In today’s video I give you a taste of how you might be able to turn access to one SQL server into free domain admin access using mssqlclient.py. We discuss:
Logging into a SQL instance
Using SQL stored procedures to coerce the SQL server to send an SMB connection to your attacking system
Opportunities to capture/relay/crack high-privilege SQL creds
Enjoy!
-Brian
