Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Hacking SQL Server Stored Procedures – Part 1: (un)Trustworthy Databases

netspi.com | blog | #privilege-escalation | #sql-injection | #powershell | #metasploit | #sql-server | #trustworthy-database

Summary

When databases are marked TRUSTWORTHY but ownership stays privileged, web app database users can escalate to sysadmin; the walkthrough includes PowerShell, Metasploit, and SQL injection automation.
Published
Collected

original ↗

Related coverage

blog · netspi.com
Hacking SQL Server Procedures – Part 4: Enumerating Domain Accounts
With only the Public role, native SQL Server functions can enumerate AD users, groups, and computers; NetSPI ships PowerShell and Metasploit modules automating this via direct connections or SQLi.
blog · netspi.com
Hacking SQL Server Stored Procedures – Part 2: User Impersonation
This lab walkthrough shows how the IMPERSONATE privilege lets low-privileged SQL Server logins escalate to sysadmin through EXECUTE AS configurations, automated with Metasploit and PowerShell.
blog · netspi.com
Blindly Discover SQL Server Instances with PowerUpSQL
Introduces PowerUpSQL discovery functions that enumerate SQL Server instances from local, network, and domain perspectives, an essential first step for data hunting or privilege escalation.
blog · netspi.com
Decrypting MSSQL Credential Passwords
SQL Server stores credential passwords reversibly encrypted in master.sys.sysobjvalues, so sysadmin attackers can decrypt them. NetSPI updates its PowerShell script for post-exploitation recovery.
blog · netspi.com
Locate and Attack Domain SQL Servers without Scanning
Any domain user can query AD SPN records to enumerate every SQL Server—instances and ports included—without noisy scans; NetSPI's Get-SQLServerAccess module then tests each for accessible logins.
blog · netspi.com
Executing MSF Payloads via PowerShell Webshellery
A Metasploit module turns arbitrary file upload into shells on Windows backends: its JSP, PHP, or ASPX webshells launch base64-encoded PowerShell commands running MSF payloads past antivirus.
back