SQL Server Link Crawling with PowerUpSQL

Misconfigured SQL Server linked servers let attackers traverse database link networks, access unauthorized data, and deploy shells. The post covers enumerating links via the sysservers table.

This blog will provide some examples that illustrate how the OSQL utility can be used to gain unauthorized access to systems, databases, and sensitive information.

Shows how to find SQL Server instances bundled with third-party applications and test them against a default credential list, using PowerUpSQL functions for discovery and automated login attempts.

PowerUpSQL's core capabilities land in Empire as six modules, from SPN-based SQL Server discovery to xp_cmdshell OS command execution for lateral movement.

Demonstrates using PowerUpSQL and the xp_regwrite extended stored procedure to write Windows registry Run keys from SQL Server, establishing persistence with the service account's privileges.

Dumps Windows auto-login credentials through SQL Server using xp_regread and PowerUpSQL, covering post-SP4 access restrictions and useful registry reads for least-privilege logins.