Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Exploiting SQL Server Global Temporary Table Race Conditions

netspi.com | blog | #privilege-escalation | #pentest | #database | #race-condition | #sql-server

Summary

Global temporary tables in SQL Server are readable and writable by any user; NetSPI shows how least-privileged users can exploit race conditions to access data, including a TSQL Agent job escalation.
Published
Collected

original ↗

Related coverage

blog · netspi.com
Executing SMB Relay Attacks via SQL Server using Metasploit
Explains triggering SMB relay attacks through SQL Server functions like xp_dirtree, then using new Metasploit modules to capture, crack, or relay hashes; SMB signing is the main defense.
blog · netspi.com
SQL Server Local Authorization Bypass
Despite SQL Server 2008/2012 removing automatic sysadmin rights for local admins, NT AUTHORITY\SYSTEM keeps them, so attackers can psexec as SYSTEM and use osql for full database control.
blog · projectzero.google
Windows Exploitation Techniques: Winning Race Conditions with Path Lookups
A Windows exploitation technique post showing how path lookup behavior can be leveraged to reliably win race conditions, with worked examples and exploitation implications.
blog · projectzero.google
Race you to the kernel!
A race condition in OS X and iOS setuid binary loading leaves a short window to manipulate the memory of an euid 0 process, potentially gaining entitlements and loading unsigned kernel extensions.
research · starlabs.sg
[CVE-2025-39964] How I Found a $113,337 AF_ALG Linux Local Privilege Escalation Before Copy Fail
A retrospective on CVE-2025-39964, an AF_ALG race condition causing out-of-bounds scatterlist access in the Linux kernel. Exploitation yields root and a Docker container escape.
blog · netspi.com
Penetration Testing as a Service – Scaling to 50 Million Vulnerabilities
Introduces Penetration Testing as a Service (PTaaS), shipping the Resolve platform on every engagement to correlate and deliver findings in real time, starting with program management dashboards.
back