NSE: Multiple Bugs in ms-sql-* scripts (e.g. ms-sql-info) #2622
Description
Describe the bug
The ms-sql-info NSE script fails to run:
Starting Nmap 7.93 ( https://nmap.org ) at 2023-03-15 10:50 CET
Nmap scan report for localhost (127.0.0.1)
Host is up (0.000078s latency).
PORT STATE SERVICE VERSION
1433/tcp open ms-sql-s Microsoft SQL Server 2019 15.00.4188.00; CU14
|_ms-sql-info: ERROR: Script execution failed (use -d to debug)
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 6.76 seconds
Stack Trace:
NSE: ms-sql-info against 127.0.0.1:1433 threw an error!
attempt to index a nil value
stack traceback:
[C]: in for iterator 'for iterator'
/usr/bin/../share/nmap/nselib/mssql.lua:3334: in function </usr/bin/../share/nmap/nselib/mssql.lua:3327>
(...tail calls...)
Completed NSE at 10:51, 0.01s elapsed
To Reproduce
Run the following nmap scan against a single instance of mssql server (e.g. SQL Server 2019):
sudo nmap -sS -p 1433 --script ms-sql-info -sV 127.0.0.1
Expected behavior
Expecting the full NSE script output for ms-sql-info:
─$ sudo nmap -sS -p 1433 --script ms-sql-info -sV 127.0.0.1
Starting Nmap 7.93 ( https://nmap.org ) at 2023-03-15 12:21 CET
Nmap scan report for localhost (127.0.0.1)
Host is up (0.00019s latency).
PORT STATE SERVICE VERSION
1433/tcp open ms-sql-s Microsoft SQL Server 2019 15.00.4188.00; CU14
| ms-sql-info:
| 127.0.0.1:1433:
| Version:
| name: Microsoft SQL Server 2019 CU14
| number: 15.00.4188.00
| Product: Microsoft SQL Server 2019
| Service pack level: CU14
| Post-SP patches applied: false
|_ TCP port: 1433
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 6.97 seconds
Version info (please complete the following information):
- OS:
Linux kali 6.1.0-kali5-amd64 - Output of
nmap --version:
Nmap version 7.93 ( https://nmap.org )
Platform: x86_64-pc-linux-gnu
Compiled with: liblua-5.3.6 openssl-3.0.8 libssh2-1.10.0 libz-1.2.13 libpcre-8.39 nmap-libpcap-1.7.3 nmap-libdnet-1.12 ipv6
Compiled without:
Available nsock engines: epoll poll select
Quick Fix
I have patched my mssql.lua as follows. I can't guarantee that this won't break compatibility with other scripts...
nselib/mssql.lua (diff):
3206,3207c3206,3207
< local status, instances = Helper.GetDiscoveredInstances(host, port)
< if status then
---
> local instances = Helper.GetDiscoveredInstances(host, port)
> if instances then
Note: Helper.GetDiscoveredInstances only returns one value, this is the source of the stack trace.
With this fix, the script works but still doesn't create the full output when run against a single SQL instance. It might work if you run against multiple instances but i haven't checked.
The reason is the following segment:
Lines 3337 to 3340 in ad3935b
#output will always return 0 when scanning a single instance since it is indexed by a string (e.g. ("127.0.0.1:1433", table:0xaaaaaaaa) (s. https://www.lua.org/manual/5.4/manual.html on ipairs vs pairs, # only counts index-value pairs i.e. ipairs)
As a quick fix you can comment out lines 3337, 3339 and 3340.
Additional Issues
For me, only few of the ms-sql-* scripts actually work. This is partly due to the use of the deprecated format_output function e.g. in the following scripts:
- ms-sql-hasdbaccess.nse
- ms-sql-query.nse
- ms-sql-brute.nse
- ms-sql-config.nse
- broadcast-ms-sql-discover.nse
- ms-sql-xp-cmdshell.nse
- ms-sql-tables.nse
Also, there is a typo in ms-sql-tables.nse ("ouptut" vs "output", s. below)
nmap/scripts/ms-sql-tables.nse
Line 248 in ad3935b