sqlmap/procs/mssqlserver/run_statement_as_user.txt

SELECT * FROM OPENROWSET('SQLOLEDB','';'%USER%';'%PASSWORD%','%STATEMENT%');