To your last question:
Alternatively, what else can I get the system to show?
Generally, it depends on how SQL server is configured and whether there are some mitigations present. But attacker may have will not only just to show user passwords, alternatively, he can try to:
- read from and write to various files;
- write to database and read from it;
- make DoS and other harmful actions;
Each operation depends on several factors, like, how I said - the presence of mitigation factors, file permissions, system configuration, etc.
By the way, for attacker there is no need to show the result of SQL request. In the case when attacker cannot view the response, it makes the process of information extraction slower and harder, but not impossible.
If you are interested in, I would suggest you to read the blog of Bernardo Damele - the creator of sqlmap: http://bernardodamele.blogspot.com/. There are interesting presentations and reading on what can be done and how.