Lateral movement is an attacker’s progression from one compromised system or account to additional systems inside an environment. In SQL Server environments, a compromised instance can become a bridge to other servers or to the operating system. section 14.4
Mistake: treating a privileged SQL Server feature as harmless because trusted administrators can use it.
- Enabling xp_cmdshell lets commands run in the operating-system context of the SQL Server service account, which may be highly privileged. section 14.4
- A coarse-grained service account can extend the compromise to other SQL Server instances through privileged credentials or linked servers. section 14.4
- An attacker may move from SQL Server to the operating system, use an SMB interception attack, and expose credentials with access elsewhere. section 14.4
- Keep xp_cmdshell disabled, alert when someone attempts to enable it, and audit administrative activity. section 14.8
The compromised SQL Server hop
An attacker compromises one SQL Server instance and uses xp_cmdshell to reach its operating system. Because commands run under the SQL Server service account, the attacker may discover or reuse privileged access to other servers, turning one breach into a wider network compromise. section 14.4
Lateral movement
Use the lateral-movement figure to trace how a vulnerable SQL Server can connect an attacker to the operating system and other servers. section 14.4
Listing 14.5 Creating a trigger to prevent xp_cmdshell execution
EXEC sp_addmessage 50001, 16, 'Attempt to disable xp_cmdshell' ;
GO
CREATE TRIGGER prevent_xp_cmdshell
ON ALL SERVER
FOR ALTER_INSTANCE
AS
BEGIN
DECLARE @Statement NVARCHAR(4000) ;
SET @Statement = (SELECT EVENTDATA().value('(/EVENT_INSTANCE/TSQLCommand/CommandText)[1]',
'nvarchar(4000)')) ;
IF (CHARINDEX('sp_configure', @Statement) > 0)
AND (CHARINDEX('xp_cmdshell', @Statement) > 0)
BEGIN
RAISERROR(50001, 16, 1, 'Attempt to disable xp_cmdshell') WITH LOG ;
ROLLBACK ;
END
END ;
GO
Use the server trigger listing as a concrete control that blocks attempts to re-enable xp_cmdshell and records the event. section 14.4
