Several enhancements like encryption enforcement and default instance checks added

[LuemmelSec]

I was looking at https://github.com/CompassSecurity/mssqlrelay to see if it can extend my workflow when auditing MSSQL environments and indeed it had some nice additions to it.

Vibecoded a lot of new nice features to PowerUpSQL.

Encryption Enforcement Detection

Added ability to detect SQL Server instances that do not enforce encryption, making them vulnerable to NTLM relay attacks. Uses TDS pre-login packet inspection matching mssqlrelay methodology.

New Function: Get-SQLEncryptionStatus

Tests a specific SQL Server instance for encryption enforcement.

Get-SQLEncryptionStatus -Instance 'sqlserver.domain.com,1433' -TimeOut 10 -Verbose

Returns: EncryptionEnforced: Yes/No/Unknown

Enhanced Instance Discovery for Get-SQLInstanceDomain

Domain SPN queries often miss instances on default port 1433 and named instances on dynamic ports.

New Parameters

• -CheckEncryption - Test encryption enforcement on discovered instances
• -CheckDefaultInstance - Always test default port 1433 (catches instances not in SPNs)
• -DiscoverDynamicPorts - Use UDP SQL Browser (port 1434) to discover all instances dynamically
• -QuickAudit - Perform security audit (login, version, database, privileges, xp_ access)
• -SQLUsername / -SQLPassword - SQL Server authentication for QuickAudit

QuickAudit Output Columns

When -QuickAudit is enabled, adds: LoginSuccess, Version, CurrentLogin, CurrentDatabase, IsSysadmin, HasXpDirtree, HasXpFileexist, HasXpCmdshell

Example Usage

All switches can be combined:

# Complete assessment with Windows Authentication
Get-SQLInstanceDomain -CheckDefaultInstance -DiscoverDynamicPorts -CheckEncryption -QuickAudit -Verbose

# Complete assessment with SQL Authentication
Get-SQLInstanceDomain -CheckDefaultInstance -DiscoverDynamicPorts -CheckEncryption -QuickAudit -SQLUsername 'auditor' -SQLPassword 'P@ssw0rd' -Verbose

# From non-domain system: use runas /netonly first
runas /netonly /user:DOMAIN\username PowerShell.exe
# Then run the command above

Excel Export

$Assessment = Get-SQLInstanceDomain -CheckDefaultInstance -DiscoverDynamicPorts -CheckEncryption -QuickAudit -SQLUsername 'user' -SQLPassword 'pass' -Verbose
$Assessment | Export-Excel -Path "SQL_Assessment.xlsx" -AutoSize -AutoFilter -FreezeTopRow

Implementation Notes

• TDS pre-login packets for encryption detection (no authentication required)
• xp_ checks use HAS_PERMS_BY_NAME() for permissions (no execution to avoid hangs)
• 5-10 second timeouts on all network operations
• Automatic deduplication of instances from multiple discovery sources
• Works from non-domain systems via runas /netonly