# Lateral Movement

> Move laterally via MSSQL linked servers using OPENQUERY and AT

- **URL:** https://hackindex.io/services/mssql/lateral-movement
- **Service:** [MSSQL](https://hackindex.io/services/mssql.md)
- **Tags:** pivoting, movement, network
- **Published:** 2026-03-26
- **Updated:** 2026-03-29

MSSQL linked servers create trust paths between database instances that attackers can pivot through. Crawling linked server chains with OPENQUERY lets you execute queries on remote instances using the configured link credentials, often with elevated privileges.

Captured MSSQL credentials frequently work on other services in the environment. NTLM relay through MSSQL uses xp_dirtree or xp_fileexist to coerce authentication to an attacker-controlled SMB server, feeding hashes into relay attacks against AD infrastructure.

## Guides

- [Lateral Movement via MSSQL Linked Servers](https://hackindex.io/services/mssql/lateral-movement/lateral-movement-via-mssql-linked-servers.md): Exploiting MSSQL linked server trust relationships to pivot across database instances and execute commands on remote SQL servers.