← Back to Academy

Academy Node

MSSQL Linked Servers

MSSQL linked servers allow one SQL server to query or execute against another configured SQL server.

Intermediate100 XPMSSQL

Why it matters

Linked servers can expose credential hops, xp_cmdshell, or privilege boundaries.

How to identify it

  • Port 1433 open.
  • Valid SQL creds.
  • Query sys.servers.
  • Check impersonation and xp_cmdshell.

BloodHound indicators

  • SQLAdmin edge
  • Sessions on SQL server

NetExec commands

nxc mssql 192.168.184.150 -d xutslabs.local -u svc_sql -p 'Password123'

Impacket commands

impacket-mssqlclient xutslabs.local/svc_sql:'Password123'@192.168.184.150 -windows-auth

Linux commands

nmap -p1433 --script ms-sql-info 192.168.184.150

Expected output

  • SQL prompt.
  • Linked server rows from sys.servers.

Success looks like

  • You discover a link and execute queries through it.

Failure looks like

  • Login failed.
  • No linked servers.
  • RPC out disabled.
  • xp_cmdshell disabled.

Troubleshooting

  • Try local SQL auth and Windows auth.
  • Check domain format.
  • Run SELECT SYSTEM_USER; SELECT IS_SRVROLEMEMBER('sysadmin');

Common mistakes

  • Not trying impacket-mssqlclient.
  • Only checking SMB with creds.
  • Not checking linked servers.

Alternative attacks

  • Kerberoast svc_sql.
  • Password reuse.
  • WinRM if local admin.

What to try next

  • Check sysadmin.
  • Check xp_cmdshell.
  • Check linked servers.
  • Harvest SQL creds.

Recommended next lessons

ASREP Roast

ASREP roasting abuses AD users with Kerberos pre-authentication disabled. You can request encrypted ASREP material and attempt to crack it offline.

Kerberoast

Kerberoasting targets domain users with SPNs. You request service tickets and crack them offline.

GenericWrite

GenericWrite means you can modify certain attributes on the target AD object.

GenericAll

GenericAll is effectively full control over the target AD object.