Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

add support for guid column type in mssql and improve error logging #19016

Merged
merged 1 commit into from
Mar 28, 2024

Conversation

zgoldman-r7
Copy link
Contributor

@zgoldman-r7 zgoldman-r7 commented Mar 27, 2024

This PR adds support for the guid datatype for TDS messaging as previously it would break our mssql message parsing.
Additionally, it makes it more clear what datatype is not supported when running into an instance of an unsupported datatype.
Previously, an unsupported datatype would frequently result in a long string of unsupported token messages, or simply not return anything at all.
Now, we should get specific unsupported column type: <type identifier in decimal> messages, and when we do get unsupported token issues, there should only be one message accompanied by a list of functions run before getting there.

To test guid types:

  • open an mssql instance
  • `CREATE TABLE guid_test (id UNIQUEIDENTIFIER NOT NULL);
  • INSERT INTO guid_test (id) VALUES (NEWID());
    Then do the following on both master and the current branch:
  • connect to the mssql instance in msfconsole
  • either in a session query_interactive shell or using mssql_sql module, run select queries against the database that should return values from the column you created
    In master, this should lead to a string of errors or empty output. In this pr, you should get a column with values that that looks like:
id
--
{00000000-0000-0000-0000-000000000000}

To test unknown column logging:

  • open an mssql instance
  • CREATE TABLE xml_table(Col1 int primary key, Col2 xml);
  • INSERT INTO xml_table values(1,'');
    then on both master and the pr branch:
  • try and query this database using a session's query_interactive or mssql_sql.
    New error:
msf6 auxiliary(admin/mssql/mssql_sql) > rerun CreateSession=true RPORT=1433 RHOSTS=192.168.2.131 USERNAME= PASSWORD= sql='select * from xml_table;' verbose=true database=master
ster
[*] Reloading module...
[*] New in Metasploit 6.4 - This module can target a SESSION or an RHOST
[*] Running module against 192.168.2.131

[*] 192.168.2.131:1433 - SQL Query: select * from xml_explosion_table;
[-] 192.168.2.131:1433 - Unsupported column type: 99.
[*] Auxiliary module execution completed
msf6 auxiliary(admin/mssql/mssql_sql) >

Copy link
Contributor

@ekalinichev-r7 ekalinichev-r7 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Confirmed that it fixes GUID issue, user's complaint query was:

select t.[text] from sys.dm_exec_requests as r cross apply sys.dm_exec_sql_text(r.sql_handle) as t;

Now it fails because we don't support NTEXT type, should add implementation for that and see where it fails next.

Another bug discovered during testing: we cannot handle ORDER BY statements and we should (not related to this PR)

@@ -229,6 +230,10 @@ def mssql_parse_tds_reply(data, info)

else
col[:id] = :unknown

# See https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tds/ce3183a6-9d89-47e8-a02f-de5a1a1303de for details about column types
info[:errors] << "Unsupported column type: #{col[:type]}. "
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should output col[:type] as hex value, because that's what Microsoft uses in their reference doc

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

free tds uses integers, which is where I think the original values came from:

https://www.freetds.org/tds.html

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

(I don't mind hex or decimal output here)

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Makes sense, then let's disregard this suggestion

@zgoldman-r7 zgoldman-r7 changed the title add support for guid column type in mssql add support for guid column type in mssql and improve error logging Mar 27, 2024
@zgoldman-r7 zgoldman-r7 marked this pull request as ready for review March 27, 2024 17:41
@adfoster-r7 adfoster-r7 merged commit 00b9ae3 into rapid7:master Mar 28, 2024
34 checks passed
@adfoster-r7
Copy link
Contributor

Release Notes

Updates the MSSQL modules to support the GUID column type. Also improves error logging.

@adfoster-r7 adfoster-r7 added the rn-enhancement release notes enhancement label Mar 28, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
rn-enhancement release notes enhancement
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants