xct's blogpost explains why it works: "When a Kerberos-authenticated client connects, SQL Server delegates to the Windows security subsystem to create a logon session. The resulting token reflects the PAC groups verbatim. "
vuln.dev/silver-ticke...
vuln.dev
MSSQL Silver Tickets and Token Privileges
I ran into an interesting situation while reviewing Signed on HackTheBox: We get MSSQL access through a silver ticket, which leads to admin privileges on the MSSQL service - but the service account ha...