Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Bypassing SQL Server Logon Trigger Restrictions

netspi.com | blog | #pentesting | #spoofing | #sql-server | #logon-trigger | #powerupsql | #ssms | #connection-string

Summary

Scott Sutherland shows how to bypass SQL Server logon trigger restrictions by spoofing hostnames and application names with lesser-known connection string properties, using SSMS and PowerUpSQL.
Published
Collected

original ↗

Related coverage

blog · netspi.com
Get Windows Auto Login Passwords via SQL Server with PowerUpSQL
Dumps Windows auto-login credentials through SQL Server using xp_regread and PowerUpSQL, covering post-SP4 access restrictions and useful registry reads for least-privilege logins.
blog · netspi.com
Finding Sensitive Data on Domain SQL Servers using PowerUpSQL
Demonstrates using PowerUpSQL to discover accessible domain SQL Servers and rapidly sample databases for sensitive PCI, HIPAA, and other regulated records at scale.
blog · netspi.com
Establishing Registry Persistence via SQL Server with PowerUpSQL
Demonstrates using PowerUpSQL and the xp_regwrite extended stored procedure to write Windows registry Run keys from SQL Server, establishing persistence with the service account's privileges.
blog · netspi.com
Finding Weak Passwords for Domain SQL Servers on Scale using PowerUpSQL
Shows how PowerUpSQL finds domain SQL Servers, enumerates SQL logins with a standard domain account, and audits them at scale for weak passwords that often enable privilege escalation.
blog · netspi.com
Blindly Discover SQL Server Instances with PowerUpSQL
Introduces PowerUpSQL discovery functions that enumerate SQL Server instances from local, network, and domain perspectives, an essential first step for data hunting or privilege escalation.
blog · netspi.com
Maintaining Persistence via SQL Server – Part 2: Triggers
Shows how DDL, DML, and logon triggers in SQL Server can be abused for persistence, provides a lab and detection guidance, and adds Get-SQLPersistTriggerDDL to PowerUpSQL.
back