rapid7/metasploit-framework — pull request #4130 by nullbind (2014-11-04 19:44:35+00:00)
Title: Added mssql_escalate_executeas_sqli.rb

This module can be used via error based SQL injection to escalate privileges if the IMPERSONATION permission has been assigned to the SQL Server login used by the web application. In most cases this results in additional data access, but in some cases it can be used to gain sysadmin privileges.

Lab Guide
https://raw.githubusercontent.com/nullbind/Metasploit-Modules/master/mssql_escalate_executeas_sqli_lab_setup.txt

Screen Shots
![1](https://cloud.githubusercontent.com/assets/1179731/4906651/ca659f22-645a-11e4-9dc3-358919dfd537.PNG)
![2](https://cloud.githubusercontent.com/assets/1179731/4906653/cbc52df6-645a-11e4-8405-dd3fa5f174f0.PNG)