mssqlclient : 'SSL routines', 'state_machine', 'internal error' #856

MA24th · 2020-05-14T23:32:17Z

I have this issue,

termx:~$ mssqlclient.py sql_svc@10.10.10.27 -windows-auth 
Impacket v0.9.22.dev1+20200513.101403.9a4b3f52 - Copyright 2020 SecureAuth Corporation

Password:
[*] Encryption required, switching to TLS
[-] [('SSL routines', 'state_machine', 'internal error')]

with debug

termx:~$ mssqlclient.py sql_svc@10.10.10.27 -windows-auth -debug
Impacket v0.9.22.dev1+20200513.101403.9a4b3f52 - Copyright 2020 SecureAuth Corporation

[+] Impacket Library Installation Path: /usr/local/lib/python3.8/dist-packages/impacket-0.9.22.dev1+20200513.101403.9a4b3f52-py3.8.egg/impacket
Password:
[*] Encryption required, switching to TLS
[+] Exception:
Traceback (most recent call last):
  File "/usr/local/lib/python3.8/dist-packages/impacket-0.9.22.dev1+20200513.101403.9a4b3f52-py3.8.egg/EGG-INFO/scripts/mssqlclient.py", line 179, in <module>
    res = ms_sql.login(options.db, username, password, domain, options.hashes, options.windows_auth)
  File "/usr/local/lib/python3.8/dist-packages/impacket-0.9.22.dev1+20200513.101403.9a4b3f52-py3.8.egg/impacket/tds.py", line 917, in login
    tls.do_handshake()
  File "/usr/lib/python3/dist-packages/OpenSSL/SSL.py", line 1915, in do_handshake
    self._raise_ssl_error(self._ssl, result)
  File "/usr/lib/python3/dist-packages/OpenSSL/SSL.py", line 1647, in _raise_ssl_error
    _raise_current_error()
  File "/usr/lib/python3/dist-packages/OpenSSL/_util.py", line 54, in exception_from_error_queue
    raise exception_type(errors)
OpenSSL.SSL.Error: [('SSL routines', 'state_machine', 'internal error')]
[-] [('SSL routines', 'state_machine', 'internal error')]

The text was updated successfully, but these errors were encountered:

francoataffarel · 2020-05-26T22:21:07Z

same error

` python3 mssqlclient.py ARCHETYPE/sql_svc@10.10.10.27 -windows-auth
Impacket v0.9.21 - Copyright 2020 SecureAuth Corporation

Password:
[*] Encryption required, switching to TLS
[-] [('SSL routines', 'state_machine', 'internal error')]
`

kazkansouh · 2020-05-29T15:30:35Z

Yep I just got this too.

I think its related to python 3.8. What is odd is both mssql-cli and mssqlclient both issued the internal error message when I tried them against a MSSQL 2014.

However, trying again after pulling a docker image with python 3.7 the impacket mssqlclient script worked fine. So probably its python 3.8 or one of the dependencies.

LeviPesin · 2020-06-20T06:27:55Z

Also look into #866. I opened this issue on pyOpenSSL: pyca/pyopenssl#916

LeviPesin · 2020-06-20T11:07:19Z

Hmm... I looked into the impacket/tds.py and I found this:
if resp['Encryption'] == TDS_ENCRYPT_REQ or resp['Encryption'] == TDS_ENCRYPT_OFF:
LOG.info("Encryption required, switching to TLS")
Is it what it is supposed to be? Maybe it should be TDS_ENCRYPT_ON instead of TDS_ENCRYPT_OFF?

Mastermjr · 2020-11-18T18:45:31Z

on python 3.8.5 and ubuntu 20.04 I was able to fix this issue by changing the TLS context method to a newer version, the original code uses v1, and changing the following lines allows me to connect just fine:

diff --git a/impacket/tds.py b/impacket/tds.py
index a24333d4..675ef822 100644
--- a/impacket/tds.py
+++ b/impacket/tds.py
@@ -660,10 +660,11 @@ class MSSQL:
             LOG.info("Encryption required, switching to TLS")

