From b35f8afe3b4b2ae276535c26895429c2f6ab1936 Mon Sep 17 00:00:00 2001 From: ekultek Date: Fri, 10 Nov 2017 14:30:01 -0600 Subject: [PATCH] is now able to parse sqlmap configuration files, so if you have a saved conf file from sqlmap that you like to use, you can use it here with the --sqlmap-conf flag --- etc/checksum/md5sum.md5 | 6 +++--- lib/attacks/sqlmap_scan/__init__.py | 4 +++- lib/core/settings.py | 29 ++++++++++++++++++++++++++--- zeus.py | 5 ++++- 4 files changed, 36 insertions(+), 8 deletions(-) diff --git a/etc/checksum/md5sum.md5 b/etc/checksum/md5sum.md5 index 065e959..2bd4409 100644 --- a/etc/checksum/md5sum.md5 +++ b/etc/checksum/md5sum.md5 @@ -1,4 +1,4 @@ -aea6086fdee5726e552046c4305ca31f ./zeus.py +8bccb97e08a1bcc4790c51db3d499aa3 ./zeus.py 4b32db388e8acda35570c734d27c950c ./etc/scripts/launch_sqlmap.sh 6ad5f22ec4a6f8324bfb1b01ab6d51ec ./etc/scripts/cleanup.sh 155c9482f690f1482f324a7ffd8b8098 ./etc/scripts/fix_pie.sh @@ -40,7 +40,7 @@ a0fedc86cfb4a370e6c1a606010812ed ./lib/tamper_scripts/space2null_encode.pyc d41d8cd98f00b204e9800998ecf8427e ./lib/__init__.py 3308a53435cd255107a9301723844d6e ./lib/attacks/clickjacking_scan/__init__.py d41d8cd98f00b204e9800998ecf8427e ./lib/attacks/__init__.py -a8cc494d25325a8cbce38004922579e3 ./lib/attacks/sqlmap_scan/__init__.py +edccc33b3d853c2f06027cbbb6e93b01 ./lib/attacks/sqlmap_scan/__init__.py 5e5bb575014ebe613db6bf671d008cf8 ./lib/attacks/sqlmap_scan/sqlmap_opts.py d41d8cd98f00b204e9800998ecf8427e ./lib/attacks/whois_lookup/__init__.py d8fab18b15d1546f6585fe926c27868f ./lib/attacks/whois_lookup/whois.py @@ -50,7 +50,7 @@ b1c3413ca94bb98be64e1ebfedf156ae ./lib/attacks/xss_scan/__init__.py 21faf4679cdeaa731029a48f8963d6e7 ./lib/attacks/nmap_scan/nmap_opts.py 1faa2b5dfad6eb538bbfe42942d2a9da ./lib/core/errors.py d41d8cd98f00b204e9800998ecf8427e ./lib/core/__init__.py -3503406a8e7674bcc10c792828ea9deb ./lib/core/settings.py +c13c469a791a06ebab05c901f12102c6 ./lib/core/settings.py f2ad9e0f0177484c2ab00bbd3ee52153 ./lib/header_check/__init__.py d41d8cd98f00b204e9800998ecf8427e ./var/google_search/__init__.py a576adcbf0c7c4e7feca1016d632e53b ./var/google_search/search.py diff --git a/lib/attacks/sqlmap_scan/__init__.py b/lib/attacks/sqlmap_scan/__init__.py index 5b75134..b048aaa 100644 --- a/lib/attacks/sqlmap_scan/__init__.py +++ b/lib/attacks/sqlmap_scan/__init__.py @@ -12,6 +12,7 @@ import requests import lib.core.settings import lib.core.errors +import lib.attacks from var.auto_issue.github import request_issue_creation @@ -144,10 +145,11 @@ def find_sqlmap(to_find="sqlmap"): return found_path -def sqlmap_scan_main(url, port=None, verbose=None, opts=None, auto_start=False): +def sqlmap_scan_main(url, port=None, verbose=None, opts=None, auto_start=False, **kwargs): """ the main function that will be called and initialize everything """ + parse_conf = kwargs.get("parse_conf", None) def ___dict_args(): """ diff --git a/lib/core/settings.py b/lib/core/settings.py index de39762..dfc95a7 100644 --- a/lib/core/settings.py +++ b/lib/core/settings.py @@ -53,7 +53,7 @@ PATCH_ID = str(subprocess.check_output(["git", "rev-parse", "origin/master"]))[: CLONE = "https://github.com/ekultek/zeus-scanner.git" # current version -VERSION = "1.2.1.{}".format(PATCH_ID) +VERSION = "1.2.2".format(PATCH_ID) # colors to output depending on the version VERSION_TYPE_COLORS = {"dev": 33, "stable": 92, "other": 30} @@ -277,6 +277,20 @@ def find_running_opts(options): return dict(opts_being_used) +def parse_conf_file(config_path): + set_options = [] + skip_opt_schema = ("", "False", "0") + parser = ConfigParser.ConfigParser(allow_no_value=True) + parser.read(config_path) + sections = parser.sections() + for section in sections: + if not section == "url": + for opt in parser.options(section): + if not any(schema == str(parser.get(section, opt)) for schema in skip_opt_schema): + set_options.append((str(opt), str(parser.get(section, opt)))) + return set_options + + def set_color(org_string, level=None): """ set the console log color, this will kinda mess with the file log but whatever @@ -711,13 +725,21 @@ def create_arguments(**kwargs): sqlmap = kwargs.get("sqlmap", False) sqlmap_args = kwargs.get("sqlmap_args", None) nmap_args = kwargs.get("nmap_args", None) + conf_file = kwargs.get("conf", None) logger.info(set_color( "creating arguments for {}...".format("sqlmap" if sqlmap else "nmap") )) retval = [] splitter = {"sqlmap": ",", "nmap": "|"} - if sqlmap: + if conf_file is not None: + set_options = parse_conf_file(conf_file) + for opt in set_options: + for o in SQLMAP_API_OPTIONS: + if not opt[0] == "url": + if o.lower() == opt[0]: + retval.append((o, opt[1])) + elif sqlmap: warn_msg = "option '{}' is not recognized by sqlmap API, skipping..." if sqlmap_args is not None: for line in sqlmap_args.split(splitter["sqlmap"]): @@ -861,6 +883,7 @@ def run_attacks(url, **kwargs): forwarded = kwargs.get("xforward", None) proxy = kwargs.get("proxy", None) agent = kwargs.get("agent", None) + conf_file = kwargs.get("conf_file", None) __enabled_attacks = { "sqlmap": sqlmap, @@ -900,7 +923,7 @@ def run_attacks(url, **kwargs): if sqlmap: return sqlmap_scan.sqlmap_scan_main( url.strip(), verbose=verbose, - opts=create_arguments(sqlmap=True, sqlmap_args=sqlmap_arguments), auto_start=auto_start) + opts=create_arguments(sqlmap=True, sqlmap_args=sqlmap_arguments, conf=conf_file), auto_start=auto_start) elif nmap: url_ip_address = replace_http(url.strip()) return nmap_scan.perform_port_scan( diff --git a/zeus.py b/zeus.py index f875c86..7388804 100755 --- a/zeus.py +++ b/zeus.py @@ -88,6 +88,8 @@ if __name__ == "__main__": attacks.add_option("--sqlmap-args", dest="sqlmapArguments", metavar="SQLMAP-ARGS", help="Pass the arguments to send to the sqlmap API within quotes & " "separated by a comma. IE 'dbms mysql, verbose 3, level 5'") + attacks.add_option("--sqlmap-conf", dest="sqlmapConfigFile", metavar="CONFIG-FILE-PATH", + help="Pass a configuration file that contains the sqlmap arguments") attacks.add_option("--nmap-args", dest="nmapArguments", metavar="NMAP-ARGS", help="Pass the arguments to send to the nmap API within quotes & " "separated by a pipe. IE '-O|-p 445, 1080'") @@ -299,7 +301,8 @@ if __name__ == "__main__": run_ip=opt.runAgainstIpAddress, # TODO:/ completely remove show_all=opt.showAllConnections, do_threading=opt.threadPanels, tamper_script=opt.tamperXssPayloads, - timeout=opt.controlTimeout, proxy=proxy_to_use, agent=agent_to_use + timeout=opt.controlTimeout, proxy=proxy_to_use, agent=agent_to_use, + conf_file=opt.sqlmapConfigFile )