Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

How to get SQL Server Sysadmin Privileges as a Local Admin with PowerUpSQL

netspi.com | blog | #privilege-escalation | #windows | #sql-server | #powerupsql | #token-impersonation

Summary

Because SQL Server service accounts hold sysadmin by default, a local admin can impersonate them via token manipulation or extract their credentials, gaining DBA-level control of every instance.
Published
Collected

original ↗

Related coverage

blog · netspi.com
Establishing Registry Persistence via SQL Server with PowerUpSQL
Demonstrates using PowerUpSQL and the xp_regwrite extended stored procedure to write Windows registry Run keys from SQL Server, establishing persistence with the service account's privileges.
blog · netspi.com
Get Windows Auto Login Passwords via SQL Server with PowerUpSQL
Dumps Windows auto-login credentials through SQL Server using xp_regread and PowerUpSQL, covering post-SP4 access restrictions and useful registry reads for least-privilege logins.
blog · netspi.com
Finding Sensitive Data on Domain SQL Servers using PowerUpSQL
Demonstrates using PowerUpSQL to discover accessible domain SQL Servers and rapidly sample databases for sensitive PCI, HIPAA, and other regulated records at scale.
blog · netspi.com
Finding Weak Passwords for Domain SQL Servers on Scale using PowerUpSQL
Shows how PowerUpSQL finds domain SQL Servers, enumerates SQL logins with a standard domain account, and audits them at scale for weak passwords that often enable privilege escalation.
blog · netspi.com
Blindly Discover SQL Server Instances with PowerUpSQL
Introduces PowerUpSQL discovery functions that enumerate SQL Server instances from local, network, and domain perspectives, an essential first step for data hunting or privilege escalation.
blog · netspi.com
Maintaining Persistence via SQL Server – Part 2: Triggers
Shows how DDL, DML, and logon triggers in SQL Server can be abused for persistence, provides a lab and detection guidance, and adds Get-SQLPersistTriggerDDL to PowerUpSQL.
back