             # Switching to TLS now
-            ctx = SSL.Context(SSL.TLSv1_METHOD)
+            ctx = SSL.Context(SSL.TLSv1_2_METHOD)
             ctx.set_cipher_list('RC4, AES256')
             tls = SSL.Connection(ctx,None)
             tls.set_connect_state()
+
             while True:
                 try:
                     tls.do_handshake()
@@ -908,7 +909,7 @@ class MSSQL:
             LOG.info("Encryption required, switching to TLS")

             # Switching to TLS now
-            ctx = SSL.Context(SSL.TLSv1_METHOD)
+            ctx = SSL.Context(SSL.TLSv1_2_METHOD)
             ctx.set_cipher_list('RC4, AES256')
             tls = SSL.Connection(ctx,None)

qbit uses v1_2 in the linked issue above

ichig069 · 2021-03-27T18:54:39Z

I've been having the same issue. I'll include a wireshark capture if anyone want's to check it out. If you can see what's going on please get back to me.x-special/nautilus-clipboard

mssqlpcap.zip

nbaAnomaly · 2021-07-18T20:30:59Z

on python 3.8.5 and ubuntu 20.04 I was able to fix this issue by changing the TLS context method to a newer version, the original code uses v1, and changing the following lines allows me to connect just fine:

diff --git a/impacket/tds.py b/impacket/tds.py
index a24333d4..675ef822 100644
--- a/impacket/tds.py
+++ b/impacket/tds.py
@@ -660,10 +660,11 @@ class MSSQL:
             LOG.info("Encryption required, switching to TLS")

             # Switching to TLS now
-            ctx = SSL.Context(SSL.TLSv1_METHOD)
+            ctx = SSL.Context(SSL.TLSv1_2_METHOD)
             ctx.set_cipher_list('RC4, AES256')
             tls = SSL.Connection(ctx,None)
             tls.set_connect_state()
+
             while True:
                 try:
                     tls.do_handshake()
@@ -908,7 +909,7 @@ class MSSQL:
             LOG.info("Encryption required, switching to TLS")

             # Switching to TLS now
-            ctx = SSL.Context(SSL.TLSv1_METHOD)
+            ctx = SSL.Context(SSL.TLSv1_2_METHOD)
             ctx.set_cipher_list('RC4, AES256')
             tls = SSL.Connection(ctx,None)

qbit uses v1_2 in the linked issue above

Running Ubuntu 21.04, python 3.9 I followed this method and modified /usr/local/lib/python3.9/dist-packages/impacket-0.9.23-py3.9.egg/impacket/tds.py

replaced ctx = SSL.Context(SSL.TLSv1_METHOD) with ctx = SSL.Context(SSL.TLSv1_2_METHOD) both at line 911 & 663 and now mssqlclient.py works

MaxALEau · 2021-11-27T16:40:49Z

Same problem for me : Impacket v0.9.25.dev1+20211027.123255.1dad8f7f

pizza-power · 2021-12-27T20:12:20Z

on python 3.8.5 and ubuntu 20.04 I was able to fix this issue by changing the TLS context method to a newer version, the original code uses v1, and changing the following lines allows me to connect just fine:
diff --git a/impacket/tds.py b/impacket/tds.py
index a24333d4..675ef822 100644
--- a/impacket/tds.py
+++ b/impacket/tds.py
@@ -660,10 +660,11 @@ class MSSQL:
             LOG.info("Encryption required, switching to TLS")

             # Switching to TLS now
-            ctx = SSL.Context(SSL.TLSv1_METHOD)
+            ctx = SSL.Context(SSL.TLSv1_2_METHOD)
             ctx.set_cipher_list('RC4, AES256')
             tls = SSL.Connection(ctx,None)
             tls.set_connect_state()
+
             while True:
                 try:
                     tls.do_handshake()
@@ -908,7 +909,7 @@ class MSSQL:
             LOG.info("Encryption required, switching to TLS")

             # Switching to TLS now
-            ctx = SSL.Context(SSL.TLSv1_METHOD)
+            ctx = SSL.Context(SSL.TLSv1_2_METHOD)
             ctx.set_cipher_list('RC4, AES256')
             tls = SSL.Connection(ctx,None)
qbit uses v1_2 in the linked issue above
Running Ubuntu 21.04, python 3.9 I followed this method and modified /usr/local/lib/python3.9/dist-packages/impacket-0.9.23-py3.9.egg/impacket/tds.py

replaced ctx = SSL.Context(SSL.TLSv1_METHOD) with ctx = SSL.Context(SSL.TLSv1_2_METHOD) both at line 911 & 663 and now mssqlclient.py works

