[PEN-TEST] SQL Server blank account

[Seth Georgion <sgeorgion () E-CLOSER COM>]

Okay, so here is a question that we've encountered, internally, that seems
to have been made more relevant by the recent Napster related defacements.
Specifically, how is it that a hacker can subvert a system, i.e. deface web
pages, change user accounts, on a system with a SQL installation and a known
username and password. For example let's say you have a Windows machine with
an IIS install and a SQL install, given an attacker with a valid,
administrator SQL username and password how would they be able to take
control of the server?