Compromising Microsoft SQL Server

This chapter will focus on a common and vital service of a typical Windows-based environment – Microsoft SQL Server. SQL Server is a relational database management system, similar to Oracle or MySQL. It is tightly integrated into Active Directory, allowing Windows authentication, the use of trust relationships, and much more. We will go through the usual attack steps, starting with the discovery and enumeration of instances in a target environment. A few different tools can help with these activities. Then, we will explore the ways to escalate privileges within SQL Server and then move on to run commands on the underlying operating system. This chapter will provide you with a solid understanding of lateral movement between database instances by abusing database links. Lastly, we will look at the ways to achieve persistence at the host and application levels utilizing what is available in SQL Server functionality.

In this chapter, we will...