Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Attacking SQL Server CLR Assemblies

netspi.com | blog | #active-directory | #privilege-escalation | #persistence | #sql-server | #powerupsql | #clr

Summary

Demonstrates creating, importing, exporting, and altering SQL Server CLR assemblies to execute OS commands, escalate to sysadmin, and persist, with new PowerUpSQL functions for AD-wide campaigns.
Published
Collected

original ↗

Related coverage

blog · netspi.com
Establishing Registry Persistence via SQL Server with PowerUpSQL
Demonstrates using PowerUpSQL and the xp_regwrite extended stored procedure to write Windows registry Run keys from SQL Server, establishing persistence with the service account's privileges.
blog · netspi.com
Finding Sensitive Data on Domain SQL Servers using PowerUpSQL
Demonstrates using PowerUpSQL to discover accessible domain SQL Servers and rapidly sample databases for sensitive PCI, HIPAA, and other regulated records at scale.
blog · netspi.com
Finding Weak Passwords for Domain SQL Servers on Scale using PowerUpSQL
Shows how PowerUpSQL finds domain SQL Servers, enumerates SQL logins with a standard domain account, and audits them at scale for weak passwords that often enable privilege escalation.
blog · netspi.com
Blindly Discover SQL Server Instances with PowerUpSQL
Introduces PowerUpSQL discovery functions that enumerate SQL Server instances from local, network, and domain perspectives, an essential first step for data hunting or privilege escalation.
blog · netspi.com
Maintaining Persistence via SQL Server – Part 2: Triggers
Shows how DDL, DML, and logon triggers in SQL Server can be abused for persistence, provides a lab and detection guidance, and adds Get-SQLPersistTriggerDDL to PowerUpSQL.
blog · netspi.com
Maintaining Persistence via SQL Server – Part 1: Startup Stored Procedures
Explains why SQL Server is an overlooked persistence layer, covering startup stored procedures that execute at service start, their detection, code review, removal, and PowerUpSQL automation.
back