Get Windows Auto Login Passwords via SQL Server with PowerUpSQL

Demonstrates using PowerUpSQL and the xp_regwrite extended stored procedure to write Windows registry Run keys from SQL Server, establishing persistence with the service account's privileges.

Demonstrates using PowerUpSQL to discover accessible domain SQL Servers and rapidly sample databases for sensitive PCI, HIPAA, and other regulated records at scale.

Scott Sutherland shows how to bypass SQL Server logon trigger restrictions by spoofing hostnames and application names with lesser-known connection string properties, using SSMS and PowerUpSQL.

Introduces Get-SQLServerLinkCrawl, which walks every accessible linked server path from an initial SQL Server foothold, exposing versions, link-user privileges, and query execution across links.

Shows how PowerUpSQL finds domain SQL Servers, enumerates SQL logins with a standard domain account, and audits them at scale for weak passwords that often enable privilege escalation.

Introduces PowerUpSQL discovery functions that enumerate SQL Server instances from local, network, and domain perspectives, an essential first step for data hunting or privilege escalation.