1. Exploiting SQL Server Security Holes
Robert L Davis
Database Engineer
@SQLSoldier

2. Robert L Davis @SQLSoldier PASS Security Virtual Chapter
Microsoft Certified Master
Data Platform MVP
@SQLSoldier
Database Engineer
BlueMountain Capital Management
16+ years working with SQL Server
PASS Security Virtual Chapter
Volunteers needed
Database Engineer at BlueMountain Capital Management
Foremer Principal Database Architect at DB Best Technologies
Former Principal DBA at Outerwall, Inc
Former Sr. Product Consultant with Idera Software
Former Program Manager for SQL Server Certified Master program in Microsoft Learning
Former Sr. Production DBA / Operations Engineer at Microsoft (CSS)
Microsoft Certified Master: SQL Server 2008 / MCSM Charter: Data Platform
Co-founder of the SQL PASS Security Virtual Chapter
MCITP: Database Developer: SQL Server 2005 and 2008
MCITP: Database Administrator: SQL Server 2005 and 2008
MCSE: Data Platform
MVP 2014
Co-author of Pro SQL Server 2008 Mirroring
Former Idera ACE (Advisors & Community Educators)
2 time host of T-SQL Tuesday
Guest Professor at SQL University, summer 2010, spring/summer 2011
Speaker at SQL PASS Summit 2010, 2011, and 2012 including a pre-con in 2012
Speaker/Pre-con at SQLRally 2012
16+ years working with SQL Server
Writer for SQL Server Pro (formerly SQL Server Magazine)
Member: Mensa
Dog picture: Maggie and Woody
SQLCruise instructor: Seattle to Alaska 2012
Speaker at SQL Server Intelligence Conference in Seattle 2012
Blog:
Twitter:

3. Exploiting SQL Server Security Holes
Agenda
Permissions Superset
Database Owner
Bypassing Logins
Trustworthy

4. Exploiting SQL Server Security Holes
Permissions Superset
Demo #1

5. Exploiting SQL Server Security Holes
Permissions Superset
User gets all permissions available to them
When grants and denies conflict deny wins
Almost always
Due to ANSI standards, an explicit grant on a column overrides and explicit deny on a column

6. Exploiting SQL Server Security Holes
Database Owner
Demo #2

7. Exploiting SQL Server Security Holes
Database Owner
Mapped automatically to the dbo account
Has all perms inside of database (DML, DDL, etc)
Has broad permissions for modifying the database properties
Can make a variety of changes that can be damaging to the database or even the server
Page verification, file settings, recovery model, auto-shrink, auto-close, etc
Still cannot change TRUSTWORTHY
Impersonated by sysadmin when sysadmin is in the database
If no valid owner, you may receive error that the user cannot perform the requested action under the current security context

8. Exploiting SQL Server Security Holes
Bypassing Logins
Demo #3

9. Exploiting SQL Server Security Holes
Bypassing Logins
Relates directly to permissions superset
If user can login via group membership, the individual perms are included in the superset
Even if the individual login doesn’t exist

10. Exploiting SQL Server Security Holes
Trustworthy
Demo #4

11. Exploiting SQL Server Security Holes
Trustworthy
Sounds like a good thing to have
Used for unsafe CLR assemblies or assemblies with external access
Used to allow cross-database permissions chaining
Can usually be done instead with signed modules or signed assemblies
Effectively allows a db owner to take over the whole server

12. Exploiting SQL Server Security Holes
Q & A

13. Thank you for coming! Thanks! My blog: www.sqlsoldier.com
Twitter: twitter.com/SQLSoldier