Your SlideShare is downloading. ×
Systems Applications Proxy Pwnage
Upcoming SlideShare
Loading in...5
×

Thanks for flagging this SlideShare!

Oops! An error has occurred.

×

Introducing the official SlideShare app

Stunning, full-screen experience for iPhone and Android

Text the download link to your phone

Standard text messaging rates apply

Systems Applications Proxy Pwnage

3,785
views

Published on

Presentation by Ian deVilliers at 44Con in 2011. …

Presentation by Ian deVilliers at 44Con in 2011.

This presentation is about the protocol used by SAP GUI and how it makes SAP applications vulnerable to attack. SApCap and SAPProx , tools developed by the presenter are discussed. SAPProx is a SAP GUI proxy tool. SApCap is a packet sniffer,decompressor and protocol analysis tool for SAP GUI. A few practical SAP app attacks are discussed.

Published in: Technology

0 Comments
1 Like
Statistics
Notes
  • Be the first to comment

No Downloads
Views
Total Views
3,785
On Slideshare
0
From Embeds
0
Number of Embeds
5
Actions
Shares
0
Downloads
33
Comments
0
Likes
1
Embeds 0
No embeds

Report content
Flagged as inappropriate Flag as inappropriate
Flag as inappropriate

Select your reason for flagging this presentation as inappropriate.

