Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

SQL Server – Link….. Link….. Link….. and Shell: How to Hack Database Links in SQL Server!

netspi.com | blog | #privilege-escalation | #penetration-testing | #lateral-movement | #database-security | #sql-server | #linked-servers

Summary

Misconfigured SQL Server linked servers let attackers traverse database link networks, access unauthorized data, and deploy shells. The post covers enumerating links via the sysservers table.
Published
Collected

original ↗

Related coverage

blog · netspi.com
SQL Server Link Crawling with PowerUpSQL
Introduces Get-SQLServerLinkCrawl, which walks every accessible linked server path from an initial SQL Server foothold, exposing versions, link-user privileges, and query execution across links.
blog · netspi.com
When Databases Attack: Hacking with the OSQL Utility
This blog will provide some examples that illustrate how the OSQL utility can be used to gain unauthorized access to systems, databases, and sensitive information.
blog · netspi.com
When Databases Attack – Finding Data on SQL Servers
Scott Sutherland shares scripts for finding sensitive data in SQL Server: a TSQL script sampling keyword-matching columns across databases, plus a Metasploit auxiliary module wrapping it.
blog · netspi.com
Decrypting MSSQL Database Link Server Passwords
MSSQL linked server credentials are reversibly encrypted, letting sysadmin-level attackers recover cleartext passwords via a new PowerShell script. Defensive advice on database links included.
blog · netspi.com
When Databases Attack: SQL Server Express Privilege Inheritance Issue
By default, SQL Server Express grants connect rights to BUILTIN\Users, letting any authenticated domain user reach instances with TCP listeners enabled. The author details the attack path and fixes.
blog · netspi.com
When Databases Attack: Secure360
Antti and I presented our revised version of "When Databases Attack" at the Secure360 conference in Minneapolis a few weeks ago.
back