start	end	text
640	4980	Hello and welcome, this is ER Pwnage, Threat Simulation Against SAP.
4980	8820	This is a talk being given to the Red Team Village at DEF CON 28.
8920	13300	Unfortunately with Corona going around, we can't really meet in person and talk through this.
13300	15580	But, let's try to make the best of it.
15580	19300	Hopefully you can get something out of this talk on targeting SAP.
20640	22000	Alright, so who am I?
22000	24560	My name is Austin Mark, I'm a Reformed Basis Admin.
24560	28520	Basis Admin is just the sysadmin of the SAP world.
28520	32980	So they might do implementations, migrations, upgrades, stuff like that.
33020	37960	So I got out of that, went into doing full-time pen testing a number of years ago.
37960	39940	And I've been employed at RSM.
40600	44520	You've got my website, amark.com, my Twitter, and then my GitHub.
44740	48060	And I go by the handle Cryo, and I have for quite some time.
49380	50800	Cool, so what is this?
50800	54620	This is Anthology, this is a talk being given to the Red Team Village.
54620	57480	It's a lightning talk about SAP.
57480	62960	Anthology is just a collection of talks that I'm giving this year and hopefully for years to come.
62960	67400	This is just how I organize my talks and make sure things are easy to digest.
67400	69920	And if you're interested in one topic, maybe you're interested in another.
70600	71700	What is the goal?
71700	75980	The goal of this talk is to provide Red Teams with enough knowledge to target SAP.
76320	78860	And kind of strike a balance between the new and the practical.
78860	80960	Things that are tried and true and aren't going anywhere.
80960	86660	But then also speak at least briefly to some of the new and exciting techniques or exploits that we're seeing today.
86660	88180	Why SAP?
88340	91360	Because it's unnecessarily complex, in my opinion.
91360	93400	Difficult to update and business critical.
93500	97180	Some of what we're going to talk about here can be applied to other ERPs.
97320	99040	But we'll be focused on SAP.
99060	105220	They have allegedly well over 120,000 installations worldwide.
105740	113220	But some of the techniques that we'll be presenting on here can be applied to any ERP or anything you're attempting to target.
113220	117300	So some of this is going to be kind of ERP agnostic or target agnostic.
117560	123460	But really we're going to try to dive deep into SAP and focus mostly on that ERP.
123920	128680	So the goal of this talk is to walk through some of those tried and true techniques.
129060	134060	And review some of those vulnerabilities and give you a jumping off point for attacking SAP.
136720	138360	Alright, so onto the agenda.
138360	139520	What are we going to cover?
139520	142340	We're going to talk really quickly about what SAP is.
142340	143840	How we get into SAP.
144340	147720	What if we want to get out of SAP and maybe move laterally?
147860	150360	And then what the impact of some of what we're doing is.
150360	153480	So as red teamers, maybe sometimes we just care about access.
153480	158300	We should be able to at least speak to what the impact is to the business and what we are able to get access to.
158320	159840	Alright, so what is SAP?
159840	162940	SAP is an ERP. It's a suite of enterprise tools for management.
163620	165420	Enterprises have to store it all somewhere.
165960	168280	And SAP wants to be that single point of truth.
168500	173280	So if you can manipulate that single point of truth, the impact can be pretty substantial.
174220	177480	Alright, and lastly, how do we get into SAP?
177480	183320	So there are a number of recent exploits that have been released, including 10K Blaze, Recon, etc.
184100	187400	These are going to take a while for a lot of businesses to patch.
187500	195960	Many SAP systems don't go through the standard patch Tuesday that you see with other back-end systems that support a business.
196020	203100	They tend to wait for a support pack or something that will effectively patch all of this at once.
203100	205040	With minimal downtime.
205160	213100	In the case of 10K Blaze, orgs have regularly mispatched or applied what they believe to be a patch without adjusting their ACLs.
213100	217060	And this vulnerability is unlikely to go away anytime soon.
217360	218640	But we are red teaming here.
218640	223500	We really don't rely on poor patching practices to gain access and move laterally.
223500	229580	Tried and true techniques such as session hijacking, credential harvesting, and phishing haven't exactly gone by the wayside.
229580	234400	Lastly, we'll talk a little bit about some of the impact of getting access into SAP.
234520	241080	Where it might help you elevate your privileges or crack picker passwords or even pivot into a new exciting network.
242380	245420	Alright, finding SAP. So where's the fun at?
245420	250760	The SAP router is something that we regularly find because SAP requires it for support.
250760	256200	So if you're trying to get support from SAP, you have to have this router installed and exposed to the web.
