A journey implementing Channel Binding on MSSQLClient.py

This post documents the implementation of Channel Binding Token (CBT) for MSSQL in Impacket/NetExec, explaining how MSSQL’s TDS authentication, NTLM, and STARTTLS interact, why tls-unique is required for CBT with Schannel, and how the TLS stack was reworked to obtain the channel binding value. It demonstrates analyzing TLS/NTLM traffic (including downgrading TLS for visibility), shows that default MSSQL can be susceptible to NTLM relay, and recommends enforcing TLS with Extended Protection to mitigate it, culminating in code changes that enable successful EPA-aware authentication.