Decrypting MSSQL Credential Passwords

MSSQL linked server credentials are reversibly encrypted, letting sysadmin-level attackers recover cleartext passwords via a new PowerShell script. Defensive advice on database links included.

Introduces PowerUpSQL discovery functions that enumerate SQL Server instances from local, network, and domain perspectives, an essential first step for data hunting or privilege escalation.

With only the Public role, native SQL Server functions can enumerate AD users, groups, and computers; NetSPI ships PowerShell and Metasploit modules automating this via direct connections or SQLi.

This lab walkthrough shows how the IMPERSONATE privilege lets low-privileged SQL Server logins escalate to sysadmin through EXECUTE AS configurations, automated with Metasploit and PowerShell.

When databases are marked TRUSTWORTHY but ownership stays privileged, web app database users can escalate to sysadmin; the walkthrough includes PowerShell, Metasploit, and SQL injection automation.

A pentest cheat sheet of fifteen file transfer techniques for compromised Windows boxes, from PowerShell and Python to FTP, TFTP, bitsadmin, wget, netcat, and compiled-source tricks.