Hacking SQL Server Stored Procedures – Part 2: User Impersonation

With only the Public role, native SQL Server functions can enumerate AD users, groups, and computers; NetSPI ships PowerShell and Metasploit modules automating this via direct connections or SQLi.

When databases are marked TRUSTWORTHY but ownership stays privileged, web app database users can escalate to sysadmin; the walkthrough includes PowerShell, Metasploit, and SQL injection automation.

Introduces PowerUpSQL discovery functions that enumerate SQL Server instances from local, network, and domain perspectives, an essential first step for data hunting or privilege escalation.

SQL Server stores credential passwords reversibly encrypted in master.sys.sysobjvalues, so sysadmin attackers can decrypt them. NetSPI updates its PowerShell script for post-exploitation recovery.

Any domain user can query AD SPN records to enumerate every SQL Server—instances and ports included—without noisy scans; NetSPI's Get-SQLServerAccess module then tests each for accessible logins.

A Metasploit module turns arbitrary file upload into shells on Windows backends: its JSP, PHP, or ASPX webshells launch base64-encoded PowerShell commands running MSF payloads past antivirus.