Expanding the Empire with SQL

Surveys administrative WMI classes such as Win32_Service for remote service creation and system changes, positioning WMI as a quieter alternative channel for post-exploitation administration.

Introduces Get-SQLServerLinkCrawl, which walks every accessible linked server path from an initial SQL Server foothold, exposing versions, link-user privileges, and query execution across links.

Demonstrates using PowerUpSQL and the xp_regwrite extended stored procedure to write Windows registry Run keys from SQL Server, establishing persistence with the service account's privileges.

Dumps Windows auto-login credentials through SQL Server using xp_regread and PowerUpSQL, covering post-SP4 access restrictions and useful registry reads for least-privilege logins.

Demonstrates using PowerUpSQL to discover accessible domain SQL Servers and rapidly sample databases for sensitive PCI, HIPAA, and other regulated records at scale.

Shows how PowerUpSQL finds domain SQL Servers, enumerates SQL logins with a standard domain account, and audits them at scale for weak passwords that often enable privilege escalation.