Hacking SQL Server 2008 (Kind of…)
During SQL Server 2008 installation, it's easy to skip the steps for properly configuring security, or you might accidentally remove the administrator user from a server and lose the ability to connect. These steps help you recover administrator control of a SQL Server 2008 instance without having to reinstall it, but they also demonstrate how a privilege escalation attack could be configured on a SQL Server 2008 system.
The Problem
I use SQL Server Express 2008 R2 with Advanced Services because it's free, works great for practically everything I do, and is lightweight enough that the machine doesn't get destroyed trying to pretend to be a server. Well, during the installation of this machine, I wasn't careful to enable mixed authentication, or worse yet, to make the machine administrators become SQL administrators. So at the end of the day, I had a machine running SQL Server that I could only connect to as a user with restricted privileges—meaning I couldn't create databases, elevate my privileges, change the security mode, etc.
The Solution
Following these steps, I was able to connect to the database in single-user mode, grant my machine's administrator user the sysadmin role, and recover control of my database.
- Stop all SQL Server services
-
Connect in single-user mode:
C:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn> sqlservr.exe -s MyInstance -m
-
Open a new console and connect with SQLCMD:
C:\> SQLCMD -S MyServer\MyInstance -E
-
Execute sp_addsrvrolemember to elevate privileges:
exec sp_addsrvrolemember @loginame='MyDomain\MyUser', @rolename='sysadmin'
- Stop with Shutdown and restart the service
Hacked?
Since what I did here was basically take a user who is only an administrator of their machine and elevate their privileges to become a SQL administrator, I've effectively configured a privilege escalation attack that gives a user access to all databases on a given system in just a few minutes.
How to Counter This Attack
The most important thing is to ensure that users have standard user accounts and are not administrators of local machines. According to some security experts, this is the main vulnerability of the entire Microsoft platform in terms of security.
This technique is useful for recovering administrative access to your own database, but it also illustrates the importance of following security best practices during the initial installation.