PeopleSoft: HACK THE Planet^W university

PeopleSoft: HACK THE
Planet^W universityby Dmitry Iudin, Security Researcher at ERPScan

Security Researcher
Dmitry Yudin
@ret5et

PeopleSoft
Used by:
Universities
Government and its institutions
Large enterprises, etc.

PeopleSoft
Campus solutions
Human Capital Management
Financial Management
Supplier Relationship Management …

Attack Targets
 Personal information
 SSN
 Salary data
 Payment information
 Credit card data
 Bank account data
Bidding information
- RFP
- Prices

Attack Targets
 Espionage
 Theft of financial information
 Corporate trade secret theft
 Theft of supplier and customer lists
 Stealing HR data (employee data theft)
 Sabotage
 Denial of service
 Tampering with financial reports
Fraud
- False transactions
- Modification of master data

PeopleSoft Pure Internet Architecture

Web Server
• Host PeopleSoft Servlets
• Communicates with AppServer
• Front end

Configuration and Deployment
Options
AppServer and database on same server

Configuration and Deployment
Options

PeopleSoft Pure Internet Architecture
 These 3 main components are common for all PeopleSoft
applications.
 All applications mainly differ only in business logic that exists in
a database.
 Pwning these components is equal to Pwning all application
types.

Attack from Internet hardcore
scenario
1. Get RCE on Peoplesoft WebServer
Recon Application Server in internal network
1. Get RCE on Application Server
On AppSvr side decrypt low level DB credentials.
1. Gain low level access to a database.
Get and decrypt high-level DB credentials from the db.
AccessID - «this account is the key to the kingdom»
1. Profit

Find PeopleSoft CS systems in WWW

Or other PeopleSoft Systems ...

Default PeopleSoft Servlets on
WebServer
 PORTAL.war - PeopleSoft Interaction Hub
 PSEMHUB.war - Environment Management Framework
 PSIGW.war - Integration gateway
 PSINTERLINKS.war - Business Interlinks
 PSPC.war - PeopleSoft PortletContainer Servlet.

Most Critical Known Bugs
 CVE-2017-10061 - RCE (CVSS v3 score – 8.3)
 CVE-2017-10366 – RCE (CVSS v3 score – 9.8)
 Any SSRF + lack authentication from localhost in PeopleSoft Apache
Axis component equal
RCE
 SSRF bugs: CVE-2013-3800, CVE-2013-3821, CVE-2017-3548,CVE-
2017-3547 ...

RCE on PeopleSoft
WebServer is
not a PROBLEM

PSIGW.war
 CVE-2017-10061
 CVSS Severity (version 3.0): 8.3 High
 CVSS Version 3 Metrics:
 Attack Vector (AV): Network
 Attack Complexity (AC): Low

Find AppSvr in internal network
$ pwd
/home/psadm2/apps/PORTAL.war
$ cat WEB-INF/psftdocs/ps/webprof/config_prop | grep -i
appserver -A 1
<string>appServer</string>
<string>192.168.56.101:9033</string>

 CVE-2017-10146 - Directory Traversal
 Attack Vector (AV):
 Network
 Attack Complexity (AC):
 Low
 Privileges Required (PR):
 None

Remote attack: hardcore scenario
Recon Application Server in internal network
On AppSvr side decrypt low level DB credentials
Get and decrypt «AccessID» from db.
1. Profit

PeopleSoft AppServer
An application server consists of numerous PeopleSoft services and
server processes.

PeopleSoft AppServer processes
 PSAPPSRV
 PSQCKSRV
 PSQRYSRV
 PSSAMSRV
 PSOPTENG
 PSMSGDSP
 PSMSGHND
 PSPUBDSP
 PSPUBHND
 PSSUBDSP
 PSSUBHND
 WSL
 WSH
 JSL
 JSH
 RMI Services
 etc.

 Many processes = large attack surface
 But … most of them are binary, native code applications.

 After some research, we have found some interesting bugs. Now we
are trying to write exploits for them.
 But we don’t have RCE on AppServer yet.

 After some research, we have found some interesting bugs and now
we are trying to write exploits for them.
 But we don’t have RCE on AppServer yet.

Remote attack hardcore scenario
Recon Application Server in the internal network
On the AppSvr side decrypt low level DB credentials
Get and decrypt «AccessID» from the db.
1. Profit

AppServer RMI service
We have PeopleSoft RMI service with hardcoded credentials...

Java Remote Method Invocation (Java RMI) is a Java API that performs
remote method invocation, the object-oriented equivalent of remote
procedure calls (the RPC), with the support for direct transfer of
serialized Java classes and distributed garbage-collection.

By using this service, we can get:
• AppSvr runtime info
• AppSvr Network statistic
• Java Memory pool info
• CPU Load info
• FileStore Information
• ...
• Access to AppServer logs

In some cases, access to AppServer logs can lead to a leakage of an
authentication token. For example, if debug logging is enabled on the
server side.

 RCE on PeopleSoft WebServer side
 We can read TOKEN from AppServer log:
 If debug mode is on
 It seems that debug mode is not common for PeopleSoft
production servers
 If we are lucky enough, we can get access to some account tokens.
What we have?

What we have?
Recon Application Server in the internal network
On the AppSvr side decrypt low level DB credentials
We got partial “access” to Application Server
1. Gain low-level access to a database.
Get and decrypt «AccessID» from db.

But we can exploit another
bug...

PeopleSoft Application Server
buffer over-read
We can disclose user passwords in plain text, remotely.

PeopleSoft Application Server
buffer over-read

Attack Scenario
 Get access to PeopleSoft web server
 Recon AppServer
 Passively dump credentials from AppServer
 Collect user names and passwords.
 Find accounts with high business roles in the system
 …
 Profit

What if we had RCE on the AppServer
The main target of those pentesting AppServer is psappsvr.cfg
But values in psappsvr.cfg are «encrypted».

psappsrv.cfg
 UserPswd=sC33X45qyMXPEbKTYHrJ06Fd31PfKYBdSEgL5e0i1vE=
 ConnectPswd=gizrWPhLwsI5KYakWwvJDLtoEGNNNG4lFfq8W5x/NpM=
 DomainConnectionPwd=iSTwU6g03N1UlzIng6I+fsXdd6L02b3iQrAW5Ah ...

psappsrv.cfg „decryption“
$ ubbgen -decr iSTwU6g03N1UlzIng6I+fsXdd6L02b3iQrAW5AhSeOo=
jahce6queiXeevoo1quo0nano #decrtypted password

ubbgen utility
UBBGEN’s usage prompt doesn’t show “-decr” and “-encr” options, it
seems that are «hidden».

psappsrv.cfg
 DBName=...
 DBType=...
 UserId=PS - # default PeopleSoft admin
 UserPswd=<encrypted password> # admin password
 ConnectID=people # default connection id
 ConnectPswd=<encrypted password>

PeopleSoft Administrator Role
(PS user)
This role does NOT have any access to critical business data.

ConnectID
 Real Database ID
 Required to establish the initial connection to the database
 Used by AppServer for initial authentication with PeopleSoft database
 Access to encrypted “AccessID”

PeopleSoft AppServer Sign In
 Initial connection.
 The application server uses the ConnectID and UserId specified in
its configuration file (PSAPPSRV.CFG) to perform the initial
connection to the database.
 The server performs a SQL Select statement on the security tables.
 Check UserID and UserPswd
 The server reconnects using the AccessID.
 The application server begins the persistent connection to the
database that all users use to access the database.

Getting encrypted AccesID
$ sqlplus «ConnecId»@«db ip address»:1522/«dbname»

$ select STM_ACCESS_PART1, STM_ACCESS_PART2, STM_ACCESS_ID,
STM_ACCESS_PSWD from SYSADM.PSACCESSPROFILE;

$ stmdecr <STM_ACCESS_PART1> <STM_ACCESS_PART2>
<STM_ACCESS_ID> <STM_ACCESS_PSWD>

stmdecr
stmdecr will be published soon … :|

Conclusion
• Implement latest CPUs
• Perform external Security Audits

Read our blog
erpscan.com/category/press-center/blog/
Join our webinars
erpscan.com/category/press-center/events/
Subscribe to our newsletters
eepurl.com/bef7h1
USA:
228 Hamilton Avenue, Fl. 3, Palo Alto, CA. 94301
Phone 650.798.5255
EMEA:
Luna ArenA 238 Herikerbergweg, 1101 CM Amsterdam
Phone +31 20 8932892
erpscan.com
inbox@erpscan.com
Thank you
Dmitry Yudin
Security Researcher at ERPScan
d.yudin@erpscan.com

PeopleSoft: HACK THE Planet^W university

PeopleSoft: HACK THE Planet^W university

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to PeopleSoft: HACK THE Planet^W university

Similar to PeopleSoft: HACK THE Planet^W university (20)

Recently uploaded

Recently uploaded (20)

PeopleSoft: HACK THE Planet^W university