Cancel
No notes for slide

Transcript

  • 1. Systems Applications Proxy Pwnage! ian@sensepost.com! [SensePost  –  2011]  
  • 2. about: us! Ian de Villiers! [SensePost  –  2011]  
  • 3. What weʼre going to talk about!•  Why this Talk ?!•  The history of decompressing SAP DIAG!•  Understanding the fundamentals!•  New Attacks!•  Conclusion! [SensePost  –  2011]  
  • 4. Why this Talk ?!•  SAP systems carry business critical data! –  Root is nice, but itʼs all about the data… !•  Any numbers of attacks against SAP systems! –  This talk is not about them…!•  Fundamental security shortcoming in the SAP GUI (DIAG) protocol! –  Unencrypted. By Default! –  Compressed! –  This is old news…! [SensePost  –  2011]  
  • 5. #include <Disclaimer.h>!•  SAP is a behemoth!•  Very little documentation out there! –  service.sap.com require user accounts !•  Documentation for DIAG protocol requires NDA (apparently)… !•  Custom toolsets require development!•  SAP Basis version used is reasonably outdated..! –  Fine for protocol analysis! –  Some attack scenarios may not be applicable! [SensePost  –  2011]  
  • 6. #include <Disclaimer.h>!•  SensePost Assessments! –  Covered a lot of ground…! –  … but virtually impossible to do a complete job on something as complex! –  Research has been on an “as-time-allows” approach between projects!•  Releasing tools and research as-is…! –  Letʼs see some SAP 0-day in the next couple of months… !•  Lack of documentation means analysis is probably not spot-on! [SensePost  –  2011]  
  • 7. #include <Disclaimer.h>!•  Planned to present with SAP on second laptop!•  Some technical issues yesterday! –  Running SAP in a VM! –  Laptop is a dog in terms of speed at the moment! [SensePost  –  2011]  
  • 8. What weʼre going to talk about!•  Why this Talk ?!•  The history of decompressing SAP DIAG!•  Understanding the fundamentals!•  New Attacks!•  Conclusion! [SensePost  –  2011]  
  • 9. The History…!•  Sniffing SAP GUI Passwords! –  Andreas Baus && René Ledosquet from Securon! –  Published 6th July, 2009!•  Dealt with playing back captured packets to SAP GUI!•  Decompressed data obtained from SAP GUI memory with debugger! [SensePost  –  2011]  
  • 10. But wait…
Thereʼs more…! [SensePost  –  2011]  
  • 11. The History…!•  Dennis Yurichev! –  Published 2nd June, 2010!•  Discovered that similar compression method was employed in MaxDB! –  Open Source MaxDB code available!•  Wrote utility for decompressing SAP traffic! –  Required manual reassembly of data segments over multiple packets! [SensePost  –  2011]  
  • 12. The History…!•  Dennisʼ research required:! –  Identification of SAP compressed packets by magic! •  0x1f @ packet.data[17]! •  0x9d @ packet.data[18]! –  Stringing together of subsequent packets without magic at 17 and 18! –  Once complete “message” had been assembled, we could decompress the data! •  (Decompression wonʼt work until we have the complete stream)! [SensePost  –  2011]  
  • 13. SAPDecompress – In Pictures! [SensePost  –  2011]  
  • 14. SAPDecompress – In Pictures! [SensePost  –  2011]  
  • 15. SAPDecompress – In Pictures! 1f  9d  ==  SAP  Compressed  Message  Magic   At  packet.data[17]  and  packet.data[18]   [SensePost  –  2011]  
  • 16. SAPDecompress – In Pictures! [SensePost  –  2011]  
  • 17. SAPDecompress – In Pictures! [SensePost  –  2011]  
  • 18. SAPDecompress – In Pictures! [SensePost  –  2011]  
  • 19. SAPDecompress – In Pictures! [SensePost  –  2011]  
  • 20. SAPDecompress – In Pictures! [SensePost  –  2011]  
  • 21. SAPDecompress – In Pictures!Compressed   SAPDecompress.exe   Decompressed  Message   Message   [SensePost  –  2011]  
  • 22. SAPDecompress – In Pictures!Compressed   SAPDecompress.exe   Decompressed  Message   Message   [SensePost  –  2011]  
  • 23. The History…!•  Dennis Yurichevʼs work is *awesome*…!•  My work is based very much on his discovery…! [SensePost  –  2011]  
  • 24. What weʼre going to talk about!•  Why this Talk ?!•  The history of decompressing SAP DIAG!•  Understanding the fundamentals!•  New Attacks!•  Conclusion! [SensePost  –  2011]  
