fix mssql_priv

[sepauli]

Fixing the Issue #273

The privileged user for the impersonation cannot be found, because there is an issue in the "is_admin_user" function.
Due to the try except statement the admin privileges are always wrong, because the if statement cannot be executed

TypeError: int() argument must be a string, a bytes-like object or a real number, not 'list'

I could sucessfully test my changes on the HTB Academy module “Using CrackMapExec” in the task “MSSQL Enumeration and Attacks”

└─$ docker run --privileged --network host netexec-fixed mssql 10.129.204.177 -u robert -p Inlanefreight01! -M mssql_priv -o ACTION=privesc
...
MSSQL       10.129.204.177  1433   DC01             [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:inlanefreight.htb)
MSSQL       10.129.204.177  1433   DC01             [+] inlanefreight.htb\robert:Inlanefreight01!
MSSQL_PRIV                                          [+] INLANEFREIGHT\robert can impersonate: julio (sysadmin)
MSSQL_PRIV                                          [+] INLANEFREIGHT\robert is now a sysadmin! (Pwn3d!)

└─$ docker run --privileged --network host netexec-fixed mssql 10.129.204.177 -u robert -p Inlanefreight01! -x whoami
...
MSSQL       10.129.204.177  1433   DC01             [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:inlanefreight.htb)
MSSQL       10.129.204.177  1433   DC01             [+] inlanefreight.htb\robert:Inlanefreight01! (Pwn3d!)
MSSQL       10.129.204.177  1433   DC01             [+] Executed command via mssqlexec
MSSQL       10.129.204.177  1433   DC01             inlanefreight\svc_mssql

[NeffIsBack]

Very nice! Thanks for the fix

[Marshall-Hallenbeck]

Sorry I can't test right now (can in 2 days), but I think if the function that saves to res fails it's None, that's why they int'd it before, so if we just reference it it'll KeyError or whatever. I'll have to test it but if someone else can that'd be cool.

[NeffIsBack]

Lol also no one (including me) noticed that the logger in the module is completely broken

[NeffIsBack]

@Marshall-Hallenbeck Looks like thats just an object with "1" or "0" depending on the user being sysadmin or not

[NeffIsBack]

fyi, fixed the logger

[NeffIsBack]

LGTM

[NeffIsBack]

Also fixed the context bug for some other modules like adcs: