if b == EOF_MARKER then -- we don't want the EOF Packet included block_end = pos - HEADER_SIZE pos = pos + header.len break end end pos = pos + header.len end blocks[i] = data:sub( block_start, block_end ) end rs.fields = blocks[1] rs.data = blocks[2] return true, rs end --- Decodes as field packet and returns a table of field tables -- -- ref: http://forge.mysql.com/wiki/MySQL_Internals_ClientServer_Protocol#Field_Packet -- -- @param data string containing field packets -- @param count number containing the amount of fields to decode -- @return status boolean (true on success, false on failure) -- @return fields table containing field tables as returned by <code>decodeField</code> -- or string containing error message if status is false function decodeFieldPackets( data, count ) local pos, header local field, fields = {}, {} if count < 1 then return false, "Field count was less than one, aborting" end for i=1, count do pos, header = decodeHeader( data, pos ) pos, field = decodeField( data, pos ) table.insert( fields, field ) end return true, fields end -- Decodes the result set header -- -- ref: http://forge.mysql.com/wiki/MySQL_Internals_ClientServer_Protocol#Result_Set_Header_Packet -- -- @param data string containing the result set header packet -- @return number containing the amount of fields function decodeResultSetHeader( data ) local _, fields if data:len() ~= HEADER_SIZE + 1 then return false, "Result set header was incorrect" end _, fields = bin.unpack( "C", data, HEADER_SIZE + 1 ) return true, fields end --- Decodes the row data -- -- ref: http://forge.mysql.com/wiki/MySQL_Internals_ClientServer_Protocol#Row_Data_Packet -- -- @param data string containing the row data packet -- @param count number containing the number of fields to decode -- @return status true on success, false on failure -- @return rows table containing row tables function decodeDataPackets( data, count ) local len, pos = 0, 1, 1 local header, row, rows = {}, {}, {} while pos < data:len() do row = {} pos, header = decodeHeader( data, pos ) for i=1, count do pos, len = bin.unpack("C", data, pos ) pos, row[i] = bin.unpack("A" .. len, data, pos) end table.insert( rows, row ) end return true, rows end --- Sends the query to the MySQL server and then attempts to decode the response -- -- @param socket socket already connected to mysql -- @param query string containing the sql query -- @return status true on success, false on failure -- @return rows table containing row tabels as decoded by <code>decodeDataPackets</code> function sqlQuery( socket, query ) local catch = function() socket:close() stdnse.print_debug("sqlQuery(): failed") end local try = nmap.new_try(catch) local packetno = 0 local querylen = query:len() + 1 local packet, packet_len, pos, header local status, fields, field_count, rows, rs packet = bin.pack("ICA", querylen, Command.Query, query ) -- -- http://forge.mysql.com/wiki/MySQL_Internals_ClientServer_Protocol#Result_Set_Header_Packet -- -- (Result Set Header Packet) the number of columns -- (Field Packets) column descriptors -- (EOF Packet) marker: end of Field Packets -- (Row Data Packets) row contents -- (EOF Packet) marker: end of Data Packets try( socket:send(packet) ) -- -- Let's read all the data into a table -- This way we avoid the hustle with reading from the socket status, rs = decodeQueryResponse( socket ) if not status then return false, rs end status, field_count = decodeResultSetHeader(rs.header) if not status then return false, field_count end status, fields = decodeFieldPackets(rs.fields, field_count) if not status then return false, fields end status, rows = decodeDataPackets(rs.data, field_count) if not status then return false, rows end return true, { cols = fields, rows = rows } end --- -- Formats the resultset returned from <code>sqlQuery</code> -- -- @param rs table as returned from <code>sqlQuery</code> -- @param options table containing additional options, currently: -- - <code>noheaders</code> - does not include column names in result -- @return string containing the formated resultset table function formatResultset(rs, options) options = options or {} if ( not(rs) or not(rs.cols) or not(rs.rows) ) then return end local restab = tab.new(#rs.cols) local colnames = {} if ( not(options.noheaders) ) then for _, col in ipairs(rs.cols) do table.insert(colnames, col.name) end tab.addrow(restab, table.unpack(colnames)) end for _, row in ipairs(rs.rows) do tab.addrow(restab, table.unpack(row)) end return tab.dump(restab) end return _ENV;