NetExec MSSQL Linked Servers

Enumerate MSSQL linked servers for lateral movement opportunities

Curated and verified by Ahmad Alawneh, penetration tester (OSCP+, CRTE) · Last updated April 10, 2026

Tool: nxc
Category: Lateral Movement / MSSQL
Platform: linux
Requires: password
Protocols: MSSQL

Open in Command Manager

Syntax

Angle-bracket tokens are placeholders — replace them with your target's values, or open this command in the app to fill them in and copy the result.

nxc mssql '<ip>' -u '<user>' -p '<password>' -M enum_links

Credential variants

The same attack using a different authentication material.

NTLM Hash requires NTLM hash

nxc mssql '<ip>' -u '<user>' -H '<hash>' -M enum_links

Examples

nxc mssql '192.168.1.56' -u 'user' -p 'password' -M enum_links

Tags

nxc mssql linked-server enumeration lateral-movement

Impacket MSSQLClient Interactive MSSQL shell for command execution and database access
MSSQLPwner Linked Server Abuse Enumerate and abuse MSSQL linked servers for lateral movement
NetExec MSSQL Command Exec Execute OS commands through MSSQL — auto-enables xp_cmdshell if disabled and the account…
NetExec MSSQL Enable CmdShell Enable xp_cmdshell on a MSSQL server for OS command execution
NetExec MSSQL Privilege Check Enumerate and escalate MSSQL server privileges (sysadmin, impersonation, linked servers)
NetExec MSSQL xp_cmdshell Execute OS commands via MSSQL xp_cmdshell using NetExec