MS SQL servers are generally deployed in plenty in a Windows domain. SQL Servers provide very good options for lateral movement as domain users can be mapped to database roles. For MSSQL and PowerShell hackery, lets use PowerUpSQL.

• https://github.com/NetSPI/PowerUpSQL
• https://github.com/NetSPI/PowerUpSQL/wiki/PowerUpSQL-Cheat-Sheet

🔎Internal Enumeration

🔥Remote Code Execution/Privilege Escalation

📚References

• https://www.offsec-journey.com/post/attacking-ms-sql-servers
• https://www.netspi.com/blog/technical-blog/network-pentesting/hacking-sql-server-stored-procedures-part-2-user-impersonation/
• https://www.bordergate.co.uk/attacking-mssql/