SQL Server Hacking on Scale using PowerShell

Presented at DerbyCon 6.0 Recharge (2016), Sept. 24, 2016, 3 p.m. (25 minutes).

This presentation will provide an overview of common SQL Server discovery, privilege escalation, persistence, and data targeting techniques. Techniques will be shared for escalating privileges on SQL Server and associated Active Directory domains. Finally we’ll show how PowerShell automation can be used to execute the SQL Server attacks on scale. All scripts created and demonstrated during the presentation will be open sourced. This should be useful to penetration testers and system administrators trying to gain a better understanding of their SQL Server attack surface and how it can be exploited.

Presenters:

• Scott Sutherland / nullbind   as Scott Sutherland

Similar Presentations:

• THOTCON 0x8 (2017) / SQL Server Hacking on Scale using PowerShell
• ToorCon San Diego 14 (2012) / Microsoft SQL Server Post-Exploitation - When Databases Attack
• DEF CON 20 (2012) / SQL ReInjector - Automated Exfiltrated Data Identification