πŸ†• Enumerating Channel Binding configuration

Having a valid account, it is possible to check whether CBT is required are not (and thus determine whether relay is possible or not) via the mssql_cbt module:

nxc mssql <target> -u <username> -p <password> -M mssql_cbt
MSSQL       <target>   1433   SRV22            [*] Windows Server 2022 Build 20348 (name:SRV22) (domain:<domain>) (EncryptionReq:True)
MSSQL       <target>   1433   SRV22            [+] <domain>\<username>:<password> 
MSSQL_CBT   <target>   1433   SRV22            Connection successful: Channel Binding Token NOT REQUIRED

If the result is anything but "Channel Binding token REQUIRED", then relaying is possible.