MSSQL:
Exploitation
RCE, privilege escalation, and credential capture via MSSQL
MSSQL Privilege Escalation via Impersonation
Exploit MSSQL IMPERSONATE privileges to escalate from low-privileged login to sysadmin by chaining user impersonation within database execution contexts.
MSSQL RCE via xp_cmdshell
Exploit MSSQL xp_cmdshell to achieve remote code execution, covering enablement via sp_configure, privilege requirements, and command execution techniques.
MSSQL exploitation turns database access into operating system control. Enabling xp_cmdshell provides direct command execution as the SQL Server service account. OLE Automation procedures and CLR assembly loading offer alternative execution paths when xp_cmdshell is restricted.
Credential brute-forcing against sa and other accounts is often viable since MSSQL instances frequently use weak or default passwords. Known CVEs in unpatched instances can provide unauthenticated access or privilege escalation.