Linked SQL Servers
So far, we have exclusively dealt with the SQL server on dc01.
As we discovered during enumeration,
there is also a SQL server instance on appsrv01.
SQL servers can be linked together
such that a query executed on one SQL server
fetches data or performs an action on a different SQL server.2
In the next sections, we are going to dig into
how this type of link can be leveraged
to perform both privilege escalation
and obtain code execution on additional SQL servers.