Lateral movement

As we saw in Chapter 5, it is crucial to understand how an adversary can abuse legitimate applications and protocols to expand inside the target environment. SQL Server also broadens lateral movement scenarios via two techniques. One is common and called shared service accounts. The other one is specific only to SQL Server – abusing database links. We will quickly explore the first one and focus on the second. We will examine how to do enumeration on linked servers, execute code, and extract clear-text hardcoded credentials.

Shared service accounts

Using shared service accounts across an environment may lead to disastrous consequences. If a service account is compromised via Kerberoasting, UNC path injection, or any other way, it means that all instances using this account are compromised. Moreover, the service account by default has sysadmin privileges on the database and SQL Server levels, but it also may have extensive privileges on the underlying OS...