Hijacking SQL Server Credentials using Agent Jobs for Domain Privilege Escalation

This post focuses on obtaining domain administrative privileges from a local administrator or domain user account. Once the initial steps have been taken to obtain local administrative access on a Windows operating system, the natural next steps are to gain domain user and domain administrative privileges.

Demonstrates using PowerUpSQL to discover accessible domain SQL Servers and rapidly sample databases for sensitive PCI, HIPAA, and other regulated records at scale.

Shows how PowerUpSQL finds domain SQL Servers, enumerates SQL logins with a standard domain account, and audits them at scale for weak passwords that often enable privilege escalation.

Introduces PowerUpSQL discovery functions that enumerate SQL Server instances from local, network, and domain perspectives, an essential first step for data hunting or privilege escalation.

Shows how DDL, DML, and logon triggers in SQL Server can be abused for persistence, provides a lab and detection guidance, and adds Get-SQLPersistTriggerDDL to PowerUpSQL.

Explains why SQL Server is an overlooked persistence layer, covering startup stored procedures that execute at service start, their detection, code review, removal, and PowerUpSQL automation.