add support for boolean datatypes on mssql #18872

zgoldman-r7 · 2024-02-21T22:55:27Z

In newer TDS Protocol versions, two different bit datatypes were added, one that allows null and one that doesn't, to allow for boolean support. To this point, our MSSQL code does not support these values, and causes "unknown column type" errors.

Verification

List the steps needed to make sure this thing works

change mssql_query to query in lib/rex/post/mssql/ui/console.rb (PR incoming)
Start msfconsole
spin up an mssql instance in your vm
create a table with two different columns of type bit, one with not null enforcement, and populate it with different values
use mssql_login run CreateSession=true ... to get a session
sessions -i -1
run queries against this table in both sqlcmd in your mssql instance and via your msf mssql client, verify that the output is the same and there are no unknown column type errors with values 50 or 104.

Setting up MSSQL Table

in your mssql instance, run the following steps:

create table your_table (nullable_bit bit);
grant select on your_table to public;
alter table your_table add strict_bit bit not null default 0;
insert into your_table (nullable_bit, strict_bit) values (0, 0);
insert into your_table (nullable_bit, strict_bit) values (0, 1);
insert into your_table (nullable_bit, strict_bit) values (1, 0);
insert into your_table (nullable_bit, strict_bit) values (1, 1);
insert into your_table (nullable_bit, strict_bit) values (NULL, 0);
insert into your_table (nullable_bit, strict_bit) values (NULL, 1);

previously, running select * from your_table; would break this if run from your mssql client in metasploit framework. This now should look like:

msf6 auxiliary(scanner/mssql/mssql_login) > sessions -i -1
[*] Starting interaction with 1...

MSSQL @ 192.168.2.227:1433 (master) > query "select * from your_table;"

[*] 192.168.2.227:1433    - SQL Query: select * from your_table;
[*] 192.168.2.227:1433    - Row Count: 6 (Status: 16 Command: 193)
Response
========

 nullable_bit  strict_bit
 ------------  ----------
 0             0
 0             1
 1             0
 1             1
 NULL          0
 NULL          1

or from modules:

msf6 auxiliary(admin/mssql/mssql_sql) > run SESSION=2 SQL="select * from your_table;"

[*] Using existing session 2
[*] 192.168.2.227:1433    - SQL Query: select * from your_table;
[*] 192.168.2.227:1433    - Row Count: 6 (Status: 16 Command: 193)
Response
========

 nullable_bit  strict_bit
 ------------  ----------
 0             0
 0             1
 1             0
 1             1
 NULL          0
 NULL          1

adfoster-r7 · 2024-02-21T22:57:30Z

Verification

run queries against this table in both sqlcmd in your mssql instance and via your msf mssql client, verify that the output is the same and there are no unknown column type errors with values 50 or 104.

Just to help with testing - would you mind sharing those queries, or sharing the SQL for creating new tables and values that replicate this issue 👍

zgoldman-r7 · 2024-02-21T22:58:27Z

Verification

run queries against this table in both sqlcmd in your mssql instance and via your msf mssql client, verify that the output is the same and there are no unknown column type errors with values 50 or 104.

Just to help with testing - would you mind sharing those queries, or sharing the SQL for creating new tables and values that replicate this issue 👍

I'll edit the steps now!

adfoster-r7 · 2024-02-21T23:15:56Z

lib/rex/proto/mssql/client_mixin.rb

@@ -178,6 +178,13 @@ def mssql_parse_tds_reply(data, info)
        col[:id] = :int
        col[:int_size] = data.slice!(0, 1).unpack('C')[0]

+      when 50
+        col[:id] = :sybbit


Where does sybbit come from? 👀

Is that this?

BITTYPE = %x32 ; Bit https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tds/859eb3d2-80d3-40f6-a637-414552c9c552

BITNTYPE = %x68 https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tds/ce3183a6-9d89-47e8-a02f-de5a1a1303de

Oh, is the existing implementation and terminology from freetds rather than the microsoft tds spec?

0x32 50 SYBBIT no 0 ... 0x68 104 SYBBITN yes 1 https://www.freetds.org/tds.html

I got bitntype from the microsoft tds spec and sybbit from the freetds spec - I'm open to feedback on the names. I think it would be reasonable to change to both of the freetds names, or :bit and :nullable_bit to be more specific?

Ah; From what I understand, in freetds - syb is just a prefix that C developers use, and it comes from the sybase product as far as I can see:

TDS Version Supported Products

4.2 Sybase SQL Server < 10 and Microsoft SQL Server 6.5

5.0 Sybase SQL Server >= 10

7.0 Microsoft SQL Server 7.0

7.1 Microsoft SQL Server 2000

7.2 Microsoft SQL Server 2005

So the naming convention should just probably be:

SYBBIT => bit SYBBITN => bitn

adfoster-r7 · 2024-02-22T12:16:07Z

lib/rex/proto/mssql/client_mixin.rb

+      when :bitntype
+        has_value = data.slice!(0, 1).unpack("C")[0]
+        if has_value == 0
+          row << 'NULL'


Should this be row << nil ? 👀

The rationale being, the string 'NULL' is definitely not the same as an actual Ruby nil

