Uploaded byPositive Hack Days
24may 1600 valday dmitry gutsko 'sap attack methodology'
This document outlines an attack methodology for compromising SAP systems. It begins by scanning open ports to identify available clients and services. Default passwords are checked to gain initial access. Tools like MaxPatrol and sapyto are used to gather additional system information from RFC connections. Direct access to the Oracle database is possible if it uses remote OS authentication. Password hijacking can occur via network protocols like DIAG and RFC. Various password encryption algorithms are detailed along with ways to recover passwords using tools like John the Ripper. The document shows how to bypass clients, access other SAP systems via decrypted RFC connections, and hide evidence of high privileges by modifying reports and tables.
More Related Content
Similar to 24may 1600 valday dmitry gutsko 'sap attack methodology'
24may 1600 valday dmitry gutsko 'sap attack methodology'
- 2. SAP Attack Methodology DmitryGutsko Security expert Positive Technologies PHDays III
- 3.
- 4. SAP: Typical three-tierarchitecture
- 5.
- 7. Where to begin? ―Scan ports • 32xx • 33xx • 36xx ― Gather information about the system • Find available clients • Check for default passwords • Identify a database server ― Tools: • MaxPatrol (PenTest) • sapyto • console bruter by PT
- 8. Clients SAP Application server Client000 Client 001 Client 066 Client 800
- 9. Clients SAP Application server Client000 Client 001 Client 066 Client 800
- 10. Clients SAP Application server Client000 Client 001 Client 066 Client 800
- 11. Default passwords User accountDefault password Statistics SAP* 06071992 PASS 0% 25% DDIC 19920706 0% TMSADM PASSWORD $1Pawd2& 25% 12,5% EARLYWATCH SUPPORT 0% SAPCPIC ADMIN 25%
- 12. Default passwords User accountDefault password Статистика использования SAP* 06071992 PASS 0% 25%(сбер,Газ DDIC 19920706 0% TMSADM PASSWORD $1Pawd2& 25%(Ом,сбер 12,5%(Газ EARLYWATCH SUPPORT 0% SAPCPIC ADMIN 25%(Газ, сбер
- 13.
- 15. Direct access toOracle database ― Remote_OS_Authentication: • User authentication by OS login ― SAPSR3 user password is stored in table OPS$<SID>ADM.SAPUSER ― Password could be recovered
- 16. Direct access toOracle database ― Механизм Remote_OS_Authentication • Аутентификация по имени пользователя в ОС ― Пароль пользователя SAPSR3 хранится в таблице OPS$<SID>ADM.SAPUSER ― Пароль возможно расшифровать
- 18. Password Hijacking via aNetwork ― Protocols: DIAG, RFC, HTTP ― Tools: Wireshark, SAP DIAG plugin for Wireshark, Cain&Abel, SapCap
- 19.
- 20.
- 22. Hacking Passwords ― Algorithms:A, B, D, E, F, G, H, I (CODVN field) ― Tables: USR02, USH02, USRPWDHISTORY ― Tools: John the Ripper ― Profile parameters: login/password_downwards_compatibility, login/password_charset
- 23. Cryptographic algorithms BCODE field PASSCODE field PWDSALTHEDHASH field A 8,upper, ASCII, username salt X B MD5, 8, upper, ASCII, username salt X D MD5, 8, upper, UTF-8, username salt X E MD5, 8 , upper, UTF-8, username salt X F SHA1, 40, UTF-8, username salt X G X X H SHA1,40, UTF-8, random salt X I X X X
- 24. USR02 table BNAME, BCODE,PASSCODE Fields
- 25.
- 27. Client Bypass ― Usetransaction ST04 ― Use transaction SM49/SM69 ― Create your own ABAP program
- 28.
- 29.
- 30.
- 31.
- 32.
- 33. ABAP program ― Sourcecode: ― Report results:
- 35. Access to otherSAPs ― Decrypt authentication data of RFC connection (0-day) • RSECTAB, RFCDES tables
- 36. Access to otherSAPs
- 37. Access to otherSAPs
- 38. Access to otherSAPs
- 39. Access to otherSAPs No data is shown by SE16
- 40. Access to otherSAPs
- 41. Access to otherSAPs
- 42. Access to otherSAPs
- 43. Access to otherSAPs
- 45. Hiding the Evidenceof High Privileges (profile SAP_ALL) ― Report RSUSR002 (transaction SUIM) • Use Reference User • Create a new profile ~ SAP_ALL, Profile1 + Profile2 + Profile3 ~ SAP_ALL • Create user ………… (0 day) • Change ABAP code of report RSUSR002 • Update table UST04
- 46.
- 47.
- 48.
- 49. Create a newprofile
- 50. Create a newprofile
- 51. Create a newprofile SAP_0 = SAP_ALL
- 52. Create a newprofile No user TEST4
- 53. User ………… (0day) ― ABAP code of RSUSR002 report:
- 54. User ………… (0day) ― ABAP code of RSUSR002 report:
- 55. User ………… (0day) ― ABAP code of RSUSR002 report: No user …………
- 56. Modification of RSUSR002ABAP code ― Insert a new string: DELETE userlist WHERE bname = ‘<USERNAME>’
- 57. Deletion of ProfileAssignment from UST04 table Assignig profile SAP_ALL:
- 58. Deletion of ProfileAssignment from UST04 table Assignig profile SAP_ALL:
- 59. Deletion of ProfileAssignment from UST04 table Assignig profile SAP_ALL: No user TEST0
- 60. Deletion of ProfileAssignment from UST04 table Assignig profile SAP_ALL:
- 61. Thank you foryour attention! Dmitry Gutsko dgutsko@ptsecurity.ru