@@ -15,13 +15,12 @@ def initialize(info = {})
15
15
super ( update_info ( info ,
16
16
'Name' => 'Microsoft SQL Server - SQLi Escalate Execute As' ,
17
17
'Description' => %q{
18
- This module can be used escalate privileges if the IMPERSONATION privilege has been assigned to the user
19
- via error based SQL injection. In most cases this results in additional data access, but in some cases it can be used to gain sysadmin
20
- privileges.
21
-
18
+ This module can be used escalate privileges if the IMPERSONATION privilege has been
19
+ assigned to the user via error based SQL injection. In most cases this results in
20
+ additional data access, but in some cases it can be used to gain sysadmin privileges.
22
21
The syntax for injection URLs is: /testing.asp?id=1+and+1=[SQLi];--
23
22
} ,
24
- 'Author' => [ 'nullbind <scott.sutherland[at]netspi.com>' ] ,
23
+ 'Author' => [ 'nullbind <scott.sutherland[at]netspi.com>' ] ,
25
24
'License' => MSF_LICENSE ,
26
25
'References' => [ [ 'URL' , 'http://msdn.microsoft.com/en-us/library/ms178640.aspx' ] ]
27
26
) )
@@ -56,7 +55,7 @@ def run
56
55
print_status ( "#{ peer } - Enumerating a list of users that can be impersonated..." )
57
56
imp_user_list = check_imp_users
58
57
if imp_user_list . nil? || imp_user_list . length == 0
59
- print_error ( ' #{peer} - Sorry, the current user doesnt have permissions to impersonate anyone.' )
58
+ print_error ( " #{ peer } - Sorry, the current user doesnt have permissions to impersonate anyone." )
60
59
return
61
60
else
62
61
# Display list of users that can be impersonated
0 commit comments