Use SQL Server rights, impersonation and command facilities

Shell commands

Copy# Baseline
impacket-mssqlclient 'USER@TARGET'
impacket-mssqlclient 'DOMAIN/USER@TARGET' -windows-auth

At the SQL prompt

Copy-- At the SQL prompt
SELECT @@VERSION;
SELECT SYSTEM_USER;
SELECT IS_SRVROLEMEMBER('sysadmin');
SELECT name FROM sys.databases;
USE DATABASE;
SELECT TABLE_SCHEMA, TABLE_NAME FROM INFORMATION_SCHEMA.TABLES;
SELECT TOP 20 * FROM SCHEMA.TABLE;

-- MSSQL variant — command-execution boundary
EXEC xp_cmdshell 'whoami';

-- MSSQL linked-server and login-context mapping
SELECT SYSTEM_USER AS current_login,
       ORIGINAL_LOGIN() AS original_login,
       SUSER_SNAME() AS effective_login,
       IS_SRVROLEMEMBER('sysadmin') AS is_sysadmin;

SELECT name, product, provider, data_source, is_linked
FROM sys.servers
WHERE is_linked = 1;

EXEC master.dbo.sp_helplinkedsrvlogin;

-- MSSQL linked-server and login-context mapping
EXEC ('SELECT SYSTEM_USER AS remote_login,
              ORIGINAL_LOGIN() AS remote_original_login,
              IS_SRVROLEMEMBER(''sysadmin'') AS remote_is_sysadmin')
AT [LINKED_SERVER];

xp_cmdshell is disabled by default on new installations. Enabling it generally requires high privilege and changes server configuration; do not enable it merely to enumerate. When available, a sysadmin's child process normally runs as the SQL Server service account; an authorized non-sysadmin may use a configured proxy. Verify returned identity before choosing the next action.

MSSQL linked-server and login-context mapping

If RPC execution is disabled but data access is allowed, use a read-only pass-through query instead:

Copy-- MSSQL linked-server and login-context mapping
SELECT *
FROM OPENQUERY([LINKED_SERVER],
  'SELECT SYSTEM_USER AS remote_login,
          ORIGINAL_LOGIN() AS remote_original_login');

MSSQL linked-server and login-context mapping

Decide: a returned remote identity enables only the operations granted to that mapped login. RPC OUT is disabled, login-mapping failures and data-access failures rule out different mechanisms; they do not prove the server is unreachable. If enum_impersonate identifies a specific permitted login, test only that login and always return to the original context:

Copy-- MSSQL linked-server and login-context mapping
EXECUTE AS LOGIN = 'LOGIN';
SELECT SYSTEM_USER, ORIGINAL_LOGIN(), SUSER_SNAME(), IS_SRVROLEMEMBER('sysadmin');
REVERT;

Do not enable RPC, create mappings or change server configuration merely to enumerate. A remote SQL query is not OS execution; independently validate any file or command facility and the operating-system identity behind it.