Turning Enterprise Update Servers Into Backdoor Factories (0_o) – Part 1

Account Operators looks harmless without 'admin' in its name, yet it grants broad control over domain identities—here is how attackers abuse it to escalate.

Explains why SQL Server is an overlooked persistence layer, covering startup stored procedures that execute at service start, their detection, code review, removal, and PowerUpSQL automation.

SQL injection inside stored procedures using dynamic SQL can escalate to sysadmin when procedures run with elevated privileges via WITH EXECUTE AS or certificate signing, as this walkthrough shows.

Misconfigured SQL Server linked servers let attackers traverse database link networks, access unauthorized data, and deploy shells. The post covers enumerating links via the sysservers table.

This blog will provide some examples that illustrate how the OSQL utility can be used to gain unauthorized access to systems, databases, and sensitive information.

A deep dive into why SCCM application execution spawns via WmiPrvSE.exe instead of CcmExec.exe, and how to detect anomalous SCCM deployments.