This worked for me, too. Thanks!

elliott-fwdsec · 2022-01-31T17:12:41Z

on python 3.8.5 and ubuntu 20.04 I was able to fix this issue by changing the TLS context method to a newer version, the original code uses v1, and changing the following lines allows me to connect just fine:

diff --git a/impacket/tds.py b/impacket/tds.py
index a24333d4..675ef822 100644
--- a/impacket/tds.py
+++ b/impacket/tds.py
@@ -660,10 +660,11 @@ class MSSQL:
             LOG.info("Encryption required, switching to TLS")

             # Switching to TLS now
-            ctx = SSL.Context(SSL.TLSv1_METHOD)
+            ctx = SSL.Context(SSL.TLSv1_2_METHOD)
             ctx.set_cipher_list('RC4, AES256')
             tls = SSL.Connection(ctx,None)
             tls.set_connect_state()
+
             while True:
                 try:
                     tls.do_handshake()
@@ -908,7 +909,7 @@ class MSSQL:
             LOG.info("Encryption required, switching to TLS")

             # Switching to TLS now
-            ctx = SSL.Context(SSL.TLSv1_METHOD)
+            ctx = SSL.Context(SSL.TLSv1_2_METHOD)
             ctx.set_cipher_list('RC4, AES256')
             tls = SSL.Connection(ctx,None)

qbit uses v1_2 in the linked issue above

Had to rerun python3 -m pip install . for the changes to take effect it seemed.

MartialSeron · 2022-03-04T22:44:25Z

same with impacket-0.9.25.dev1+20220218.140931.6042675a

the changes in file impacket/tds.py and python3 -m pip install . fixed it

iosusan · 2022-05-29T17:31:35Z

#856 (comment)

this worked for me aswell. In my case i manually edited my user-installed lib ~/.local/lib/python3.8/site-packages/impacket.tds.py

mpgn · 2022-06-23T20:56:38Z

Okay, thanks to @H00K the solution seems to be pretty simple ctx = SSL.Context(SSL.TLS_METHOD) instead of selecting one particular protocol !

PR: #1356

SSL.TLS_METHOD = These are the general-purpose version-flexible SSL/TLS methods. The actual protocol version used will be negotiated to the highest version mutually supported by the client and the server. The supported protocols are SSLv3, TLSv1, TLSv1.1, TLSv1.2 and TLSv1.3. Applications should use these methods, and avoid the version-specific methods described below, which are deprecated.
https://www.openssl.org/docs/manmaster/man3/TLS_method.html

0xdeaddood · 2022-07-20T13:44:17Z

Should be fixed in #1364. Please re-open if needed.

sVignone · 2022-07-21T17:45:32Z

on python 3.8.5 and ubuntu 20.04 I was able to fix this issue by changing the TLS context method to a newer version, the original code uses v1, and changing the following lines allows me to connect just fine:
diff --git a/impacket/tds.py b/impacket/tds.py
index a24333d4..675ef822 100644
--- a/impacket/tds.py
+++ b/impacket/tds.py
@@ -660,10 +660,11 @@ class MSSQL:
             LOG.info("Encryption required, switching to TLS")

             # Switching to TLS now
-            ctx = SSL.Context(SSL.TLSv1_METHOD)
+            ctx = SSL.Context(SSL.TLSv1_2_METHOD)
             ctx.set_cipher_list('RC4, AES256')
             tls = SSL.Connection(ctx,None)
             tls.set_connect_state()
+
             while True:
                 try:
                     tls.do_handshake()
@@ -908,7 +909,7 @@ class MSSQL:
             LOG.info("Encryption required, switching to TLS")

             # Switching to TLS now
-            ctx = SSL.Context(SSL.TLSv1_METHOD)
+            ctx = SSL.Context(SSL.TLSv1_2_METHOD)
             ctx.set_cipher_list('RC4, AES256')
             tls = SSL.Connection(ctx,None)
qbit uses v1_2 in the linked issue above
Running Ubuntu 21.04, python 3.9 I followed this method and modified /usr/local/lib/python3.9/dist-packages/impacket-0.9.23-py3.9.egg/impacket/tds.py

replaced ctx = SSL.Context(SSL.TLSv1_METHOD) with ctx = SSL.Context(SSL.TLSv1_2_METHOD) both at line 911 & 663 and now mssqlclient.py works

I've been struggling with this for weeks and this fixed it right away, only difference was I found mine on line 666 and 914. Thanks again!

younes-benniz · 2022-08-20T16:05:20Z

running python3 -m pip install . fixed it.