  • 25. The Fundamentals!•  Understand the compression!•  Understand the compressed protocol! –  Simplify the sniffing and decompression!•  Recompression!•  Understand the application protocol! –  What makes SAP GUI tick ?!•  Identify SAP attack vectors not previously considered…! [SensePost  –  2011]  
  • 26. The Compression Algorithm!•  Variants of Lempel-Ziv! –  LZC! –  LZH! –  SAP Supports both (tried and tested)! [SensePost  –  2011]  
  • 27. The Compression Algorithm!•  Variant of Lempel-Ziv! –  LZC! –  LZH! –  SAP Supports both (tried and tested)! •  Makes one believe that SAP and MaxDB share same compression code-base… ! .Compression   .Decompression   ==   .Compression   .Decompression   [SensePost  –  2011]  
  • 28. The Compression Algorithm!•  Variant of Lempel-Ziv! –  LZC! –  LZH! –  SAP Supports both (tried and tested)! •  Makes one believe that SAP and MaxDB share same compression code-base… !•  Version used per message is determined by the Compression Header…! –  This is described in a minute…! [SensePost  –  2011]  
  • 29. The Fundamentals!•  Understand the compression!•  Understand the compressed protocol! –  Simplify the sniffing and decompression! –  Recompression!•  Understand the application protocol! –  What makes SAP GUI tick ?!•  Identify SAP attack vectors not previously considered…! [SensePost  –  2011]  
  • 30. The Core, Compressed Protocol!•  Easy to parse…! [SensePost  –  2011]  
  • 31. The Core, Compressed Protocol!•  Easy to parse…!•  In the absence of documentation, Iʼve had to make my own names…! [SensePost  –  2011]  
  • 32. The Core, Compressed Protocol!•  Easy to parse…!•  In the absence of documentation, Iʼve had to make my own names…! –  SAP Header! –  Compression Header! –  Compressed Data! [SensePost  –  2011]  
  • 33. The Core, Compressed Protocol! SAP    Header  •  Easy to parse…!•  Consist of:! –  “SAP Header”! –  “Compression Header”! –  Compressed Data! [SensePost  –  2011]  
  • 34. The Core, Compressed Protocol! SAP    Header  •  Easy to parse…! Compression    Header  •  Consist of:! –  “SAP Header”! –  “Compression Header”! –  Compressed Data! [SensePost  –  2011]  
  • 35. The Core, Compressed Protocol! SAP    Header  •  Easy to parse…! Compression    Header  •  Consist of:! Compressed  Data   –  “SAP Header”! –  “Compression Header”! –  Compressed Data! [SensePost  –  2011]  
  • 36. The SAP Header!•  Bytes [0] – [11]! [SensePost  –  2011]  
  • 37. The SAP Header!•  Bytes [0] – [11]! –  Bytes [0] – Bytes [3]! •  Len(Sheader) + Len(Cheader) + Len(Cdata) - 4! [SensePost  –  2011]  
  • 38. The SAP Header!•  Bytes [0] – [11]! –  Bytes [0] – Bytes [3]! •  Len(Sheader) + Len(Cheader) + Len(Cdata) – 4! 316  bytes  –  4  bytes  ==    312  bytes   0x0000138  ==  312   [SensePost  –  2011]  
  • 39. The SAP Header!•  Bytes [0] – [11]! –  Bytes [0] – Bytes [3]! •  Len(Sheader) + Len(Cheader) + Len(Cdata) – 4! 316  bytes  –  4  bytes  ==    312  bytes   0x0000138  ==  312   –  Bytes [4] – Bytes [11]! •  Unknown (Tampering makes *no* difference)! [SensePost  –  2011]  
  • 40. The Compression Header!•  Bytes [12] – [19]! [SensePost  –  2011]  
  • 41. The Compression Header!•  Bytes [12] – [19]! –  Bytes [12] – Bytes [15]! •  Length of decompressed stream! •  Little-Endian! [SensePost  –  2011]  
  • 42. The Compression Header!•  Bytes [12] – [19]! –  Bytes [12] – Bytes [15]! •  Length of decompressed stream! •  Little-Endian! 0x00001af  ==  431   [SensePost  –  2011]  
  • 43. The Compression Header!•  Bytes [12] – [19]! –  Bytes [12] – Bytes [15]! •  Length of decompressed stream! •  Little-Endian! 0x00001af  ==  431   [SensePost  –  2011]  
  • 44. The Compression Header!•  Bytes [12] – [19]! –  Bytes [16]! •  Version of compression (LZH / LZC)! •  LZC == byte & 0x0f = 0x00! •  LZH == byte & 0x0f = 0x02! [SensePost  –  2011]  
  • 45. The Compression Header!•  Bytes [12] – [19]! –  Bytes [16]! •  Version of compression (LZH / LZC)! •  LZC == byte & 0x0f = 0x00! •  MZH == byte & 0x0f = 0x02! [SensePost  –  2011]  
  • 46. The Compression Header!•  Bytes [12] – [19]! –  Bytes [17] – Bytes [18]! •  Compression Magic! •  Always 1f 9d! [SensePost  –  2011]  
