Impacket mssqlinstance.py
Back to the Category Index / Back to the Command Index
Overview
Section titled “Overview”Queries SQL Server Browser over UDP to enumerate instance names, ports, versions, and named pipes.
| Item | Details |
|---|---|
| Implementation | examples/mssqlinstance.py |
| Category | MSSQL / Exchange / MQTT |
| Size | 56 lines |
| Distribution | Installed as a script through scripts=examples/*.py in setup.py |
CLI and Inputs
Section titled “CLI and Inputs”Check python examples/mssqlinstance.py -h for the current option definitions.
| Argument | Description |
|---|---|
host | Target host. |
-timeout | Time to wait for a response (default: 5). |
-debug | Enable debug logging. |
-ts | Add timestamps to log output. |
Detailed Processing Flow
Section titled “Detailed Processing Flow”The command creates an MSSQL helper from the host and timeout, sends an instance discovery packet to UDP 1434, parses multiple records according to their separators, and displays each instance’s properties.
How It Works
Section titled “How It Works”SQL Server Browser accepts instance discovery requests on UDP 1434 and returns information about named instances on the host as delimited text records. The command does not log in to a database; it uses only the Browser service discovery protocol to collect instance names, versions, TCP ports, and named pipes.
One datagram may contain several instances, each as a series of key/value pairs. The parser distinguishes instance and field separators and allows missing fields or reordered fields when building a dictionary or table. Instance-name and port fields may differ between default and named instances.
With UDP, a missing response does not mean there are no instances. The Browser service may be stopped, a firewall may block traffic, packets may be lost, multiple interfaces may be involved, or a response may be spoofed. Report a timeout as one piece of evidence, and verify returned hosts and ports separately before connecting automatically.
Key Implementation Elements
Section titled “Key Implementation Elements”| Symbol | Location | Entry Point for Tracing Behavior |
|---|---|---|
| module-level entry | 1 | Parses arguments and runs the operation at the top level |
Dependencies
Section titled “Dependencies”Internal Impacket Modules
Section titled “Internal Impacket Modules”| Module | Main Names Used |
|---|---|
impacket.examples | logger |
impacket | tds, version |
Output, Side Effects, and Required Privileges
Section titled “Output, Side Effects, and Required Privileges”- Primarily queries and authentication attempts. Repeated runs can affect audit logs, account lockouts, and target load.
Failure Paths and Cleanup
Section titled “Failure Paths and Cleanup”- Distinguish missing input files, damaged files, truncated reads, and unsupported formats.
When Changing the Implementation
Section titled “When Changing the Implementation”This small CLI depends on impacket.tds.MSSQL and UDP sockets. Because responses are unauthenticated datagrams, allow for missing or duplicate fields, timeouts, and malformed separators when parsing.
Verification
Section titled “Verification”- Syntax:
python -m py_compile examples/mssqlinstance.py - CLI:
python examples/mssqlinstance.py -h - No test specific to this command was found. Choose shared-module tests and, if needed, a run in an isolated environment.