Beyond XP Cmdshell - Owning the Empire through SQL Server

Beyond XP Cmdshell - Owning the Empire through SQL Server

Explore advanced SQL Server exploitation techniques in this 27-minute conference talk from Derbycon 7. Delve into topics such as attack flow, SQL audit disabling, extended stored procedures, CLR, automation procedures, agent jobs, machine learning, and file autoruns. Gain insights into cheat sheets, future research directions, Empire modules, and new techniques for leveraging SQL Server vulnerabilities. Learn how to go beyond xp_cmdshell and potentially compromise entire networks through SQL Server misconfigurations and weaknesses.