Summary

In conclusion, there are many reasons for an adversary to choose SQL Server as a valuable target. We saw in practice how to perform enumeration against a database server. We deep-dived into various privilege escalation techniques, not focusing only on the database level. By gradually migrating from a low-privileged public account to SYSTEM, we covered the attacker’s kill chain. Then, many techniques for OS command execution were demonstrated in order to help us understand how tightly applications can be integrated with a host OS. Furthermore, we saw how database links can be abused by an adversary for lateral movement if they are not configured correctly. Finally, persistence techniques were discussed at the OS and database levels. A deeper understanding of available database functionality can give one party an advantage over the other.