RDP, WinRM, and SQL Admin: Lateral Movement When You're Not Local Admin Anywhere

#What If You Have Credentials But Zero Local Admin Rights?#link

You've sprayed passwords. You've kerberoasted. You have five sets of valid credentials. But BloodHound shows none of these users are local admin on any host. No pass-the-hash. No psexec. No wmiexec. Dead end? Not even close. RDP access, WinRM membership, and SQL sysadmin privileges are three separate lateral movement vectors that don't require local admin.

A user in the Remote Desktop Users group can RDP into a host. A user in Remote Management Users can WinRM into it. A user with sysadmin on SQL Server can execute OS commands via xp_cmdshell. None of these require the Administrators group. And all three are enumerable in BloodHound under the Execution Rights section of any user's Node Info tab.

How do you enumerate these rights without BloodHound?

Domain Users can RDP to this host. Every single authenticated user in the domain. This is common on RDS jump hosts or VDI infrastructure. Get on that box, and you're in a position to hunt for credentials in memory, escalate via local privilege escalation, or pivot to other hosts from a new network position.

Why is SQL sysadmin access almost always SYSTEM access?

Three lateral movement vectors that bypass the local admin requirement. Always check these before declaring a dead end. And always test SQL credentials against every MSSQL instance in the domain. The credentials in that web.config file from three servers ago might just be sysadmin on the production database cluster.