If you want it to appear as NULL in the table outputs of modules, you'll have to handle that in your presentation layer - not here 👍

adfoster-r7 · 2024-02-22T12:21:38Z

lib/rex/proto/mssql/client_mixin.rb

+        col[:id] = :sybbit
+
+      when 104
+        col[:id] = :bitntype


Suggested change

col[:id] = :bitntype

col[:id] = :bitn

adfoster-r7 · 2024-02-22T12:21:49Z

lib/rex/proto/mssql/client_mixin.rb

@@ -178,6 +178,13 @@ def mssql_parse_tds_reply(data, info)
        col[:id] = :int
        col[:int_size] = data.slice!(0, 1).unpack('C')[0]

+      when 50
+        col[:id] = :sybbit


Suggested change

col[:id] = :sybbit

col[:id] = :bit

adfoster-r7 · 2024-02-22T12:21:57Z

lib/rex/proto/mssql/client_mixin.rb

+          row << data.slice!(0, 1).unpack("C")[0]
+        end
+
+      when :sybbit


Suggested change

when :sybbit

when :bit

adfoster-r7 · 2024-02-22T12:22:09Z

lib/rex/proto/mssql/client_mixin.rb

@@ -292,6 +299,17 @@ def mssql_parse_tds_row(data, info)
      when :tinyint
        row << data.slice!(0, 1).unpack("C")[0]

+      when :bitntype


Suggested change

when :bitntype

when :bitn

adfoster-r7 · 2024-02-26T10:53:20Z

Release Notes

Updates the MSSQL modules to support querying database rows that contain boolean bit values

zgoldman-r7 force-pushed the mssql-boolean-columns branch from 6dfdcc5 to c0626d1 Compare February 21, 2024 22:57

adfoster-r7 reviewed Feb 21, 2024

View reviewed changes

adfoster-r7 reviewed Feb 22, 2024

View reviewed changes

zgoldman-r7 force-pushed the mssql-boolean-columns branch from c0626d1 to 55fab27 Compare February 22, 2024 15:39

add support for boolean datatypes on mssql

854dcc5

zgoldman-r7 force-pushed the mssql-boolean-columns branch from 55fab27 to 854dcc5 Compare February 22, 2024 17:08

adfoster-r7 merged commit 787a2cb into rapid7:master Feb 26, 2024
34 checks passed

adfoster-r7 added the rn-enhancement release notes enhancement label Feb 26, 2024

adfoster-r7 mentioned this pull request Mar 20, 2024

Error handling response - admin/mssql/mssql_sql - unsupported token and invalid number of columns #18970

Closed

adfoster-r7 mentioned this pull request Apr 11, 2024

Add NText column parsing to MSSQL #19054

Merged

4 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

add support for boolean datatypes on mssql #18872

add support for boolean datatypes on mssql #18872

zgoldman-r7 commented Feb 21, 2024 •

edited

Loading

adfoster-r7 commented Feb 21, 2024

Verification

zgoldman-r7 commented Feb 21, 2024

Verification

adfoster-r7 Feb 21, 2024 •

edited

Loading

adfoster-r7 Feb 21, 2024 •

edited

Loading

zgoldman-r7 Feb 21, 2024

adfoster-r7 Feb 22, 2024

adfoster-r7 Feb 22, 2024 •

edited

Loading

adfoster-r7 Feb 22, 2024

adfoster-r7 Feb 22, 2024

adfoster-r7 Feb 22, 2024

adfoster-r7 Feb 22, 2024

adfoster-r7 commented Feb 26, 2024

TDS Version	Supported Products
4.2	Sybase SQL Server < 10 and Microsoft SQL Server 6.5
5.0	Sybase SQL Server >= 10
7.0	Microsoft SQL Server 7.0
7.1	Microsoft SQL Server 2000
7.2	Microsoft SQL Server 2005

add support for boolean datatypes on mssql #18872

add support for boolean datatypes on mssql #18872

Conversation

zgoldman-r7 commented Feb 21, 2024 • edited Loading

Verification

Setting up MSSQL Table

adfoster-r7 commented Feb 21, 2024

Verification

zgoldman-r7 commented Feb 21, 2024

Verification

adfoster-r7 Feb 21, 2024 • edited Loading

Choose a reason for hiding this comment

adfoster-r7 Feb 21, 2024 • edited Loading

Choose a reason for hiding this comment

zgoldman-r7 Feb 21, 2024

Choose a reason for hiding this comment

adfoster-r7 Feb 22, 2024

Choose a reason for hiding this comment

adfoster-r7 Feb 22, 2024 • edited Loading

Choose a reason for hiding this comment

adfoster-r7 Feb 22, 2024

Choose a reason for hiding this comment

adfoster-r7 Feb 22, 2024

Choose a reason for hiding this comment

adfoster-r7 Feb 22, 2024

Choose a reason for hiding this comment

adfoster-r7 Feb 22, 2024

Choose a reason for hiding this comment

adfoster-r7 commented Feb 26, 2024

Release Notes

zgoldman-r7 commented Feb 21, 2024 •

edited

Loading

adfoster-r7 Feb 21, 2024 •

edited

Loading

adfoster-r7 Feb 21, 2024 •

edited

Loading

adfoster-r7 Feb 22, 2024 •

edited

Loading