NSE: Multiple Bugs in ms-sql-* scripts (e.g. ms-sql-info)

Describe the bug
The ms-sql-info NSE script fails to run:

Starting Nmap 7.93 ( https://nmap.org ) at 2023-03-15 10:50 CET
Nmap scan report for localhost (127.0.0.1)
Host is up (0.000078s latency).

PORT STATE SERVICE VERSION
1433/tcp open ms-sql-s Microsoft SQL Server 2019 15.00.4188.00; CU14
|_ms-sql-info: ERROR: Script execution failed (use -d to debug)

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 6.76 seconds

Stack Trace:

NSE: ms-sql-info against 127.0.0.1:1433 threw an error!                                                              
attempt to index a nil value                                                                                         
stack traceback:                                                                                                     
        [C]: in for iterator 'for iterator'                                                                          
        /usr/bin/../share/nmap/nselib/mssql.lua:3334: in function </usr/bin/../share/nmap/nselib/mssql.lua:3327>     
        (...tail calls...)                                                                                           
                                                                                                                     
Completed NSE at 10:51, 0.01s elapsed 

To Reproduce
Run the following nmap scan against a single instance of mssql server (e.g. SQL Server 2019):
sudo nmap -sS -p 1433 --script ms-sql-info -sV 127.0.0.1

Expected behavior
Expecting the full NSE script output for ms-sql-info:

─$ sudo nmap -sS -p 1433 --script ms-sql-info -sV 127.0.0.1
Starting Nmap 7.93 ( https://nmap.org ) at 2023-03-15 12:21 CET
Nmap scan report for localhost (127.0.0.1)
Host is up (0.00019s latency).

PORT     STATE SERVICE  VERSION
1433/tcp open  ms-sql-s Microsoft SQL Server 2019 15.00.4188.00; CU14
| ms-sql-info: 
|   127.0.0.1:1433: 
|     Version: 
|       name: Microsoft SQL Server 2019 CU14
|       number: 15.00.4188.00
|       Product: Microsoft SQL Server 2019
|       Service pack level: CU14
|       Post-SP patches applied: false
|_    TCP port: 1433

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 6.97 seconds

Version info (please complete the following information):

• OS: Linux kali 6.1.0-kali5-amd64
• Output of nmap --version:

Nmap version 7.93 ( https://nmap.org )
Platform: x86_64-pc-linux-gnu
Compiled with: liblua-5.3.6 openssl-3.0.8 libssh2-1.10.0 libz-1.2.13 libpcre-8.39 nmap-libpcap-1.7.3 nmap-libdnet-1.12 ipv6
Compiled without:
Available nsock engines: epoll poll select

Quick Fix
I have patched my mssql.lua as follows. I can't guarantee that this won't break compatibility with other scripts...

nselib/mssql.lua (diff):

3206,3207c3206,3207                                                                                                   
<       local status, instances = Helper.GetDiscoveredInstances(host, port)                                           
<       if status then                                                                                                                                                                                                                      
---                                                                                                                   
>       local instances = Helper.GetDiscoveredInstances(host, port)                                                   
>       if instances then   

Note: Helper.GetDiscoveredInstances only returns one value, this is the source of the stack trace.

With this fix, the script works but still doesn't create the full output when run against a single SQL instance. It might work if you run against multiple instances but i haven't checked.

The reason is the following segment:

https://github.com/nmap/nmap/blob/ad3935b642714d363a2a0a2a4fc892c8c292fc5c/nselib/mssql.lua#L3337-L3340

#output will always return 0 when scanning a single instance since it is indexed by a string (e.g. ("127.0.0.1:1433", table:0xaaaaaaaa) (s. https://www.lua.org/manual/5.4/manual.html on ipairs vs pairs, # only counts index-value pairs i.e. ipairs)

As a quick fix you can comment out lines 3337, 3339 and 3340.

Additional Issues
For me, only few of the ms-sql-* scripts actually work. This is partly due to the use of the deprecated format_output function e.g. in the following scripts:

• ms-sql-hasdbaccess.nse
• ms-sql-query.nse
• ms-sql-brute.nse
• ms-sql-config.nse
• broadcast-ms-sql-discover.nse
• ms-sql-xp-cmdshell.nse
• ms-sql-tables.nse

Also, there is a typo in ms-sql-tables.nse ("ouptut" vs "output", s. below)
https://github.com/nmap/nmap/blob/ad3935b642714d363a2a0a2a4fc892c8c292fc5c/scripts/ms-sql-tables.nse#L248

Start by reproducing the single-instance scan with scripts/ms-sql-info.nse and inspect nselib/mssql.lua around the reported GetDiscoveredInstances and output handling. Review the listed ms-sql-* scripts for deprecated format_output usage and the typo in scripts/ms-sql-tables.nse. Done means the reported scripts run without errors and produce the expected output for the relevant SQL Server scans.