search

NetSPI / PowerUpSQL

PowerUpSQL: A PowerShell Toolkit for Attacking SQL Server
Other
2.47k stars 462 forks source link

Requested Feature: Nested Impersonation #31

Open nullbind opened 6 years ago

nullbind commented 6 years ago

Would it be possible to implement nested impersonation capabilities in the scenario in which you cannot go straight to sysadmin? If not, am I missing an understanding as to why it is not possible?

nullbind commented 6 years ago

You are correct, nested impersonation is possible in SQL Server. Both at the SQL Server login and database user levels. We have done it manually a few times, but haven't taken the time to automate it yet. I'll put it in our follow up list, and see if we can get it addressed before EOY. I think we'd like to add the feature as a "-Recursive" or "-Nested" flag in the existing "Invoke-SQLAuditPrivImpersonateLogin" and "Invoke-SQLAuditPrivImpersonateLogin" functions.

D00MFist commented 6 years ago

Thanks for adding the feature request for me. I'll keep working on it and submit a pull request once I get a functioning version.

nullbind commented 6 years ago

No worries, thanks for reaching out. It should be a fun feature. I’m curious to see what trends it may uncover once we find an opportunity to run it on scale. Cool stuff!