search

fortra / impacket

Impacket is a collection of Python classes for working with network protocols.
https://www.coresecurity.com
Other
13.51k stars 3.58k forks source link

Impacket : unpack requires a buffer of 1 bytes #1011

Closed PrajjwalBhattrai closed 3 years ago

PrajjwalBhattrai commented 3 years ago

root@kali:/home/kali/impacket# mssqlclient.py ARCHETYPE/sql_svc@10.10.10.27 -windows-auth -debug Impacket v0.9.23.dev1+20201203.125520.aa0c78ad - Copyright 2020 SecureAuth Corporation

[+] Impacket Library Installation Path: /usr/local/lib/python3.8/dist-packages/impacket-0.9.23.dev1+20201203.125520.aa0c78ad-py3.8.egg/impacket Password: [+] Exception: Traceback (most recent call last): File "/usr/local/lib/python3.8/dist-packages/impacket-0.9.23.dev1+20201203.125520.aa0c78ad-py3.8.egg/EGG-INFO/scripts/mssqlclient.py", line 179, in res = ms_sql.login(options.db, username, password, domain, options.hashes, options.windows_auth) File "/usr/local/lib/python3.8/dist-packages/impacket-0.9.23.dev1+20201203.125520.aa0c78ad-py3.8.egg/impacket/tds.py", line 905, in login resp = self.preLogin() File "/usr/local/lib/python3.8/dist-packages/impacket-0.9.23.dev1+20201203.125520.aa0c78ad-py3.8.egg/impacket/tds.py", line 520, in preLogin tds = self.recvTDS() File "/usr/local/lib/python3.8/dist-packages/impacket-0.9.23.dev1+20201203.125520.aa0c78ad-py3.8.egg/impacket/tds.py", line 606, in recvTDS packet = TDSPacket(self.socketRecv(packetSize)) File "/usr/local/lib/python3.8/dist-packages/impacket-0.9.23.dev1+20201203.125520.aa0c78ad-py3.8.egg/impacket/structure.py", line 84, in init self.fromString(data) File "/usr/local/lib/python3.8/dist-packages/impacket-0.9.23.dev1+20201203.125520.aa0c78ad-py3.8.egg/impacket/structure.py", line 149, in fromString self[field[0]] = self.unpack(field[1], data[:size], dataClassOrCode = dataClassOrCode, field = field[0]) File "/usr/local/lib/python3.8/dist-packages/impacket-0.9.23.dev1+20201203.125520.aa0c78ad-py3.8.egg/impacket/structure.py", line 382, in unpack return unpack(format, data)[0] struct.error: ('unpack requires a buffer of 1 bytes', "When unpacking field 'Type | <B | b''[:1]'") [-] ('unpack requires a buffer of 1 bytes', "When unpacking field 'Type | <B | b''[:1]'")

mohemiv commented 3 years ago

Hi @PrajjwalBhattrai, Could you please make a pcap file for this?

redskal commented 3 years ago

I'm getting the same issue. Using current Kali Linux release VM. Tried reverting back to 0.9.21 but getting the same error. Attached is a pcap dump file.

pcap.zip

EDIT: I've since tried connecting to the same server with DBeaver and had the same issue. So I believe this is a server-side issue. It's worth noting I'm working on the same server as Prajjwal.

PrajjwalBhattrai commented 3 years ago

@redskal are u also doing Hackthebox.

redskal commented 3 years ago

Yes, Just started yesterday. Startingpoint server was also refusing the psexec.py attack. It actually got taken offline not long after I commented so I guess there were issues.

mohemiv commented 3 years ago

As you can see, the server just closed the connection after the client sent the pre-login message. I'm not very familiar with the SQL Server protocol, but I think this is the server's issue. If you will succeed to connect to this server using other SQL Server clients, e.g. HeidiSQL or SQL Server Management Studio, please attach a pcap file for the connection, and we will see what the issue was.

ChamDK commented 3 years ago

Same here, diffrent "box" same error.

ajmcmiddlin commented 3 years ago

I hit this error on hackthebox.eu about the time this issue was posted. I went back the next day and it worked as expected. I believe this adds weight to the idea that it's an issue with the service and not this package.