256200	271320	Also, we regularly find web services that are disclosing the exact landscape, OS patch level, services running on the SAP internal infrastructure, and of course, LinkedIn.
271320	281340	We have third party contractors all the time that are disclosing the exact client they're working for, what they implemented, what patch level they moved everything to, and support packs.
281340	289020	Some of them are even kind enough to explain exactly what security systems have been implemented in the case of the consultant on the very bottom.
289760	294900	But kind of the same thing that you would do for any other type of red team or any other type of investigation.
295160	304280	There are some SAP specific services and background information that you can use to just further inform where you're going to target if you're trying to get into SAP.
305600	310320	Alright, so moving on to some common exploits. 10k Blaze. I don't think this is going anywhere.
310320	314640	10k Blaze is what I like to think of as the MS-17-010 of the SAP world.
314840	320220	It gives you full-blown RCE. You can find it pretty much anywhere and the impact is typically severe.
320740	324600	What's worse than MS-17, it's difficult and can be confusing for a business to patch.
324600	338120	Great research and proof-of-concepts were published by Dimitri and Matthew for what was actually an older vulnerability that got a lot of attention during the proof-of-concepts and during the talk they gave at Opcode.
338840	344800	At the bottom of the screen, you've got a one-liner to dump hashes from the database.
344800	361160	This is a fully anonymous, no authentication required, command execution vulnerability within SAP that without appropriate ACLs put in place, you're going to get code execution as SIDADM.
361160	378280	The SIDADM user is effectively the SAP administrator, so you have full access, full rights to add users, dump tables, you essentially have full control over the SAP system at that point.
378660	386240	Recon, the new hotness. A few Onapsis researchers identified in DisclosedCV 2020-6287 and 6286.
386240	396460	Both of these are impacting the SAP NetWeaver Java Stack application servers. These servers are regularly exposed to the web. That's a big part of why this is a concerning vulnerability.
396860	410380	Proof-of-concepts were developed and released by Dimitri, same individual who also released 10k Blaze. This proof-of-concept was later built upon by Zero Steiner and that proof-of-concept has since been merged into Metasploit.
410380	421560	The POC adds an administrative user that can then take full control of the SAP Java system. The vulnerability relies on an authentication bypass and the application configuration wizard.
421560	432120	The fix is a little bit more straightforward than 10k Blaze. You can simply patch or disable the LM manager altogether. And if you are to do that, you're relatively safe.
432120	445020	The high risk of this is that while 10k Blaze is typically only seen on internal networks and relies on a weakness in, say, the SAP router ACL, this is something that's just directly exposed to the web.
445020	456140	And it's gotten a lot of attention from bug bounty hunters who are going out and creating proof-of-concept admin users and disclosing them to companies. It's probably a little risky for that to be going on on some of your business critical systems.
457920	470360	Alright, so fast-tracking your career as a basis admin. SAP Vaulns are fun, but there are plenty of ways to get initial access. We do Red Team stuff, we aren't here to be limited by a couple Vaulns or patch management.
470380	477040	If you have a target, or you want to have a target, basis admins are probably one of the best targets for getting substantial access into SAP.
477040	490300	Basis is just a fancy word for SAP admin. Sometimes they have special admin access, sometimes special network access, but they definitely have the rights that we're after.
490640	499320	And typically they're over-provisioned with roles like SAP All, which is effectively domain administrator for SAP admins.
499840	506720	One of my go-to's and tried-and-true techniques is RDP hijacking, a basis session. Still works in most environments.
506940	518760	Getting that level of access typically means that we're going to go down the AD pen testing road, and I don't want to talk too much about that here, but RDP hijacking is still super useful in environments, and not just for SAP.
518760	531980	This is something that we've used plenty of times when we're trying to get access into another ERP that might be the target, and we might not have the software that's required, even if we have credentials, to log into those systems.
532980	538980	If your access permissions and rights are my access permissions and rights, I'll get where I need to go at the end of the day.
540480	548600	Regularly, you'll find these basis administrators in their own group inside of Active Directory. That should really narrow down where you're trying to target.
548860	558140	And they regularly post contact information on an intranet. That should also give you a couple directing points on where you can go find some of these users.
558940	566820	We also have a couple RDP hijacking demos here on the right that I've pulled off with DoublePulsar.
567480	579460	Just in case you're not familiar with RDP hijacking, there is a Mimikatz module for it as well. I believe this works all the way up to Server 2016.
582470	588710	So, we've got him hijacking a session. He's got some sort of IOWAs here first.
588710	600590	Really, what you're doing is you're just stealing a session. And you're assuming the admin is still logged in, doing his work, even if the credentials are MFA'd or anything else, you have their session at that point.
