Enabling PostgreSQL file write over a gadget when stacked queries are unavailable

Author: stamparm

lib/core/settings.py

@@ -20,7 +20,7 @@
 from thirdparty import six
 
 # sqlmap version (<major>.<minor>.<month>.<monthly commit>)
-VERSION = "1.10.8.48"
+VERSION = "1.10.8.49"
 TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
 TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}
 VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)

plugins/generic/filesystem.py

@@ -315,6 +315,13 @@ def writeFile(self, localFile, remoteFile, fileType=None, forceCheck=False):
                 debugMsg += "stacked query technique"
                 logger.debug(debugMsg)
 
+            written = self.stackedWriteFile(localFile, remoteFile, fileType, forceCheck)
+            self.cleanup(onlyFileTbl=True)
+        elif Backend.isDbms(DBMS.PGSQL) and inject.getGadget():
+            debugMsg = "going to upload the file '%s' with " % fileType
+            debugMsg += "large object technique through a gadget"
+            logger.debug(debugMsg)
+
             written = self.stackedWriteFile(localFile, remoteFile, fileType, forceCheck)
             self.cleanup(onlyFileTbl=True)
         elif isTechniqueAvailable(PAYLOAD.TECHNIQUE.UNION) and Backend.isDbms(DBMS.MYSQL):