infosecn1nja
/
C3
mirror of https://github.com/infosecn1nja/C3.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Use RAII style HANDLES

dependabot/npm_and_yarn/Src/WebController/UI/websocket-extensions-0.1.4
Grzegorz Rychlik 2020-05-12 17:13:54 +02:00
parent 4f254e31dc
commit c822094de5
2 changed files with 12 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
Src/Common/FSecure/C3/Interfaces/Channels/MSSQL.cpp
View File

@ -27,15 +27,17 @@ FSecure::C3::Interfaces::Channels::MSSQL::MSSQL(ByteView arguments)
if (!LogonUserA(user.c_str(), domain.c_str(), this->m_password.c_str(), LOGON32_LOGON_NEW_CREDENTIALS, LOGON32_PROVIDER_WINNT50, &hToken)) if (!LogonUserA(user.c_str(), domain.c_str(), this->m_password.c_str(), LOGON32_LOGON_NEW_CREDENTIALS, LOGON32_PROVIDER_WINNT50, &hToken))
throw std::runtime_error("[x] error creating Token"); throw std::runtime_error("[x] error creating Token");
auto userToken = WinTools::UniqueHandle(hToken);
if (!DuplicateTokenEx(hToken, MAXIMUM_ALLOWED, NULL, SecurityImpersonation, TokenImpersonation, &m_impersonationToken)) HANDLE impersonationToken;
if (!DuplicateTokenEx(hToken, MAXIMUM_ALLOWED, NULL, SecurityImpersonation, TokenImpersonation, &impersonationToken))
throw std::runtime_error("[x] error duplicating token"); throw std::runtime_error("[x] error duplicating token");
CloseHandle(hToken); m_impersonationToken = WinTools::UniqueHandle(impersonationToken);
} }
Sql::Enviroment env; Sql::Enviroment env;
auto conn = env.Connect(m_servername, m_databasename, m_username, m_password, m_useSSPI, m_impersonationToken); auto conn = env.Connect(m_servername, m_databasename, m_username, m_password, m_useSSPI, m_impersonationToken.get());
//Initial SQL Query is to identify if m_tablename exists //Initial SQL Query is to identify if m_tablename exists
std::string stmtString = OBF("Select * FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_NAME = '") + m_tablename + OBF("';"); std::string stmtString = OBF("Select * FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_NAME = '") + m_tablename + OBF("';");
@ -55,7 +57,7 @@ size_t FSecure::C3::Interfaces::Channels::MSSQL::OnSendToChannel(FSecure::ByteVi
{ {
//connect to the database //connect to the database
Sql::Enviroment env; Sql::Enviroment env;
auto conn = env.Connect(m_servername, m_databasename, m_username, m_password, m_useSSPI, m_impersonationToken); auto conn = env.Connect(m_servername, m_databasename, m_username, m_password, m_useSSPI, m_impersonationToken.get());
size_t bytesWritten = 0; size_t bytesWritten = 0;
std::string b64packet = ""; std::string b64packet = "";
@ -84,7 +86,7 @@ std::vector<FSecure::ByteVector> FSecure::C3::Interfaces::Channels::MSSQL::OnRec
{ {
//connect to the database //connect to the database
Sql::Enviroment env; Sql::Enviroment env;
auto conn = env.Connect(m_servername, m_databasename, m_username, m_password, m_useSSPI, m_impersonationToken); auto conn = env.Connect(m_servername, m_databasename, m_username, m_password, m_useSSPI, m_impersonationToken.get());
const auto stmt = OBF("SELECT TOP 100 * FROM dbo.") + this->m_tablename + OBF(" WHERE MSGID = '") + this->m_inboundDirectionName + OBF("';"); const auto stmt = OBF("SELECT TOP 100 * FROM dbo.") + this->m_tablename + OBF(" WHERE MSGID = '") + this->m_inboundDirectionName + OBF("';");
auto hStmt = conn.MakeStatement(stmt); auto hStmt = conn.MakeStatement(stmt);
@ -141,7 +143,7 @@ FSecure::ByteVector FSecure::C3::Interfaces::Channels::MSSQL::OnRunCommand(ByteV
FSecure::ByteVector FSecure::C3::Interfaces::Channels::MSSQL::ClearTable() FSecure::ByteVector FSecure::C3::Interfaces::Channels::MSSQL::ClearTable()
{ {
Sql::Enviroment env; Sql::Enviroment env;
auto conn = env.Connect(m_servername, m_databasename, m_username, m_password, m_useSSPI, m_impersonationToken); auto conn = env.Connect(m_servername, m_databasename, m_username, m_password, m_useSSPI, m_impersonationToken.get());
{ {
const auto deleteStmt = OBF("DELETE FROM dbo.") + this->m_tablename + ";"; const auto deleteStmt = OBF("DELETE FROM dbo.") + this->m_tablename + ";";

10
Src/Common/FSecure/C3/Interfaces/Channels/MSSQL.h
View File

@ -1,8 +1,6 @@
#pragma once #pragma once
#include <sqlext.h> #include "Common/FSecure/WinTools/UniqueHandle.h"
#include <sqltypes.h>
#include <sql.h>
namespace FSecure::C3::Interfaces::Channels namespace FSecure::C3::Interfaces::Channels
{ {
@ -37,13 +35,13 @@ namespace FSecure::C3::Interfaces::Channels
/// Explicit values used as the defaults for Channel's UpdateDelayJitter. Values can be changed later, at runtime. /// Explicit values used as the defaults for Channel's UpdateDelayJitter. Values can be changed later, at runtime.
constexpr static std::chrono::milliseconds s_MinUpdateDelay = 1000ms, s_MaxUpdateDelay = 1000ms; constexpr static std::chrono::milliseconds s_MinUpdateDelay = 1000ms, s_MaxUpdateDelay = 1000ms;
protected:
private:
/// The inbound direction name of data /// The inbound direction name of data
std::string m_inboundDirectionName; std::string m_inboundDirectionName;
/// The outbound direction name, the opposite of m_inboundDirectionName /// The outbound direction name, the opposite of m_inboundDirectionName
std::string m_outboundDirectionName; std::string m_outboundDirectionName;
private:
/// The server name to handle communication /// The server name to handle communication
std::string m_servername; std::string m_servername;
@ -59,7 +57,7 @@ namespace FSecure::C3::Interfaces::Channels
/// The password for the user /// The password for the user
std::string m_password; std::string m_password;
HANDLE m_impersonationToken; WinTools::UniqueHandle m_impersonationToken;
bool m_useSSPI = false; bool m_useSSPI = false;
}; };