Exploiting SQL Server Security Holes Robert L Davis Database Engineer www.sqlsoldier.com @SQLSoldier

Robert L Davis @SQLSoldier PASS Security Virtual Chapter Microsoft Certified Master Data Platform MVP @SQLSoldier www.sqlsoldier.com Database Engineer BlueMountain Capital Management 16+ years working with SQL Server PASS Security Virtual Chapter http://security.sqlpass.org Volunteers needed Database Engineer at BlueMountain Capital Management Foremer Principal Database Architect at DB Best Technologies www.dbbest.com Former Principal DBA at Outerwall, Inc Former Sr. Product Consultant with Idera Software Former Program Manager for SQL Server Certified Master program in Microsoft Learning Former Sr. Production DBA / Operations Engineer at Microsoft (CSS) Microsoft Certified Master: SQL Server 2008 / MCSM Charter: Data Platform Co-founder of the SQL PASS Security Virtual Chapter MCITP: Database Developer: SQL Server 2005 and 2008 MCITP: Database Administrator: SQL Server 2005 and 2008 MCSE: Data Platform MVP 2014 Co-author of Pro SQL Server 2008 Mirroring Former Idera ACE (Advisors & Community Educators) 2 time host of T-SQL Tuesday Guest Professor at SQL University, summer 2010, spring/summer 2011 Speaker at SQL PASS Summit 2010, 2011, and 2012 including a pre-con in 2012 Speaker/Pre-con at SQLRally 2012 16+ years working with SQL Server Writer for SQL Server Pro (formerly SQL Server Magazine) Member: Mensa Dog picture: Maggie and Woody SQLCruise instructor: Seattle to Alaska 2012 Speaker at SQL Server Intelligence Conference in Seattle 2012 Blog: http://www.sqlsoldier.com Twitter: http://twitter.com/SQLSoldier

Exploiting SQL Server Security Holes Agenda Permissions Superset Database Owner Bypassing Logins Trustworthy

Exploiting SQL Server Security Holes Permissions Superset Demo #1

Exploiting SQL Server Security Holes Permissions Superset User gets all permissions available to them When grants and denies conflict deny wins Almost always Due to ANSI standards, an explicit grant on a column overrides and explicit deny on a column

Exploiting SQL Server Security Holes Database Owner Demo #2

Exploiting SQL Server Security Holes Database Owner Mapped automatically to the dbo account Has all perms inside of database (DML, DDL, etc) Has broad permissions for modifying the database properties Can make a variety of changes that can be damaging to the database or even the server Page verification, file settings, recovery model, auto-shrink, auto-close, etc Still cannot change TRUSTWORTHY Impersonated by sysadmin when sysadmin is in the database If no valid owner, you may receive error that the user cannot perform the requested action under the current security context

Exploiting SQL Server Security Holes Bypassing Logins Demo #3

Exploiting SQL Server Security Holes Bypassing Logins Relates directly to permissions superset If user can login via group membership, the individual perms are included in the superset Even if the individual login doesn’t exist

Exploiting SQL Server Security Holes Trustworthy Demo #4

Exploiting SQL Server Security Holes Trustworthy Sounds like a good thing to have Used for unsafe CLR assemblies or assemblies with external access Used to allow cross-database permissions chaining Can usually be done instead with signed modules or signed assemblies Effectively allows a db owner to take over the whole server

Exploiting SQL Server Security Holes Q & A

Thank you for coming! Thanks! My blog: www.sqlsoldier.com Twitter: twitter.com/SQLSoldier