Security - Jon Gurgul's Blog

Regain access to SQL Server via inject service

Aug 12, 2017

—

by

One way to regain access to SQL Server is to use a simple inject technique which overrides the current Image Path for the SQL Writer service. PsExec can alternatively be used to access SQL Server as shown in the post below. This relies on the NT AUTHORITY\SYSTEM account having been granted system administrator on…

Checking what permissions they have in SQL Server

May 29, 2014

—

by

Jon Gurgul

in SQL Server

The function sys.fn_my_permissions is very useful for seeing what permissions you have, but it can be just as useful to check someone else. For this all that is needed is to use EXECUTE AS to impersonate them.

Dangers of giving dbo in MSDB

Apr 22, 2014

—

by

Jon Gurgul

in SQL Server

I wanted to talk today about something that I have often seen in environments which is that dbo is granted to msdb without a second thought to the exact implications. So what? Its not got any user data in it, and they need dbo to perform some action not covered by the existing security to do…

SQL Server Login password hash

Jan 30, 2014

—

by

Jon Gurgul

in SQL Server

In this article we will look at how SQL Server stores passwords and how we can go about working them out. As a developer/administrator you are probably accessing SQL Server via a windows login, however the other option is when the instance is changed into mixed mode allowing SQL Logins. These logins are created within…

Running as local system to allow administrators in to SQL Server

Dec 15, 2013

—

by

Jon Gurgul

in SQL Server

In cases when there are no provisioned accounts in a SQL Server instance which are known or working, then there is an option instead to run as nt authority \ system (local system). Note that in SQL 2012 local system no longer has sa and you will have to instead start SQL Server in single user…

SQL Server Instance Security: Scripting Permissions Part 2

Mar 22, 2012

—

by

Jon Gurgul

in SQL Server

After writing a powershell way of scripting permissions I thought I better just show the way I used to do it using T-SQL. Although this script is not complete and is kind of relic of my scripting work I thought that I would include it and perhaps maybe if it is on this blog it…

SQL Server Instance Security: Scripting Permissions

Mar 22, 2012

—

by

Jon Gurgul

in Powershell

Another How-To post and this time focusing on scripting permissions. Here is how to script User(s), Object(s), Role(s), Server Role(s) and Server Object(s) Permissions. Beginning with the simple way via SSMS, before showing a custom script solution that I have written. Scripting SQL Server Security: Simple Solution In order to script the security settings for…

Tag: Security

Regain access to SQL Server via inject service

Checking what permissions they have in SQL Server

Dangers of giving dbo in MSDB

SQL Server Login password hash

Running as local system to allow administrators in to SQL Server

SQL Server Instance Security: Scripting Permissions Part 2

SQL Server Instance Security: Scripting Permissions