SQL Server Local Authorization Bypass

Summary

Despite SQL Server 2008/2012 removing automatic sysadmin rights for local admins, NT AUTHORITY\SYSTEM keeps them, so attackers can psexec as SYSTEM and use osql for full database control.

Published: 2012-08-16 00:00
Collected: 2026-09-20 06:10

original ↗

← PreviousA False Sense of Security Next →PA-DSS vendors now have training options

Related coverage

blog · netspi.com

Executing SMB Relay Attacks via SQL Server using Metasploit

Explains triggering SMB relay attacks through SQL Server functions like xp_dirtree, then using new Metasploit modules to capture, crack, or relay hashes; SMB signing is the main defense.

blog · projectzero.google

Windows Exploitation Tricks: Exploiting Arbitrary File Writes for Local Elevation of Privilege

A Project Zero post explains how arbitrary file write bugs on Windows can be turned into local privilege escalation, walking through practical exploitation techniques for this bug class.

blog · projectzero.google

Windows Exploitation Tricks: Arbitrary Directory Creation to Arbitrary File Read

A Project Zero post in the Windows exploitation tricks series, showing how an arbitrary directory creation primitive can be escalated into arbitrary file read.

blog · projectzero.google

Exploiting a Leaked Thread Handle

A bug in the Windows Secondary Logon service, fixed as MS16-032, leaks a fully accessible thread handle from a privileged process, enabling privilege escalation without memory corruption.

blog · projectzero.google

Raising the Dead

A Windows Terminal Server issue allowing dead processes to be resurrected, reported to Microsoft and fixed in MS15-111, demonstrated as an exploitable elevation of privilege.

blog · projectzero.google

Windows Sandbox Attack Surface Analysis

Analyzing the attack surface of user-mode sandboxed applications helps find elevation of privilege bugs; automating the enumeration matters for initial analysis and detecting regressions.

back