Privilege Escalation

MSSQL privilege escalation moves a low-privileged database user to sysadmin. The IMPERSONATE permission lets you execute queries as another user or login, often escalating to sa through a chain of impersonation grants.

Databases marked as TRUSTWORTHY allow stored procedures owned by db_owner to execute in the security context of the database owner, which is frequently sa. Excessive role memberships and forgotten service account privileges provide additional escalation paths.