← Back to Academy

Academy Node

SQLAdmin

SQLAdmin means a principal has administrative control over MSSQL service or server context.

Intermediate100 XPBloodHound Edge

Why it matters

It can lead to xp_cmdshell, linked server abuse, credential access, or code execution.

How to identify it

  • BloodHound SQLAdmin edge
  • MSSQL login with sysadmin role

BloodHound indicators

  • SQLAdmin

NetExec commands

nxc mssql 192.168.184.150 -d xutslabs.local -u USER -p PASS

Impacket commands

impacket-mssqlclient xutslabs.local/USER:PASS@192.168.184.150 -windows-auth

Expected output

  • SQL prompt
  • IS_SRVROLEMEMBER('sysadmin') = 1

Success looks like

  • Can enable xp_cmdshell
  • Can enumerate linked servers

Failure looks like

  • Login failed
  • Not sysadmin

Troubleshooting

  • Try -windows-auth
  • Check SPNs
  • Try domain formats

Common mistakes

  • Not trying Windows auth
  • Skipping linked servers

Alternative attacks

  • Kerberoast svc_sql

What to try next

  • xp_cmdshell
  • linked servers
  • hash capture

Recommended next lessons

ASREP Roast

ASREP roasting abuses AD users with Kerberos pre-authentication disabled. You can request encrypted ASREP material and attempt to crack it offline.

Kerberoast

Kerberoasting targets domain users with SPNs. You request service tickets and crack them offline.

GenericWrite

GenericWrite means you can modify certain attributes on the target AD object.

GenericAll

GenericAll is effectively full control over the target AD object.