Impacket checkMSSQLStatus.py
Back to the Category Index / Back to the Command Index
Overview
Section titled “Overview”Compares SQL Server login responses to determine whether TLS channel binding is required.
| Item | Details |
|---|---|
| Implementation | examples/checkMSSQLStatus.py |
| Category | MSSQL / Exchange / MQTT |
| Size | 154 lines |
| Distribution | Installed as a script through scripts=examples/*.py in setup.py |
CLI and Inputs
Section titled “CLI and Inputs”Check python examples/checkMSSQLStatus.py -h for the current option definitions.
| Argument | Description |
|---|---|
target | [[domain/]username[:password]@]<targetName or address> |
-port | MSSQL port (default: 1433). |
-debug | Enable debug logging. |
-ts | Add timestamps to log output. |
-hashes | NTLM hashes. |
-no-pass | Skip the password prompt (useful with -k). |
-k | Use Kerberos authentication with the ccache specified by KRB5CCNAME. |
-aesKey | 128- or 256-bit AES key for Kerberos. |
-dc-ip | Domain controller IP address. |
-target-ip | Target IP address, overriding name resolution for the target. |
Detailed Processing Flow
Section titled “Detailed Processing Flow”The command performs TDS pre-login and establishes a TLS connection according to the server’s encryption settings. It constructs logins with correct, missing, and invalid channel bindings, then compares server responses to determine the policy. The target parser resolves SQL/Windows authentication and connection options.
How It Works
Section titled “How It Works”MSSQL channel binding ties the TLS channel to the Windows/NTLM authentication performed over it. The client creates channel-binding data from the server certificate and includes it in the NTLM authenticate message’s AV pair/MIC calculation. If the server is configured to validate CBT, it can reject values taken from a different TLS channel or omitted entirely.
_new_conn() creates a fresh TCP/TLS session from TDS pre-login for each
attempt, because reusing one session would prevent independent comparison
of CBT conditions. It reads the pre-login encryption negotiation, wraps
the socket in TLS when needed, and sends login tokens with valid, invalid, or missing bindings.
The result depends on differences between conditions, not just whether one login succeeds. Incorrect credentials, SQL-only login support, or a failed TLS certificate check or handshake prevent a CBT policy determination. Preserve TDS error tokens and disconnects to distinguish enforced, unenforced, and indeterminate results.
Key Implementation Elements
Section titled “Key Implementation Elements”| Symbol | Location | Entry Point for Tracing Behavior |
|---|---|---|
MSQLCBTCheck | 24 | __init__(), run() |
Dependencies
Section titled “Dependencies”Internal Impacket Modules
Section titled “Internal Impacket Modules”| Module | Main Names Used |
|---|---|
impacket | version |
impacket.examples | logger |
impacket.examples.utils | parse_target |
impacket.tds | MSSQL, TDS_ENCRYPT_OFF, TDS_ENCRYPT_REQ |
Output, Side Effects, and Required Privileges
Section titled “Output, Side Effects, and Required Privileges”- Primarily queries and authentication attempts. Repeated runs can affect audit logs, account lockouts, and target load.
Failure Paths and Cleanup
Section titled “Failure Paths and Cleanup”- On failure, use protocol status to determine whether name resolution, connection, authentication, service state, or permissions stopped the operation.
When Changing the Implementation
Section titled “When Changing the Implementation”This command depends on impacket.tds.MSSQL, TDS encryption constants, and TLS/NTLM helpers. MSQLCBTCheck._new_conn() isolates state for each attempt, while _login() / run() compare the results. Do not reuse TLS or session state between attempts.
Verification
Section titled “Verification”- Syntax:
python -m py_compile examples/checkMSSQLStatus.py - CLI:
python examples/checkMSSQLStatus.py -h - Related test:
tests/misc/test_tds.py