Skip to content

DNS exfiltration issue with null bytes MSSQL #5411

@brenocss

Description

@brenocss

Describe the bug

When performing DNS exfiltration on MS SQL, some responses come in the UTF16 format. SQLmap is not properly handling this case and having trouble pulling the next queries since it "thinks" that the tables, columns, and database have these null bytes characters.

To Reproduce
Exfil dns

Expected behavior
A clear and concise description of what you expected to happen.

Screenshots
image

Running environment:

  • {1.7.5#stable}
  • pip
  • ubuntu
  • Python 3.10.6

Target details:

  • MSSQL
  • SQLi techniques DNS

Additional context
I made this "quick fix" for my case, but it will certainly break in other cases.

@@ -97,6 +97,10 @@ def dnsUse(payload, expression):
             output = decodeDbmsHexValue(output) if conf.hexConvert else output

             kb.dnsMode = False
+            try:
+                output = output.replace('\x00', "")
+            except:
+                pass

Metadata

Metadata

Assignees

Type

No type

Projects

No projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions