1
00:00:00,640 --> 00:00:04,980
Hello and welcome, this is ER Pwnage, Threat Simulation Against SAP.

2
00:00:04,980 --> 00:00:08,820
This is a talk being given to the Red Team Village at DEF CON 28.

3
00:00:08,920 --> 00:00:13,300
Unfortunately with Corona going around, we can't really meet in person and talk through this.

4
00:00:13,300 --> 00:00:15,580
But, let's try to make the best of it.

5
00:00:15,580 --> 00:00:19,300
Hopefully you can get something out of this talk on targeting SAP.

6
00:00:20,640 --> 00:00:22,000
Alright, so who am I?

7
00:00:22,000 --> 00:00:24,560
My name is Austin Mark, I'm a Reformed Basis Admin.

8
00:00:24,560 --> 00:00:28,520
Basis Admin is just the sysadmin of the SAP world.

9
00:00:28,520 --> 00:00:32,980
So they might do implementations, migrations, upgrades, stuff like that.

10
00:00:33,020 --> 00:00:37,960
So I got out of that, went into doing full-time pen testing a number of years ago.

11
00:00:37,960 --> 00:00:39,940
And I've been employed at RSM.

12
00:00:40,600 --> 00:00:44,520
You've got my website, amark.com, my Twitter, and then my GitHub.

13
00:00:44,740 --> 00:00:48,060
And I go by the handle Cryo, and I have for quite some time.

14
00:00:49,380 --> 00:00:50,800
Cool, so what is this?

15
00:00:50,800 --> 00:00:54,620
This is Anthology, this is a talk being given to the Red Team Village.

16
00:00:54,620 --> 00:00:57,480
It's a lightning talk about SAP.

17
00:00:57,480 --> 00:01:02,960
Anthology is just a collection of talks that I'm giving this year and hopefully for years to come.

18
00:01:02,960 --> 00:01:07,400
This is just how I organize my talks and make sure things are easy to digest.

19
00:01:07,400 --> 00:01:09,920
And if you're interested in one topic, maybe you're interested in another.

20
00:01:10,600 --> 00:01:11,700
What is the goal?

21
00:01:11,700 --> 00:01:15,980
The goal of this talk is to provide Red Teams with enough knowledge to target SAP.

22
00:01:16,320 --> 00:01:18,860
And kind of strike a balance between the new and the practical.

23
00:01:18,860 --> 00:01:20,960
Things that are tried and true and aren't going anywhere.

24
00:01:20,960 --> 00:01:26,660
But then also speak at least briefly to some of the new and exciting techniques or exploits that we're seeing today.

25
00:01:26,660 --> 00:01:28,180
Why SAP?

26
00:01:28,340 --> 00:01:31,360
Because it's unnecessarily complex, in my opinion.

27
00:01:31,360 --> 00:01:33,400
Difficult to update and business critical.

28
00:01:33,500 --> 00:01:37,180
Some of what we're going to talk about here can be applied to other ERPs.

29
00:01:37,320 --> 00:01:39,040
But we'll be focused on SAP.

30
00:01:39,060 --> 00:01:45,220
They have allegedly well over 120,000 installations worldwide.

31
00:01:45,740 --> 00:01:53,220
But some of the techniques that we'll be presenting on here can be applied to any ERP or anything you're attempting to target.

32
00:01:53,220 --> 00:01:57,300
So some of this is going to be kind of ERP agnostic or target agnostic.

33
00:01:57,560 --> 00:02:03,460
But really we're going to try to dive deep into SAP and focus mostly on that ERP.

34
00:02:03,920 --> 00:02:08,680
So the goal of this talk is to walk through some of those tried and true techniques.

35
00:02:09,060 --> 00:02:14,060
And review some of those vulnerabilities and give you a jumping off point for attacking SAP.

36
00:02:16,720 --> 00:02:18,360
Alright, so onto the agenda.

37
00:02:18,360 --> 00:02:19,520
What are we going to cover?

38
00:02:19,520 --> 00:02:22,340
We're going to talk really quickly about what SAP is.

39
00:02:22,340 --> 00:02:23,840
How we get into SAP.

40
00:02:24,340 --> 00:02:27,720
What if we want to get out of SAP and maybe move laterally?

41
00:02:27,860 --> 00:02:30,360
And then what the impact of some of what we're doing is.

42
00:02:30,360 --> 00:02:33,480
So as red teamers, maybe sometimes we just care about access.

43
00:02:33,480 --> 00:02:38,300
We should be able to at least speak to what the impact is to the business and what we are able to get access to.

44
00:02:38,320 --> 00:02:39,840
Alright, so what is SAP?

45
00:02:39,840 --> 00:02:40,880
SAP is an ERP.

46
00:02:40,880 --> 00:02:42,940
It's a suite of enterprise tools for management.

47
00:02:43,620 --> 00:02:45,420
Enterprises have to store it all somewhere.

48
00:02:45,960 --> 00:02:48,280
And SAP wants to be that single point of truth.

49
00:02:48,500 --> 00:02:53,280
So if you can manipulate that single point of truth, the impact can be pretty substantial.

50
00:02:54,220 --> 00:02:57,480
Alright, and lastly, how do we get into SAP?

51
00:02:57,480 --> 00:03:03,320
So there are a number of recent exploits that have been released, including 10K Blaze, Recon, etc.

52
00:03:04,100 --> 00:03:07,400
These are going to take a while for a lot of businesses to patch.

53
00:03:07,500 --> 00:03:15,960
Many SAP systems don't go through the standard patch Tuesday that you see with other back-end systems that support a business.

54
00:03:16,020 --> 00:03:23,100
They tend to wait for a support pack or something that will effectively patch all of this at once.

55
00:03:23,100 --> 00:03:25,040
With minimal downtime.

56
00:03:25,160 --> 00:03:33,100
In the case of 10K Blaze, orgs have regularly mispatched or applied what they believe to be a patch without adjusting their ACLs.

57
00:03:33,100 --> 00:03:37,060
And this vulnerability is unlikely to go away anytime soon.

58
00:03:37,360 --> 00:03:38,640
But we are red teaming here.

59
00:03:38,640 --> 00:03:43,500
We really don't rely on poor patching practices to gain access and move laterally.

60
00:03:43,500 --> 00:03:49,580
Tried and true techniques such as session hijacking, credential harvesting, and phishing haven't exactly gone by the wayside.

61
00:03:49,580 --> 00:03:54,400
Lastly, we'll talk a little bit about some of the impact of getting access into SAP.

62
00:03:54,520 --> 00:04:01,080
Where it might help you elevate your privileges or crack picker passwords or even pivot into a new exciting network.

63
00:04:02,380 --> 00:04:04,180
Alright, finding SAP.

64
00:04:04,180 --> 00:04:05,420
So where's the fun at?

65
00:04:05,420 --> 00:04:10,760
The SAP router is something that we regularly find because SAP requires it for support.

66
00:04:10,760 --> 00:04:16,200
So if you're trying to get support from SAP, you have to have this router installed and exposed to the web.

67
00:04:16,200 --> 00:04:31,320
Also, we regularly find web services that are disclosing the exact landscape, OS patch level, services running on the SAP internal infrastructure, and of course, LinkedIn.

68
00:04:31,320 --> 00:04:41,340
We have third party contractors all the time that are disclosing the exact client they're working for, what they implemented, what patch level they moved everything to, and support packs.

69
00:04:41,340 --> 00:04:49,020
Some of them are even kind enough to explain exactly what security systems have been implemented in the case of the consultant on the very bottom.

70
00:04:49,760 --> 00:04:54,900
But kind of the same thing that you would do for any other type of red team or any other type of investigation.

71
00:04:55,160 --> 00:05:04,280
There are some SAP specific services and background information that you can use to just further inform where you're going to target if you're trying to get into SAP.

72
00:05:05,600 --> 00:05:07,860
Alright, so moving on to some common exploits.

73
00:05:07,860 --> 00:05:08,560
10k Blaze.

74
00:05:08,620 --> 00:05:10,320
I don't think this is going anywhere.

75
00:05:10,320 --> 00:05:14,640
10k Blaze is what I like to think of as the MS-17-010 of the SAP world.

76
00:05:14,840 --> 00:05:16,320
It gives you full-blown RCE.

77
00:05:16,340 --> 00:05:20,220
You can find it pretty much anywhere and the impact is typically severe.

78
00:05:20,740 --> 00:05:24,600
What's worse than MS-17, it's difficult and can be confusing for a business to patch.

79
00:05:24,600 --> 00:05:38,120
Great research and proof-of-concepts were published by Dimitri and Matthew for what was actually an older vulnerability that got a lot of attention during the proof-of-concepts and during the talk they gave at Opcode.

80
00:05:38,840 --> 00:05:44,800
At the bottom of the screen, you've got a one-liner to dump hashes from the database.

81
00:05:44,800 --> 00:06:01,160
This is a fully anonymous, no authentication required, command execution vulnerability within SAP that without appropriate ACLs put in place, you're going to get code execution as SIDADM.

82
00:06:01,160 --> 00:06:18,280
The SIDADM user is effectively the SAP administrator, so you have full access, full rights to add users, dump tables, you essentially have full control over the SAP system at that point.

83
00:06:18,660 --> 00:06:20,720
Recon, the new hotness.

84
00:06:20,720 --> 00:06:26,240
A few Onapsis researchers identified in DisclosedCV 2020-6287 and 6286.

85
00:06:26,240 --> 00:06:30,780
Both of these are impacting the SAP NetWeaver Java Stack application servers.

86
00:06:30,780 --> 00:06:33,260
These servers are regularly exposed to the web.

87
00:06:33,260 --> 00:06:36,460
That's a big part of why this is a concerning vulnerability.

88
00:06:36,860 --> 00:06:41,700
Proof-of-concepts were developed and released by Dimitri, same individual who also released 10k Blaze.

89
00:06:41,700 --> 00:06:50,380
This proof-of-concept was later built upon by Zero Steiner and that proof-of-concept has since been merged into Metasploit.

90
00:06:50,380 --> 00:06:56,700
The POC adds an administrative user that can then take full control of the SAP Java system.

91
00:06:56,780 --> 00:07:01,560
The vulnerability relies on an authentication bypass and the application configuration wizard.

92
00:07:01,560 --> 00:07:04,720
The fix is a little bit more straightforward than 10k Blaze.

93
00:07:04,720 --> 00:07:08,880
You can simply patch or disable the LM manager altogether.

94
00:07:08,900 --> 00:07:12,120
And if you are to do that, you're relatively safe.

95
00:07:12,120 --> 00:07:25,020
The high risk of this is that while 10k Blaze is typically only seen on internal networks and relies on a weakness in, say, the SAP router ACL, this is something that's just directly exposed to the web.

96
00:07:25,020 --> 00:07:31,640
And it's gotten a lot of attention from bug bounty hunters who are going out and creating proof-of-concept admin users and disclosing them to companies.

97
00:07:31,640 --> 00:07:36,140
It's probably a little risky for that to be going on on some of your business critical systems.

98
00:07:37,920 --> 00:07:41,700
Alright, so fast-tracking your career as a basis admin.

99
00:07:41,980 --> 00:07:45,640
SAP Vaulns are fun, but there are plenty of ways to get initial access.

100
00:07:45,640 --> 00:07:50,360
We do Red Team stuff, we aren't here to be limited by a couple Vaulns or patch management.

101
00:07:50,380 --> 00:07:57,040
If you have a target, or you want to have a target, basis admins are probably one of the best targets for getting substantial access into SAP.

102
00:07:57,040 --> 00:08:00,640
Basis is just a fancy word for SAP admin.

103
00:08:00,640 --> 00:08:10,300
Sometimes they have special admin access, sometimes special network access, but they definitely have the rights that we're after.

104
00:08:10,640 --> 00:08:19,320
And typically they're over-provisioned with roles like SAP All, which is effectively domain administrator for SAP admins.

105
00:08:19,840 --> 00:08:24,800
One of my go-to's and tried-and-true techniques is RDP hijacking, a basis session.

106
00:08:24,880 --> 00:08:26,720
Still works in most environments.

107
00:08:26,940 --> 00:08:38,760
Getting that level of access typically means that we're going to go down the AD pen testing road, and I don't want to talk too much about that here, but RDP hijacking is still super useful in environments, and not just for SAP.

108
00:08:38,760 --> 00:08:51,980
This is something that we've used plenty of times when we're trying to get access into another ERP that might be the target, and we might not have the software that's required, even if we have credentials, to log into those systems.

109
00:08:52,980 --> 00:08:58,980
If your access permissions and rights are my access permissions and rights, I'll get where I need to go at the end of the day.

110
00:09:00,480 --> 00:09:04,180
Regularly, you'll find these basis administrators in their own group inside of Active Directory.

111
00:09:04,180 --> 00:09:08,600
That should really narrow down where you're trying to target.

112
00:09:08,860 --> 00:09:11,840
And they regularly post contact information on an intranet.

113
00:09:11,840 --> 00:09:18,140
That should also give you a couple directing points on where you can go find some of these users.

114
00:09:18,940 --> 00:09:26,820
We also have a couple RDP hijacking demos here on the right that I've pulled off with DoublePulsar.

115
00:09:27,480 --> 00:09:32,460
Just in case you're not familiar with RDP hijacking, there is a Mimikatz module for it as well.

116
00:09:33,600 --> 00:09:39,460
I believe this works all the way up to Server 2016.

117
00:09:42,470 --> 00:09:45,510
So, we've got him hijacking a session.

118
00:09:45,510 --> 00:09:48,710
He's got some sort of IOWAs here first.

119
00:09:48,710 --> 00:09:51,170
Really, what you're doing is you're just stealing a session.

120
00:09:51,170 --> 00:10:00,590
And you're assuming the admin is still logged in, doing his work, even if the credentials are MFA'd or anything else, you have their session at that point.

121
00:10:00,590 --> 00:10:01,450
Alright, cool.

122
00:10:03,290 --> 00:10:04,930
Alright, phishing SAP users.

123
00:10:04,930 --> 00:10:12,210
Phishing is still consistently and regularly one of our most successful paths for initial access.

124
00:10:12,210 --> 00:10:24,090
Excel macros continue to be useful, but if you have SAP GUI scripting enabled, which it almost always is in my experience, they work particularly well for phishing for initial access directly into SAP.

125
00:10:24,590 --> 00:10:36,210
SAP Excel macros aren't going to have the common indicators of compromise that you would see when you're trying to phish for getting a C2 directly into memory.

126
00:10:36,990 --> 00:10:45,830
Sure, there's a macro with an IPv4 or hostname pattern, and an OLE object is created, but that's not going to trip AV or EDR on its own.

127
00:10:45,830 --> 00:10:52,790
At the bottom, you can see VirusTotal looking at some very simple SAP macros that were created.

128
00:10:53,050 --> 00:10:55,650
Nothing is going to pick up on this.

129
00:10:55,650 --> 00:11:13,150
Yes, you don't have the same type of shell access that you would have otherwise, but you could potentially use this with some sort of SAP payload that, when executed, runs in the context of the user that's executing it, if single sign-on is enabled.

130
00:11:13,770 --> 00:11:29,290
SAP GUI scripting is something that almost every business relies on, but if you're following along at home, you probably are noticing that you're still going to need a hostname, a client number, maybe even a domain for sending this type of information on behalf of a user.

131
00:11:29,290 --> 00:11:39,090
You still have to know where the SAP systems are, which is not a huge problem if you're trying to get hostnames.

132
00:11:39,090 --> 00:11:41,830
SAP WebDispatcher is absolutely everywhere.

133
00:11:41,830 --> 00:11:47,530
It's regularly disclosing SAP hostnames, domain schemas, services, and patches.

134
00:11:47,530 --> 00:12:02,970
I rarely see it require authentication at all, but if it does require authentication, typically if you go from slash default.html to index.html, it bypasses authentication entirely.

135
00:12:02,970 --> 00:12:12,670
It will disclose the hostname, services, OS version, patches, and in my experience, very rarely requires auth at all.

136
00:12:14,270 --> 00:12:21,030
Yes, these services can be disabled, but you can also check at slash SAP slash public slash info.

137
00:12:21,030 --> 00:12:33,730
But if you're able to grab the hostnames of some of these machines that you're trying to target, you can pre-create SAP malicious GUI scripts or VBA macros.

138
00:12:36,160 --> 00:12:45,980
And there's just a quick screenshot of all the SAP NetWeaver ICM services that are potentially disclosing this information out of the web, and I guarantee you there are plenty more.

139
00:12:47,400 --> 00:12:50,060
Alright, so let's talk about grabbing some plain text credentials.

140
00:12:50,060 --> 00:12:57,220
If you can get shell access on an SAP user system, those same SAP GUI scripts we just discussed are also worth hunting for.

141
00:12:57,220 --> 00:13:07,700
Regularly they'll have hard-coded credentials, and there might be some fun backdooring or persistence opportunities for those scripts if single sign-on is not enabled.

142
00:13:08,060 --> 00:13:10,860
SAP uses what's called SNC for encryption.

143
00:13:10,860 --> 00:13:27,160
If you have shell access and you're able to find yourself in a man-in-the-middle type of position, you can use an SAP Wireshark Dissector plugin that will quickly look through and parse out passwords directly from SAP PCAPs.

144
00:13:27,160 --> 00:13:29,660
There's actually a Wireshark filter that does exactly that.

145
00:13:29,660 --> 00:13:32,720
Shout out to those guys who wrote this fantastic plugin.

146
00:13:32,720 --> 00:13:41,560
I use it somewhat regularly if I can find a way to man-in-the-middle the traffic between an SAP system and the user systems.

147
00:13:48,170 --> 00:13:52,710
A little bit of background on the user types that you might be able to collect.

148
00:13:52,890 --> 00:13:56,610
You may get access to dialogue or non-dialogue users.

149
00:13:56,610 --> 00:13:59,830
A dialogue user will allow you to just log in to SAP.

150
00:13:59,830 --> 00:14:04,230
You can kind of think of it the same way you would an Active Directory domain user account.

151
00:14:04,230 --> 00:14:08,150
And then similar to an Active Directory service user account, you have non-dialogue users.

152
00:14:08,150 --> 00:14:11,910
Those are users that cannot directly log in to SAP.

153
00:14:11,910 --> 00:14:19,370
Instead, they will execute RFCs or ABAP code externally and they can't log directly into the system.

154
00:14:19,370 --> 00:14:29,490
So if you do have access to a non-dialogue user, you may still be able to take advantage of some of the elevated rights that you have in that context.

155
00:14:29,490 --> 00:14:33,490
To kind of show that and prove that out, I wrote RFCpwn.

156
00:14:33,490 --> 00:14:35,910
I'm sure there's other tools that do the same thing.

157
00:14:35,950 --> 00:14:38,350
But this was the tool that I pulled together.

158
00:14:40,610 --> 00:14:46,550
You can see on the right-hand side, an impact style enumeration and exploitation tool.

159
00:14:47,250 --> 00:14:54,530
We have the IP, the client, a user, and a password that we were able to gain access to.

160
00:14:54,530 --> 00:15:00,490
And we're going to copy that user's rights into a dialogue user called SAPPrivUser.

161
00:15:00,970 --> 00:15:06,670
The script runs, collects those user privs, and moves them over to a brand new user.

162
00:15:06,670 --> 00:15:09,250
We can also run the flag tech dump.

163
00:15:09,370 --> 00:15:16,010
And that will give us all of the SHA hashes for an SAP system.

164
00:15:16,010 --> 00:15:18,610
So this is just a very quick proof of concept.

165
00:15:18,610 --> 00:15:21,330
I plan to make some updates to this tool here soon.

166
00:15:21,850 --> 00:15:23,250
Feel free to follow it.

167
00:15:23,250 --> 00:15:26,270
I plan to post something here in the next coming weeks.

168
00:15:27,150 --> 00:15:32,370
But really, this tool is designed to demonstrate the impact of compromising service accounts.

169
00:15:32,590 --> 00:15:33,210
Cool.

170
00:15:33,670 --> 00:15:35,850
So let's talk about cracking those hashes.

171
00:15:36,150 --> 00:15:37,830
B code is best code.

172
00:15:38,750 --> 00:15:44,150
There are three types of hashes you'll typically see as part of testing SAP systems.

173
00:15:45,130 --> 00:15:49,390
There are also SAP Secure Cred Store hashes, but we're not going to really talk about that.

174
00:15:49,390 --> 00:15:51,390
Those are better covered by other talks.

175
00:15:51,390 --> 00:15:58,810
What I'm really most excited to see is backward compatibility enabled for logons, which will mean that there's B code hashes.

176
00:15:58,810 --> 00:16:07,570
B code hashes will force every character to be uppercase, and it will truncate the password to eight characters.

177
00:16:07,890 --> 00:16:24,130
You might actually have a password that's much longer, but if you can crack the first eight with B code, and then maybe the last seven with a hashcat mask attack for a 15-character password, you can start cracking out very, very long admin passwords that would be difficult to crack otherwise.

178
00:16:24,350 --> 00:16:36,470
There's a lot of ways to gather those hashes via different table reading boppies, or even just accessing the USR02 table in SAP and exporting a CSV.

179
00:16:37,930 --> 00:16:42,990
On the bottom, you can see some of the hashcat codes to crack these passwords.

180
00:16:42,990 --> 00:16:57,750
In the back, you can see a simple mask attack that executed almost immediately, where we were attempting to crack out a B code hash using just a uppercase, uppercase, uppercase, eight-character password, which cracked out with password.

181
00:16:58,430 --> 00:17:02,850
And then on the right-hand side, you can kind of see what it would look like to pull these out of USR02.

182
00:17:02,850 --> 00:17:05,530
There are also scripts that will pull these exact same tables.

183
00:17:06,370 --> 00:17:10,990
And if you're trying to grab similar hashes, you can do that inside of rcpwn as well.

184
00:17:11,490 --> 00:17:13,550
But B code is the best code.

185
00:17:13,550 --> 00:17:15,450
That is definitely what I'm looking for.

186
00:17:15,630 --> 00:17:26,950
And I regularly see, because it is required for supporting older kernel versions of SAP, I think anything before 7.0, you have to be supporting B code.

187
00:17:30,650 --> 00:17:32,010
Code execution.

188
00:17:32,750 --> 00:17:35,050
So everybody loves code execution.

189
00:17:35,050 --> 00:17:38,710
So we have hashes, we have access into SAP, but everybody wants shells.

190
00:17:39,530 --> 00:17:45,110
If you're new to SAP, SAP comes with this handy T code called se38.

191
00:17:45,230 --> 00:17:51,930
And there's a transaction that you can run called rsbdcos0.

192
00:17:51,930 --> 00:17:55,410
You run that report, it will give you a very basic shell.

193
00:17:55,410 --> 00:18:00,050
And you can cat out etc password and run some very standard commands.

194
00:18:00,050 --> 00:18:09,550
But if you want to go above and beyond, and you want to find your own commands and run pretty much anything you want, sm69 is the way you want to go.

195
00:18:09,550 --> 00:18:11,510
That is another T code within SAP.

196
00:18:12,230 --> 00:18:17,710
It's a little finicky to get a reverse shell or netcat out shell.

197
00:18:17,710 --> 00:18:23,130
A simple fix that works for me is to curl over a one-liner name pipe reverse shell.

198
00:18:23,370 --> 00:18:28,410
And after pulling that over, you can execute it as a custom transaction.

199
00:18:28,410 --> 00:18:30,110
This is a very loud attack, right?

200
00:18:30,110 --> 00:18:34,370
You're going to show up as a brand new program type within this table.

201
00:18:34,370 --> 00:18:38,530
But if you're looking for a shell, this may be a way to get access.

202
00:18:38,530 --> 00:18:41,470
So we've got a quick video of kind of what that looks like.

203
00:18:41,470 --> 00:18:45,530
On the right-hand side, you have a transaction that I've created here.

204
00:18:45,530 --> 00:18:50,250
I'm just executing the script that I just curled into the standard directory.

205
00:18:51,830 --> 00:18:58,490
I'm not listening yet, so we ran it once, not listening, come back up, run it again, and we've got a shell.

206
00:19:05,380 --> 00:19:08,160
All right, and lastly, we're going to talk a little bit about fuzzing SAP.

207
00:19:08,160 --> 00:19:10,220
Just some things that I've seen work.

208
00:19:10,420 --> 00:19:13,020
Redamsa has been very, very successful in fuzzing SAP in the past.

209
00:19:13,020 --> 00:19:20,140
You can see a few ERP scan security researchers who have found vulnerabilities using it back in 2016, 2017.

210
00:19:21,320 --> 00:19:39,260
Using that same framework, I like to use Cisco Mutiny, which leverages part of Redamsa and automates a lot of the process of extracting potential fuzzers, creating the fuzzer, and then being able to do fuzz cases all based off of just some PCAPs that you can pull out of Wireshark.

211
00:19:39,560 --> 00:19:50,040
And then you can, of course, use that Wireshark dissector that we talked about and begin to understand what exactly is being fuzzed, how it's being fuzzed, and dive deeper into the binary.

212
00:19:50,900 --> 00:20:04,160
And to that end, one of the things that I've been finding kind of interesting, and I haven't seen a ton of success with it yet, but I'm really excited about it, is this Voln Fanatic plugin for Binary Ninja that will go out, look for sources and syncs,

213
00:20:04,160 --> 00:20:17,260
and start highlighting parts of the code inside of the control flow graph and maybe show you where a potential buffer overflow from a memcpy or a scanf could be happening within the binary itself.

214
00:20:17,260 --> 00:20:27,440
So on the right-hand side, you've got the HANA database index server and some potential buffer overflows up at the top that Voln Fanatic believes that it's identified.

215
00:20:27,440 --> 00:20:37,820
And then lastly, I'm just going to release an old POC that I had for a crash inside of the HANA database server that affected every version up until last August.

216
00:20:37,820 --> 00:20:46,680
So if you haven't patched since this time last year, consider patching, but hopefully somebody can find it useful or at least kick some tires for somebody.

217
00:20:49,060 --> 00:20:56,160
So those of you with a red teaming background or a pen testing background have definitely touched ImpactKit or a tool that's built off of ImpactKit.

218
00:20:57,000 --> 00:20:59,840
Similar, but for SAP is PySAP.

219
00:20:59,840 --> 00:21:03,840
It's a library for crafting SAP network packets built off of SCAPI.

220
00:21:04,280 --> 00:21:06,440
Martin maintains this.

221
00:21:06,440 --> 00:21:07,520
He does a fantastic job.

222
00:21:07,520 --> 00:21:09,660
He has a ton of example scripts.

223
00:21:10,080 --> 00:21:14,280
Strongly, strongly recommended for trying to craft SAP fuzzers.

224
00:21:15,240 --> 00:21:19,180
The hdboff module is something that recently got pushed out.

225
00:21:19,180 --> 00:21:22,060
I'm super excited to try that out on my own.

226
00:21:22,060 --> 00:21:34,880
One of my favorites, and you can see it on the right-hand side, is this msdumpparam example module that will tell you some of the potentially sensitive settings that may or may not be enabled.

227
00:21:35,300 --> 00:21:38,940
If you look at the right-hand side, some of those have exclamation points.

228
00:21:38,940 --> 00:21:44,560
And if we look down toward the bottom, we can see login password downwards compatibility is set to zero.

229
00:21:44,560 --> 00:21:46,040
Now that would be a good thing.

230
00:21:46,260 --> 00:21:52,720
But bear in mind, this is just the operating config, not necessarily the running config.

231
00:21:52,800 --> 00:22:00,700
So even if it says zero here, there's a potential that downwards compatibility is enabled in something like RZ11.

232
00:22:00,840 --> 00:22:02,760
We won't get into too much of that here.

233
00:22:02,760 --> 00:22:10,900
The nuances, just because it's marked there as downward compatibility disabled doesn't mean it's actually disabled in the running system.

234
00:22:12,180 --> 00:22:20,760
And if that is disabled, you might not get B code hashes, but maybe you'll get B code hashes because somebody's gone and made that adjustment in the running config.

235
00:22:20,880 --> 00:22:24,620
And somebody's logged in or changed their password with that enabled.

236
00:22:25,600 --> 00:22:28,880
Further, there's a ton of different protocols that this is supported.

237
00:22:29,500 --> 00:22:37,700
Just if you're going to do any sort of packet crafting, this is a strongly recommended tool for fuzzers or for SAP research.

238
00:22:37,840 --> 00:22:45,820
And I use a lot of these tools in my pen testing, in addition to some of the standard modules you see inside of something like Metasploit.

239
00:22:46,000 --> 00:22:46,940
Cool.

240
00:22:47,700 --> 00:22:49,680
All right, so what did we cover?

241
00:22:49,680 --> 00:23:04,040
New fangled SAP vulns, how to target SAP users, and which SAP users I would personally target, gathering cleartext credentials, code execution as non-dialogue users, fuzzing SAP as a target, and the PySAP library.

242
00:23:05,020 --> 00:23:13,600
Some shoutouts to some fantastic researchers, friends, people that I look for additional research from.

243
00:23:13,600 --> 00:23:15,940
These are all fantastic SAP researchers.

244
00:23:15,940 --> 00:23:18,320
I strongly recommend following each and every one of them.

245
00:23:18,420 --> 00:23:21,200
And then on the right-hand side, you have my Twitter and Discord.

246
00:23:21,200 --> 00:23:27,020
Feel free to reach out based on this talk, ask questions, and I'd love to hear from you, collab on some stuff.

247
00:23:27,500 --> 00:23:32,620
SAP is definitely an area of growing interest over the last couple of years, and I think it'll continue to be.

248
00:23:33,740 --> 00:23:36,560
And with that, we can turn it over for Q&A.

249
00:23:37,420 --> 00:23:41,060
I will be in the chat, so feel free to drop me questions there.

250
00:23:41,160 --> 00:23:51,020
This is prerecorded just a little bit beforehand, so it's still very fresh, but drop me questions, and I'll be sure to get back to you quickly in the Red Team Village Discord channel.

251
00:23:52,060 --> 00:23:53,000
And thank you for coming!