  • 47. The Compression Header!•  Bytes [12] – [19]! –  Bytes [19]! •  MaxBits! [SensePost  –  2011]  
  • 48. Compressed Data!•  Bytes [20] – [N]! –  The compressed stream! [SensePost  –  2011]  
  • 49. As an Aside…!•  Bytes [12] – Bytes [15]! –  Length of decompressed stream! –  Little-Endian! 0x00001af  ==  431   –  Field is user-controlled, but programmatic type is SAP_INT! –  Signed integer!•  What if the original length was 0xffffff ?!•  (thanks Behrang Fouladi)! [SensePost  –  2011]  
  • 50. As an Aside…!•  Bytes [12] – Bytes [15]! –  Length of decompressed stream! –  Little-Endian! 0x00001af  ==  431   –  User input is user-controlled, but programmatic type is SAP_INT! –  What if the original length was 0xffffff ?! [SensePost  –  2011]  
  • 51. As an Aside…!•  Bytes [12] – Bytes [15]! –  Length of decompressed stream! –  Little-Endian! 0x00001af  ==  431   –  User input is user-controlled, but programmatic type is SAP_INT! –  What if the original length was 0xffffff ?! [SensePost  –  2011]  
  • 52. As an Aside…!•  Bytes [12] – Bytes [15]! –  Length of decompressed stream! –  Little-Endian! 0x00001af  ==  431   –  User input is user-controlled, but programmatic type is SAP_INT! –  What if the original length was 0xffffff ?! [SensePost  –  2011]  
  • 53. Sniffing SAP Traffic!•  SAP traffic does not lend itself very well to WireShark dissectors…!•  Answer was to write a custom protocol analysis tool in Java!•  Used 3rd Party pCap JNI interface! –  Allows us to use standard pCap filters / dump files!•  Use custom built JNI interface built from MaxDB code! [SensePost  –  2011]  
  • 54. SApCap! [SensePost  –  2011]  
  • 55. SApCap!•  Jpcap! –  JNI interface for pCap! –  Responsible for reading packets! •  pCap dump files! •  Sniffing! –  Filtering packets using standard pCap filters! –  Saving information as pCap dump files! [SensePost  –  2011]  
  • 56. SApCap!•  SApCap! –  Java! –  Responsible for:! •  Parsing packet data! •  Decompressing messages! •  Queue management! [SensePost  –  2011]  
  • 57. SApCap!•  SapCompress! –  JNI interface! –  Implements MaxDB functions for decompression! •  int[] doDecompress(int[])! [SensePost  –  2011]  
  • 58. Demo: SApCap! [SensePost  –  2011]  
  • 59. The Fundamentals!•  Understand the compression!•  Understand the compressed protocol! –  Simplify the sniffing and decompression!•  Recompression!•  Understand the application protocol! –  What makes SAP GUI tick ?!•  Identify SAP attack vectors not previously considered…! [SensePost  –  2011]  
  • 60. Recompression ?!•  Core decompression functions are defined in vpa105CsObjInt.cpp! –  CsDecompr()! [SensePost  –  2011]  
  • 61. Recompression ?!•  But… vpa105CsObjInt.cpp also contains function for what would appear to be compression…! –  CsCompr()! [SensePost  –  2011]  
  • 62. Recompression ?!•  We modify our JNI library to make use of MaxDB code! –  doCompress()! –  doDecompress()! [SensePost  –  2011]  
  • 63. Recompression ?!•  We now have programmatic interface to:! –  Decompress SAP traffic! •  doDecompress()! •  Useful for interception and sniffing! –  Compress SAP traffic! •  doCompress()! •  Useful for MiTM attacks! •  Useful for assessment of SAP Gui Applications! [SensePost  –  2011]  
  • 64. The Fundamentals!•  Understand the compression!•  Understand the compressed protocol! –  Simplify the sniffing and decompression!•  Recompression!•  Understand the application protocol! –  What makes SAP GUI tick ?!•  Identify SAP attack vectors not previously considered…! [SensePost  –  2011]  
  • 65. The Application Protocol!•  Multiplexed! –  Single connection per-user per-location per- host! [SensePost  –  2011]  
  • 66. The Application Protocol!•  Multiplexed! –  Single connection per-user per-location per- host!•  Initial hand-shake is uncompressed! [SensePost  –  2011]  
  • 67. The Application Protocol!•  Multiplexed! –  Single connection per-user per-location per- host!•  Initial hand-shake is uncompressed!•  Server response is compressed! [SensePost  –  2011]  
