MSSQL:

Lateral Movement

Move laterally via MSSQL linked servers using OPENQUERY and AT

1 guide • Created Dec 28, 2025 • Updated Mar 29, 2026

1 guide

Lateral Movement via MSSQL Linked Servers

Exploiting MSSQL linked server trust relationships to pivot across database instances and execute commands on remote SQL servers.

Mar 26, 2026 • 4 min read

MSSQL linked servers create trust paths between database instances that attackers can pivot through. Crawling linked server chains with OPENQUERY lets you execute queries on remote instances using the configured link credentials, often with elevated privileges.

Captured MSSQL credentials frequently work on other services in the environment. NTLM relay through MSSQL uses xp_dirtree or xp_fileexist to coerce authentication to an attacker-controlled SMB server, feeding hashes into relay attacks against AD infrastructure.