Microsoft SQL Server is a widely used relational database management system (RDBMS). Just like any other software, it can be vulnerable to different attack vectors if not secured properly. Understanding common attack vectors and techniques for privilege escalation can help security professionals and system administrators protect their assets.

Common Attack Vectors for Microsoft SQL Server:

1. SQL Injection: SQL Injection occurs when an attacker sends malicious SQL commands to a database by exploiting vulnerabilities in a web application's user inputs. This can lead to unauthorized data access, modification, or even deletion.
2. Weak or Default Credentials: If an SQL Server uses weak, default, or easily guessable username and password combinations, attackers can easily gain unauthorized access.
3. Misconfigured Access Controls: Insufficient access controls can enable attackers to escalate privileges, tamper with data, or gain unauthorized access to sensitive information within the database.
4. Unsupported or Unpatched Versions: Running outdated or unsupported versions of Microsoft SQL Server exposes a database to known vulnerabilities, which attackers can exploit.
5. Stored Procedure Vulnerabilities: Some stored procedures might increase the attack surface if they don't have proper input validation or user permission checks.

Privilege Escalation and Attack Techniques through Database Connections:

Once a system has been compromised via a database connection (e.g., through SQL injection or unauthorized access to an SQL Server), an attacker will often seek to escalate privileges and further compromise the system. Here are some techniques for privilege escalation and attack in this context:

Database Server Privilege Escalation: An attacker might attempt to escalate their privileges within the database itself. For example, they might try to elevate a database user's permissions to sysadmin privileges using T-SQL commands like:

sql
EXEC sp_addsrvrolemember 'username', 'sysadmin';

Operating System Command Execution: Once an attacker has gained elevated privileges within the database, they might try to execute system commands or scripts through SQL Server's various mechanisms, like using the xp_cmdshell stored procedure:

sql
EXEC xp_cmdshell 'net user hacker password /add';

This command tries to create a new user on the system with the specified credentials.

Enumeration and Data Exfiltration: With elevated privileges and the ability to execute system commands, an attacker can gather sensitive information (such as database connection strings, server configuration files, or user credentials) and exfiltrate the data for further exploitation.

Lateral Movement: An attacker may also use the compromised SQL Server to pivot to other systems on the network, for example, by using stored credentials, linked servers or exploiting trust relationships between databases.

Persistence: The attacker can set up persistence after gaining access, for example, by creating backdoor accounts, configuring triggers or stored procedures that execute malicious actions, or deploying malware on the compromised server.