  • 68. The Application Protocol!•  Multiplexed! –  Single connection per-user per-location per- host!•  Initial hand-shake is uncompressed!•  Server response is compressed!•  Uncompressed component is static! –  Terminal name! –  Options change depending on capabilities of SAP GUI (support bits)! [SensePost  –  2011]  
  • 69. The Application Protocol!•  Multiplexed! –  Single connection per-user per-location per- host!•  Initial hand-shake is uncompressed!•  Server response is compressed!•  Hand shake is static (apart from “terminal name”)! [SensePost  –  2011]  
  • 70. Message Types!•  Two basic Types of Messages! –  Simple Messages! –  Complex Messages!•  Message structures differ in terms of direction! –  GUI -> Server! –  Server -> GUI! [SensePost  –  2011]  
  • 71. Simple Messages : GUI -> SAP!•  Header! –  “OK Code”! –  Character Encoding! –  GUI Version!•  Data! –  Input values! –  XML Stream defining screen metrics! [SensePost  –  2011]  
  • 72. Simple Messages : GUI -> SAP!•  Header! –  “OK Code”! –  Character Encoding! –  GUI Version!•  Data! –  Input values! –  XML Stream defining screen metrics! [SensePost  –  2011]  
  • 73. Simple Messages : SAP -> GUI!•  Header!•  Data!•  “TH”! [SensePost  –  2011]  
  • 74. Simple Messages : SAP -> GUI!•  Header! –  Encoding! [SensePost  –  2011]  
  • 75. Simple Messages : SAP -> GUI!•  Header! –  Encoding! –  Transaction ID! [SensePost  –  2011]  
  • 76. Simple Messages : SAP -> GUI!•  Header! –  Encoding! –  Transaction ID! –  System & Hostname! [SensePost  –  2011]  
  • 77. Simple Messages : SAP -> GUI!•  Header! –  Encoding! –  Transaction ID! –  System Name! –  Host name! –  Theme! [SensePost  –  2011]  
  • 78. Simple Messages : SAP -> GUI!•  Data! –  SAP Program Context & SAP Screen! [SensePost  –  2011]  
  • 79. Simple Messages : SAP -> GUI!•  Data! –  SAP Program Context & SAP Screen! –  Menus & Keyboard Accelerators! [SensePost  –  2011]  
  • 80. Simple Messages : SAP -> GUI!•  Data! –  SAP Program Context & SAP Screen! –  Menus & Keyboard Accelerators! –  Input dialogs! [SensePost  –  2011]  
  • 81. Simple Messages : SAP -> GUI!•  Data! –  SAP Program Context & SAP Screen! –  Menus & Keyboard Accelerators! –  Input dialogs! –  Screen Data! [SensePost  –  2011]  
  • 82. Simple Messages : SAP -> GUI!•  “TH”! –  System Name! –  Transaction! –  Transaction ID! [SensePost  –  2011]  
  • 83. Dialogs!•  All input fields accept strings! –  No client-side validation! –  Data is validated on the server!•  Input field lengths can be manipulated! [SensePost  –  2011]  
  • 84. Dialogs!•  All input fields accept strings! –  No client-side validation! –  Data is validated on the server!•  Input field lengths can be manipulated! [SensePost  –  2011]  
  • 85. Dialogs!•  All input fields accept strings! –  No client-side validation! –  Data is validated on the server!•  Input field lengths can be manipulated! [SensePost  –  2011]  
  • 86. Dialogs!•  All input fields accept strings! –  No client-side validation! –  Data is validated on the server!•  Input field lengths can be manipulated! [SensePost  –  2011]  
  • 87. Dialogs!•  All input fields accept strings! –  No client-side validation! –  Data is validated on the server!•  Input field lengths can be manipulated! [SensePost  –  2011]  
  • 88. Dialogs!•  Length of submitted strings can be adjusted in a similar fashion…! [SensePost  –  2011]  
  • 89. Dialogs!•  Length of submitted strings can be adjusted in a similar fashion…! [SensePost  –  2011]  
  • 90. Complex Messages!•  Contain the same structures as simple messages…! [SensePost  –  2011]  
  • 91. Complex Messages!•  Contain the same structures as simple messages…!•  … But include XML structure:! –  <SVARS>! [SensePost  –  2011]  
  • 92. Complex Messages!•  Contain the same structures as simple messages…!•  … But include XML structure:! –  <SVARS>! [SensePost  –  2011]  
  • 93. Complex Messages!•  Contain the same structures as simple messages…!•  … But include XML structure:! –  <SVARS>!•  Include compressed streams:! –  PARAMS! [SensePost  –  2011]  
  • 94. Complex Messages!•  Contain the same structures as simple messages…!•  … But include XML structure:! –  <SVARS>!•  Include compressed streams:! –  PARAMS! [SensePost  –  2011]  
  • 95. Complex Messages!•  Contain the same structures as simple messages…!•  … But include XML structure:! –  <SVARS>!•  Include compressed streams:! –  PARAMS! –  RFC_QUEUE! [SensePost  –  2011]  
  • 96. Complex Messages!•  Contain the same structures as simple messages…!•  … But include XML structure:! –  <SVARS>!•  Include compressed streams:! –  PARAMS! –  RFC_QUEUE! [SensePost  –  2011]  
  • 97. Complex Messages!•  Contain the same structures as simple messages…!•  … But include XML structure:! –  <SVARS>!•  Include compressed streams:! –  PARAMS! –  RFC_QUEUE! –  VERBS! [SensePost  –  2011]  
  • 98. Complex Messages!•  Contain the same structures as simple messages…!•  … But include XML structure:! –  <SVARS>!•  Include compressed streams:! –  PARAMS! –  RFC_QUEUE! –  VERBS! [SensePost  –  2011]  
  • 99. Complex Messages!•  Contain the same structures as simple messages…!•  … But include XML structure:! –  <SVARS>!•  Include compressed streams:! –  PARAMS! –  RFC_QUEUE! –  VERBS! –  VARS! [SensePost  –  2011]  
  • 100. Complex Messages!•  Contain the same structures as simple messages…!•  … But include XML structure:! –  <SVARS>!•  Include compressed streams:! –  PARAMS! –  RFC_QUEUE! –  VERBS! –  VARS! [SensePost  –  2011]  
  • 101. PARAMS, VARS and VERBS!•  Work in conjunction!•  Define actions to be performed on / by objects on the GUI / Server!•  Lists of “indexed data” are decompressed and parsed by ABAP to various fixed- length data structures! [SensePost  –  2011]  
  • 102. PARAMS, VARS and VERBS!•  Decompressed, they look as follows:! –  PARAMS:! [SensePost  –  2011]  
  • 103. PARAMS, VARS and VERBS!•  Decompressed, they look as follows:! –  PARAMS:! –  VERBS:! [SensePost  –  2011]  
  • 104. PARAMS, VARS and VERBS!•  Decompressed, they look as follows:! –  PARAMS:! –  VERBS:! –  VARS:! [SensePost  –  2011]  
  • 105. PARAMS, VARS and VERBS!•  Parsed by ABAP into structured variables!•  CASE ABAP PARAM-TYP.! –  WHEN ʻSʼ:! •  Set Value Of! –  WHEN ʻGʼ:! •  Get Value Of! –  WHEN ʻCʼ:! •  Call Method Of!•  Thoughts of eval() spring to mind…! [SensePost  –  2011]  
  • 106. PARAMS, VARS and VERBS!•  Graphic example:! [SensePost  –  2011]  
  • 107. PARAMS, VARS and VERBS!•  Graphic example:! [SensePost  –  2011]  
  • 108. PARAMS, VARS and VERBS!•  Graphic example:! [SensePost  –  2011]  
  • 109. PARAMS, VARS and VERBS!•  Graphic example:! [SensePost  –  2011]  
  • 110. PARAMS, VARS and VERBS!•  Details on these structures can be found in ABAP code…!•  Refer to ABAP Structures && where used:! –  OLE_PA! –  OLE_VERBS! –  SWCBCONT! [SensePost  –  2011]  
  • 111. RFC_QUEUE!•  Contains META and internal table data in use by the current application / screen!•  Only ever seems to appear in SAP responses! –  This assumption may be incorrect! [SensePost  –  2011]  
  • 112. RFC_QUEUE!•  Contains META and internal table data in use by the current application / screen!•  Only ever seems to appear in SAP responses! –  This assumption may be incorrect! [SensePost  –  2011]  
  • 113. The Fundamentals!•  Understand the compression!•  Understand the compressed protocol! –  Simplify the sniffing and decompression!•  Recompression!•  Understand the application protocol! –  What makes SAP Gui tick ?!•  Identify SAP attack vectors not previously considered…! [SensePost  –  2011]  
  • 114. SAPProx! [SensePost  –  2011]  
  • 115. SAPProx!•  SapCompress! –  JNI interface! –  Implements MaxDB functions for decompression && compression! •  int[] doDecompress(int[])! •  Int[] doCompress(int[])! [SensePost  –  2011]  
  • 116. SAPProx!•  SAPProx! –  Java! –  Responsible for:! •  Parsing packet data! •  Decompressing messages! •  Interception! •  Compressing modified messages! •  Queue management! [SensePost  –  2011]  
  • 117. Demo: SAPProx! [SensePost  –  2011]  
  • 118. Attack API!•  Users can write their own exploits!•  In a scripting language of their choice…! –  Jython! –  Groovy! –  Jruby! –  *!•  Script locations specified in configuration!•  Allow for canned exploits!•  (thanks Willem Mouton)! [SensePost  –  2011]  