MA24th changed the title ~~OpenSSL.SSL.Error: [('SSL routines', 'state_machine', 'internal error')]~~ mssqlclient : 'SSL routines', 'state_machine', 'internal error' May 14, 2020

LeviPesin mentioned this issue Jun 20, 2020

Error in do_handshake() pyca/pyopenssl#916

Open

LeviPesin mentioned this issue Jun 20, 2020

OpenSSL.SSL.Error: [('SSL routines', 'state_machine', 'internal error')] #866

Closed

ssabetan mentioned this issue Dec 10, 2021

LDAP.py fails with SSL error ly4k/Certipy#15

Closed

mpgn mentioned this issue Jun 22, 2022

Fix mssql 'SSL routines' error #856 #1355

Closed

mpgn mentioned this issue Jun 23, 2022

Fix mssql 'SSL routines' error with TLS1 #1356

Merged

This was referenced Jun 24, 2022

OpenSSL.SSL.Error: [('SSL routines', '', 'internal error')] in mssqlclient.py #1357

Closed

Changed the setting up for new SSL connections #1364

Merged

0xdeaddood closed this as completed Jul 20, 2022

D3vil0p3r mentioned this issue Dec 30, 2022

[BUG] Impacket mssqlclient.py [-] [('SSL routines', '', 'internal error')] BlackArch/blackarch#3650

Closed

2 tasks

Ridter mentioned this issue Sep 14, 2023

macos 使用的时候经常遇到报错 Ridter/PySQLTools#5

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

mssqlclient : 'SSL routines', 'state_machine', 'internal error' #856

mssqlclient : 'SSL routines', 'state_machine', 'internal error' #856

MA24th commented May 14, 2020 •

edited

Loading

francoataffarel commented May 26, 2020

kazkansouh commented May 29, 2020

LeviPesin commented Jun 20, 2020

LeviPesin commented Jun 20, 2020

Mastermjr commented Nov 18, 2020 •

edited

Loading

ichig069 commented Mar 27, 2021

nbaAnomaly commented Jul 18, 2021 •

edited

Loading

MaxALEau commented Nov 27, 2021 •

edited

Loading

pizza-power commented Dec 27, 2021

elliott-fwdsec commented Jan 31, 2022

MartialSeron commented Mar 4, 2022

iosusan commented May 29, 2022

mpgn commented Jun 23, 2022 •

edited

Loading

0xdeaddood commented Jul 20, 2022

sVignone commented Jul 21, 2022

younes-benniz commented Aug 20, 2022

mssqlclient : 'SSL routines', 'state_machine', 'internal error' #856

mssqlclient : 'SSL routines', 'state_machine', 'internal error' #856

Comments

MA24th commented May 14, 2020 • edited Loading

francoataffarel commented May 26, 2020

kazkansouh commented May 29, 2020

LeviPesin commented Jun 20, 2020

LeviPesin commented Jun 20, 2020

Mastermjr commented Nov 18, 2020 • edited Loading

ichig069 commented Mar 27, 2021

nbaAnomaly commented Jul 18, 2021 • edited Loading

MaxALEau commented Nov 27, 2021 • edited Loading

pizza-power commented Dec 27, 2021

elliott-fwdsec commented Jan 31, 2022

MartialSeron commented Mar 4, 2022

iosusan commented May 29, 2022

mpgn commented Jun 23, 2022 • edited Loading

0xdeaddood commented Jul 20, 2022

sVignone commented Jul 21, 2022

younes-benniz commented Aug 20, 2022

MA24th commented May 14, 2020 •

edited

Loading

Mastermjr commented Nov 18, 2020 •

edited

Loading

nbaAnomaly commented Jul 18, 2021 •

edited

Loading

MaxALEau commented Nov 27, 2021 •

edited

Loading

mpgn commented Jun 23, 2022 •

edited

Loading