rapid7/metasploit-framework — pull request #616 by nullbind (2012-07-18 04:07:07+00:00)
Title: MSSQL Local Authorization Bypass (POST MODULE)

I have provide information about this module below.

Whats the issue?

LocalSystem is assigned syadmin privileges in SQL Server 2k-2k8 by default to support patching. So LocalSystem = unauthorized data access. Microsoft changed the default in SQL Server 2012 so that LocalSystem no longer has sysadmin privileges. However, this can be overcome by migrating to the SQL Server process. So running in SQL Server service process = unathorized access to data.

What does this module do?

When this module is executed via an existing meterpreter session it can be used to add a sysadmin to local SQL Server instances. It first attempts to gain LocalSystem privileges using the "getsystem" escalation methods. If those privileges are not sufficient to add a sysadmin, then it will migrate to the SQL Server service process associated with the target instance. The sysadmin login is added to the local SQL Server using native SQL clients and stored procedures. If no instance is specified then the first identified instance will be used.

Side Comment:

If I managed to screw up the pull request let me know. I'm not great with git, so sorry ahead of time.