  • 119. Demo: Attacks / Scripting! [SensePost  –  2011]  
  • 120. What weʼre going to talk about!•  Why this Talk ?!•  The history of decompressing SAP DIAG!•  Understanding the fundamentals!•  New Attacks!•  Conclusion! [SensePost  –  2011]  
  • 121. New (Old) Attacks ?!•  We now have a proxy for SAP GUI! –  WebScarab for SAP!•  For what I believe is the first time, we get an unprecedented view into SAP GUI applications…!•  … and we know where that left us with web applications …! [SensePost  –  2011]  
  • 122. New (Old) Attacks ?!•  Authorisation!•  Authentication! [SensePost  –  2011]  
  • 123. Demo: Auth*! [SensePost  –  2011]  
  • 124. New (Old) Attacks ?!•  Authorisation!•  Authentication!•  State Management!•  Business Logic! [SensePost  –  2011]  
  • 125. Demo: State & Business Logic! [SensePost  –  2011]  
  • 126. New (Old) Attacks ?!•  Authorisation!•  Authentication!•  State Management!•  Business Logic!•  Validation! [SensePost  –  2011]  
  • 127. Demo: Validation! [SensePost  –  2011]  
  • 128. New (Old) Attacks ?!•  Authorisation!•  Authentication!•  State Management!•  Business Logic!•  Validation!•  Replay! [SensePost  –  2011]  
  • 129. Demo: Replay! [SensePost  –  2011]  
  • 130. New (Old) Attacks ?!•  Authorisation!•  Authentication!•  State Management!•  Business Logic!•  Validation!•  Replay!•  Client-Side attacks! [SensePost  –  2011]  
  • 131. Client-Side Attacks!•  Many business cases require the execution of applications on the client.! –  Provided for by ABAP!•  Deprecated: GUI_RUN or WS_EXECUTE!•  Current: cl_gui_frontend_services!•  Newer clients still support old methods! –  Backwards compatibility! –  Do prompt when applications execute!•  (thanks Steve Lord)! [SensePost  –  2011]  
  • 132. Client-Side Attacks!•  WS_EXECUTE / GUI_RUN! [SensePost  –  2011]  
  • 133. Client-Side Attacks!•  WS_EXECUTE / GUI_RUN! [SensePost  –  2011]  
  • 134. Demo: Client-Side Attacks! [SensePost  –  2011]  
  • 135. Client-Side Attacks!•  cl_gui_frontend_services! –  Makes use of OLE! [SensePost  –  2011]  
  • 136. Client-Side Attacks!•  cl_gui_frontend_services! –  Makes use of OLE! [SensePost  –  2011]  
  • 137. Client-Side Attacks!•  SAP GUI provides number of COM libraries with potentially exploitable functions! –  Saved by the fact that the controls are not marked “Safe for Scripting”! [SensePost  –  2011]  
  • 138. Client-Side Attacks!•  SAP GUI provides number of COM libraries with potentially exploitable functions! –  Saved by the fact that the controls are not marked “Safe for Scripting”! [SensePost  –  2011]  
  • 139. Client-Side Attacks!•  SAP GUI provides number of COM libraries with potentially exploitable functions! –  Saved by the fact that the controls are not marked “Safe for Scripting”!•  With SAPProxy we can potentially instantiate diverse COM objects! [SensePost  –  2011]  
  • 140. New (Old) Attacks ?!•  Authorisation!•  Authentication!•  State Management!•  Business Logic!•  Validation!•  Replay!•  Client-Side attacks!•  DoS! [SensePost  –  2011]  
  • 141. Demo: DoS! [SensePost  –  2011]  
  • 142. New (Old) Attacks ?!•  Authorisation!•  Authentication!•  State Management!•  Business Logic!•  Validation!•  Replay!•  Client-Side attacks!•  DoS!•  *! [SensePost  –  2011]  
  • 143. What weʼre going to talk about!•  Why this Talk ?!•  The history of decompressing SAP DIAG!•  Understanding the fundamentals!•  New Attacks!•  Conclusion! [SensePost  –  2011]  
  • 144. Conclusion!•  A couple of factors have been common security knowledge for years…! –  Plain-text communication == #fail! –  Security by obscurity == #fail!•  We now have a toolset and programmatic interface into SAP DIAG protocol! –  Game Changer! –  Change the way we look at ABAP! –  Happy Haxoring! [SensePost  –  2011]  
  • 145. Conclusion!•  SAP provides encryption for client components in the form of Secure Network Communications! –  Provided by 3rd Parties! –  Provided by SAP!•  SAP Clients should ensure the use of SNC is enabled and enforced! [SensePost  –  2011]  
  • 146. Questions ?!•  www.sensepost.com/blog! ian@sensepost.com! [SensePost  –  2011]