Unable to discover Microsoft SQL Server 2019 RTM instance listening on TCP Port 1433

[Reelix]

I had a remote MSSQL 2019 Server listening on TCP Port 1433 that this could not retrieve instance information from - It simply timed out.

I am unsure if 2019 altered the protocol as Sqlnstance.cs only has up to version 2014.

[matwilko]

Thanks for the report :)

As far as I know, the SQL Server Browser protocol hasn't changed, and SQL Server 2019 should be detected by this library just fine (though as you've pointed out, won't have the human readable version string suported)

I think the problem may be that SQL Server Browser may not be running on the machine in question. This library doesn't scan for SQL Server instances themselves (i.e. a port scan). Instead it tries to contact the SQL Server Browser service on each of the machines it scans, which then does the work of enumerating the instances on the machine and returning the information.

You'll need to check that the SQL Server Browser service is running on the machine, and is accessible through the firewall on UDP port 1434. You can find more information about it here: https://docs.microsoft.com/en-us/sql/tools/configuration-manager/sql-server-browser-service?view=sql-server-ver15

If your problem persists once you've got the Browser service up and running and you can verify external connectivity, we can look at further potential issues.

I'll also look at updating the version table to cover the more recent versions of SQL Server.

[Reelix]

Whilst I am unable to test if it is available on UDP Port 1434 being a third party server (I was testing against a server on the internet through a VPN in a CTF in this case), regular scanners such as Nmap could detect that it was running on TCP 1433 (In addition to several additional details), and a connection could indeed be made with a regular mssql client (In this case, I used https://github.com/dbcli/mssql-cli as I was on a shell-only linux system).

I was looking at this project as the default variation is unable to return basic version information about a server without actually logging on.

[matwilko]

Unfortunately port scanning is outside the scope of this project - it's not intended to absolutely determine if there are SQL Server instances on the network, it's intended to use the established Microsoft protocol for this purpose to retrieve information. The library doesn't actually connect to SQL Server itself.

If administrators have disabled or blocked this functionality on their servers, then this library cannot detect those instances.

I'd suggest you use this library as only part of a detection strategy - if available, then instances are going to be very quickly detected by the protocol used by this library, but you could also start running a port scan yourself separately. However, many network administrators are likely to look askance at port scanning on their network, so it's not something I'd advise in general!