mssqlclient.py "Unpacked data doesn't match constant value" / NTLMSSP

[corsch]

Configuration

impacket version: v0.9.21
Python version: 3.8.3
Target OS: KALI_2020.2 / Windows Server 2008R2 & 2012R2 (Both with SQL Server)

Debug Output With Command String

proxychains python3 mssqlclient.py -debug DOMAIN/USER@10.10.10.2 -p 53231 -windows-auth -no-pass

ProxyChains-3.1 (http://proxychains.sf.net)
Impacket v0.9.21 - Copyright 2020 SecureAuth Corporation

[+] Impacket Library Installation Path: /usr/lib/python3/dist-packages/impacket
|S-chain|-<>-127.0.0.1:1080-<><>-10.10.10.2:53231-<><>-OK
[+] Exception:
Traceback (most recent call last):
File "mssqlclient.py", line 179, in
res = ms_sql.login(options.db, username, password, domain, options.hashes, options.windows_auth)
File "/usr/lib/python3/dist-packages/impacket/tds.py", line 972, in login
type3, exportedSessionKey = ntlm.getNTLMSSPType3(auth, serverChallenge, username, password, domain, lmhash, nthash)
File "/usr/lib/python3/dist-packages/impacket/ntlm.py", line 618, in getNTLMSSPType3
ntlmChallenge = NTLMAuthChallenge(type2)
File "/usr/lib/python3/dist-packages/impacket/structure.py", line 84, in init
self.fromString(data)
File "/usr/lib/python3/dist-packages/impacket/ntlm.py", line 371, in fromString
Structure.fromString(self,data)
File "/usr/lib/python3/dist-packages/impacket/structure.py", line 149, in fromString
self[field[0]] = self.unpack(field[1], data[:size], dataClassOrCode = dataClassOrCode, field = field[0])
File "/usr/lib/python3/dist-packages/impacket/structure.py", line 312, in unpack
raise Exception("Unpacked data doesn't match constant value '%r' should be '%r'" % (data, answer))
Exception: ("Unpacked data doesn't match constant value 'b'\x00\x00\x00\x00\x00\x00'' should be ''NTLMSSP\x00''", 'When unpacking field ' | "NTLMSSP\x00 | b'\x00\x00\x00\x00\x00\x00'[:8]'')
[-] ("Unpacked data doesn't match constant value 'b'\x00\x00\x00\x00\x00\x00'' should be ''NTLMSSP\x00''", 'When unpacking field ' | "NTLMSSP\x00 | b'\x00\x00\x00\x00\x00\x00'[:8]'')

Additional context

Works on KALI Linux with Impacket v0.9.20
=> Won't work after upgrade to Impacket v0.9.21

"SQL NTLM Stealer" => ntlmrelayx => proxychains mssqlclient

[corsch]

The trunk version v0.9.22.dev1 also seems to work fine.

[asolino]

Thanks for verifying master branch is working fine @corsch , closing now.

[pich4ya]

I need this to be solved for HTB Scrambled.

[0xdeaddood]

Hi @pich4ya!

Please check #1343 (comment)