πŸ†• Enumerating encryption settings

By default MSSQL databases do not enforce TLS ciphering which makes eavesdroping possible. There are two configurations values that can be set:

  • Force encryption: that will force establishing a TLS tunnel via the STARTTLS mechanism ;
  • Force strict encryption: which will force a standard TLS tunnel without having to use the STARTTLS mechanism.

NetExec will tell you whether one of these two options is enabled via the EncryptionReq flag on the host enumeration:

nxc mssql <target>
MSSQL       <target>   1433   SRV22            [*] Windows Server 2022 Build 20348 (name:SRV22) (domain:<domain>) (EncryptionReq:True)