fortra/impacket

Unsupported data type on TDS version >=7.2

Open

#877 opened on Jun 9, 2020

View on GitHub
 (2 comments) (0 reactions) (0 assignees)Python (12,244 stars) (3,421 forks)batch import
enhancementhelp wanted

Description

Configuration

impacket version: 0.9.21 Python version: 3.7.7 Target OS: Ubuntu 18.04

Debug Output With Command String

i.e.
smbexec -debug domain/user:password@127.0.0.1

>>> d = tds.TDS_COLMETADATA(b"\x81\x01\x00\x00\x00\x00\x00\x08\x00\x38\x09\x41\x00\x70\x00\x70\x00\x74\x00\x43\x00\x6f\x00\x6c\x00\x6f\x00\x72\x00")
>>> tds.MSSQL('bla').parseColMetaData(d)
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/home/user/.local/lib/python3.7/site-packages/impacket/tds.py", line 1439, in parseColMetaData
    raise Exception("Unsupported data type: 0x%x" % colType)
Exception: Unsupported data type: 0x8

Additional context

This Column Metadata bytes was taken from pcap of TDS version 7.2.

As far as I understand, the problem is size of field userType:

  • until TDS version 7.1, userType size is 2 bytes.
  • since TDS version 7.2, userType size is 4 bytes.

The code of the library assume userType size is 2 bytes.

Contributor guide

Tech stack
python
Domain
backenddatabaseapi
Issue type
bug
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-3 hours
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
stale
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
clear
Prerequisites
Pythonbasic understanding of TDS protocol
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
40
Research direction
The issue is in impacket's tds.py file, specifically in the parseColMetaData method around line 1439. The problem is that the userType field size differs between TDS versions: 2 bytes for versions <7.2 and 4 bytes for versions >=7.2. The code currently always reads 2 bytes. To fix, check the TDS version (likely stored in the MSSQL object) and conditionally read 2 or 4 bytes for userType. Refer to the comments in the issue for more context on the pcap example.