Privilege escalation

In the previous section, we saw a number of techniques for database enumeration. In this section, we will use gathered reconnaissance results for the user khal.drogo to identify privilege escalation paths on the database server. We will also practice escalating privileges from SQL Server to the host itself. At the end of this section, we will escalate to the sysadmin role from the user, with host local administrator privileges.

Impersonation

One of the most common privilege escalation vectors is user impersonation. This privilege allows the impersonation of another user or login in order to access resources on behalf of the impersonated user, without specifically granting rights[10]. sysadmin has this permission for all databases, members of the db_owner role only have this permission in databases they own. We can check whether a current user is allowed to impersonate sa user login with the following query:

EXECUTE AS LOGIN = 'sa'
SELECT SYSTEM_USER...