Executing SMB Relay Attacks via SQL Server using Metasploit

With only the Public role, native SQL Server functions can enumerate AD users, groups, and computers; NetSPI ships PowerShell and Metasploit modules automating this via direct connections or SQLi.

This lab walkthrough shows how the IMPERSONATE privilege lets low-privileged SQL Server logins escalate to sysadmin through EXECUTE AS configurations, automated with Metasploit and PowerShell.

When databases are marked TRUSTWORTHY but ownership stays privileged, web app database users can escalate to sysadmin; the walkthrough includes PowerShell, Metasploit, and SQL injection automation.

Introduces the mssql_local_auth_bypass Metasploit post module that turns a local admin Meterpreter session into SQL Server sysadmin access, plus a module to search databases for sensitive data.

Shares slides, Metasploit modules, and videos from the OWASP AppSec 2012 talk on abusing SQL Server trust relationships, misconfigurations, and weak defaults to reach high-value systems and data.

Despite SQL Server 2008/2012 removing automatic sysadmin rights for local admins, NT AUTHORITY\SYSTEM keeps them, so attackers can psexec as SYSTEM and use osql for full database control.