Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Hacking SQL Server Stored Procedures – Part 3: SQL Injection

netspi.com | vulnerability | #privilege-escalation | #sql-injection | #sql-server | #stored-procedures | #execute-as

Summary

SQL injection inside stored procedures using dynamic SQL can escalate to sysadmin when procedures run with elevated privileges via WITH EXECUTE AS or certificate signing, as this walkthrough shows.
Published
Collected

original ↗

Related coverage

vulnerability · netspi.com
Exploiting Second Order SQL Injection with Stored Procedures
This walkthrough covers exploiting second-order SQL injection in an Excel report export feature, chaining stored procedure UNC path injection via xp_dirtree to exfiltrate database details over DNS.
vulnerability · netspi.com
Preventing SQL Injection at the Database
SQL injection vulnerabilities are common out in the real world.
blog · netspi.com
Maintaining Persistence via SQL Server – Part 1: Startup Stored Procedures
Explains why SQL Server is an overlooked persistence layer, covering startup stored procedures that execute at service start, their detection, code review, removal, and PowerUpSQL automation.
blog · netspi.com
Hacking SQL Server Procedures – Part 4: Enumerating Domain Accounts
With only the Public role, native SQL Server functions can enumerate AD users, groups, and computers; NetSPI ships PowerShell and Metasploit modules automating this via direct connections or SQLi.
blog · netspi.com
Hacking SQL Server Stored Procedures – Part 2: User Impersonation
This lab walkthrough shows how the IMPERSONATE privilege lets low-privileged SQL Server logins escalate to sysadmin through EXECUTE AS configurations, automated with Metasploit and PowerShell.
blog · netspi.com
Hacking SQL Server Stored Procedures – Part 1: (un)Trustworthy Databases
When databases are marked TRUSTWORTHY but ownership stays privileged, web app database users can escalate to sysadmin; the walkthrough includes PowerShell, Metasploit, and SQL injection automation.
back