OWASP AppSec 2012 Presentation: SQL Server Exploitation, Escalation, and Pilfering

In September, Antti Rantasaari and I delivered our presentation “Escalating Privileges through Database Trusts” at the OWASP APPSEC 2010 conference in CA.

With only the Public role, native SQL Server functions can enumerate AD users, groups, and computers; NetSPI ships PowerShell and Metasploit modules automating this via direct connections or SQLi.

This lab walkthrough shows how the IMPERSONATE privilege lets low-privileged SQL Server logins escalate to sysadmin through EXECUTE AS configurations, automated with Metasploit and PowerShell.

When databases are marked TRUSTWORTHY but ownership stays privileged, web app database users can escalate to sysadmin; the walkthrough includes PowerShell, Metasploit, and SQL injection automation.

Explains triggering SMB relay attacks through SQL Server functions like xp_dirtree, then using new Metasploit modules to capture, crack, or relay hashes; SMB signing is the main defense.

Introduces the mssql_local_auth_bypass Metasploit post module that turns a local admin Meterpreter session into SQL Server sysadmin access, plus a module to search databases for sensitive data.