Command Manager

NetExec MSSQL enum_impersonate

List every login the current user can EXECUTE AS (IMPERSONATE permission). The classic privesc primitive on MSSQL — find a sysadmin you can impersonate, then run mssql_priv to land on xp_cmdshell.

Curated and verified by Ahmad Alawneh, penetration tester (OSCP+, CRTE) · Last updated

Tool
nxc
Category
Enumeration / MSSQL
Platform
linux
Requires
password
Protocols
MSSQL

Open in Command Manager

Syntax

Angle-bracket tokens are placeholders — replace them with your target's values, or open this command in the app to fill them in and copy the result.

nxc mssql <target> -u '<user>' -p '<password>' -M enum_impersonate

Examples

nxc mssql 10.10.10.10 -u lowpriv -p 'Password123!' --local-auth -M enum_impersonate

Tags

netexec nxc mssql impersonate privesc