| Feature | Requirement | Capability | Priv Needed | Risk | Notes |
|---|---|---|---|---|---|
| RID Brute | SQL Auth | User enumeration | Low | ✔ | Useful for username discovery |
| AD Enumeration | Any login | Domain/user/group discovery | Low | ✔ | Map environment quickly |
| xp_cmdshell | xp_cmdshell=1 | Direct OS RCE | High | ❌ | Dangerous; check config first |
| Ad Hoc Distributed Queries | AdHoc=1 | File read & pivot | High | ❌ | OPENROWSET/OPENQUERY abuse |
| Ole Automation | Ole=1 | COM-based RCE | High | ❌ | Write files, spawn processes |
| CLR RCE | clr enabled=1 | .NET assembly execution | High | ❌ | Load custom DLLs |
| Cross-DB Ownership | CBOC=1 | Lateral DB access | Medium | ❌ | Move horizontally |
| External Scripts | external scripts=1 | Python/R RCE | High | ❌ | Execute OS commands via runtimes |
| Registry Access | xp_reg* | Read sensitive registry keys | High | ❌ | Fingerprint host, secrets |
| Linked Servers | RPC OUT | Remote SQL execution | High | ❌ | Pivot across SQL servers |
| SQL Agent | Operator role | Job-based RCE | High | ❌ | Run OS commands via Agent |
Enumeration Checklist
- Domain context
- User Context
- Server Context
- Data dumping
- Coercion