Several enhancements like encryption enforcement and default instance checks added#87
Open
LuemmelSec wants to merge 31 commits intoNetSPI:masterfrom
Open
Several enhancements like encryption enforcement and default instance checks added#87LuemmelSec wants to merge 31 commits intoNetSPI:masterfrom
LuemmelSec wants to merge 31 commits intoNetSPI:masterfrom
Conversation
Added a -CheckEncryption switch to Get-SQLInstanceDomain
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
I was looking at https://github.com/CompassSecurity/mssqlrelay to see if it can extend my workflow when auditing MSSQL environments and indeed it had some nice additions to it.
Vibecoded a lot of new nice features to PowerUpSQL.
Encryption Enforcement Detection
Added ability to detect SQL Server instances that do not enforce encryption, making them vulnerable to NTLM relay attacks. Uses TDS pre-login packet inspection matching mssqlrelay methodology.
New Function: Get-SQLEncryptionStatus
Tests a specific SQL Server instance for encryption enforcement.
Returns:
EncryptionEnforced: Yes/No/UnknownEnhanced Instance Discovery for Get-SQLInstanceDomain
Domain SPN queries often miss instances on default port 1433 and named instances on dynamic ports.
New Parameters
-CheckEncryption- Test encryption enforcement on discovered instances-CheckDefaultInstance- Always test default port 1433 (catches instances not in SPNs)-DiscoverDynamicPorts- Use UDP SQL Browser (port 1434) to discover all instances dynamically-QuickAudit- Perform security audit (login, version, database, privileges, xp_ access)-SQLUsername/-SQLPassword- SQL Server authentication for QuickAuditQuickAudit Output Columns
When
-QuickAuditis enabled, adds: LoginSuccess, Version, CurrentLogin, CurrentDatabase, IsSysadmin, HasXpDirtree, HasXpFileexist, HasXpCmdshellExample Usage
All switches can be combined:
Excel Export
Implementation Notes
HAS_PERMS_BY_NAME()for permissions (no execution to avoid hangs)runas /netonly