600590	601450	Alright, cool.
603290	612210	Alright, phishing SAP users. Phishing is still consistently and regularly one of our most successful paths for initial access.
612210	624090	Excel macros continue to be useful, but if you have SAP GUI scripting enabled, which it almost always is in my experience, they work particularly well for phishing for initial access directly into SAP.
624590	636210	SAP Excel macros aren't going to have the common indicators of compromise that you would see when you're trying to phish for getting a C2 directly into memory.
636990	645830	Sure, there's a macro with an IPv4 or hostname pattern, and an OLE object is created, but that's not going to trip AV or EDR on its own.
645830	652790	At the bottom, you can see VirusTotal looking at some very simple SAP macros that were created.
653050	655650	Nothing is going to pick up on this.
655650	673150	Yes, you don't have the same type of shell access that you would have otherwise, but you could potentially use this with some sort of SAP payload that, when executed, runs in the context of the user that's executing it, if single sign-on is enabled.
673770	689290	SAP GUI scripting is something that almost every business relies on, but if you're following along at home, you probably are noticing that you're still going to need a hostname, a client number, maybe even a domain for sending this type of information on behalf of a user.
689290	699090	You still have to know where the SAP systems are, which is not a huge problem if you're trying to get hostnames.
699090	707530	SAP WebDispatcher is absolutely everywhere. It's regularly disclosing SAP hostnames, domain schemas, services, and patches.
707530	722970	I rarely see it require authentication at all, but if it does require authentication, typically if you go from slash default.html to index.html, it bypasses authentication entirely.
722970	732670	It will disclose the hostname, services, OS version, patches, and in my experience, very rarely requires auth at all.
734270	741030	Yes, these services can be disabled, but you can also check at slash SAP slash public slash info.
741030	753730	But if you're able to grab the hostnames of some of these machines that you're trying to target, you can pre-create SAP malicious GUI scripts or VBA macros.
756160	765980	And there's just a quick screenshot of all the SAP NetWeaver ICM services that are potentially disclosing this information out of the web, and I guarantee you there are plenty more.
767400	770060	Alright, so let's talk about grabbing some plain text credentials.
770060	777220	If you can get shell access on an SAP user system, those same SAP GUI scripts we just discussed are also worth hunting for.
777220	787700	Regularly they'll have hard-coded credentials, and there might be some fun backdooring or persistence opportunities for those scripts if single sign-on is not enabled.
788060	790860	SAP uses what's called SNC for encryption.
790860	807160	If you have shell access and you're able to find yourself in a man-in-the-middle type of position, you can use an SAP Wireshark Dissector plugin that will quickly look through and parse out passwords directly from SAP PCAPs.
807160	812720	There's actually a Wireshark filter that does exactly that. Shout out to those guys who wrote this fantastic plugin.
812720	821560	I use it somewhat regularly if I can find a way to man-in-the-middle the traffic between an SAP system and the user systems.
828170	832710	A little bit of background on the user types that you might be able to collect.
832890	836610	You may get access to dialogue or non-dialogue users.
836610	839830	A dialogue user will allow you to just log in to SAP.
839830	844230	You can kind of think of it the same way you would an Active Directory domain user account.
844230	848150	And then similar to an Active Directory service user account, you have non-dialogue users.
848150	851910	Those are users that cannot directly log in to SAP.
851910	859370	Instead, they will execute RFCs or ABAP code externally and they can't log directly into the system.
859370	869490	So if you do have access to a non-dialogue user, you may still be able to take advantage of some of the elevated rights that you have in that context.
869490	875910	To kind of show that and prove that out, I wrote RFCpwn. I'm sure there's other tools that do the same thing.
875950	878350	But this was the tool that I pulled together.
880610	886550	You can see on the right-hand side, an impact style enumeration and exploitation tool.
887250	894530	We have the IP, the client, a user, and a password that we were able to gain access to.
894530	900490	And we're going to copy that user's rights into a dialogue user called SAPPrivUser.
900970	906670	The script runs, collects those user privs, and moves them over to a brand new user.
906670	909250	We can also run the flag tech dump.
909370	916010	And that will give us all of the SHA hashes for an SAP system.
916010	921330	So this is just a very quick proof of concept. I plan to make some updates to this tool here soon.
921850	926270	Feel free to follow it. I plan to post something here in the next coming weeks.
927150	932370	But really, this tool is designed to demonstrate the impact of compromising service accounts.
932590	933210	Cool.
933670	935850	So let's talk about cracking those hashes.
936150	937830	B code is best code.
938750	944150	There are three types of hashes you'll typically see as part of testing SAP systems.
945130	949390	There are also SAP Secure Cred Store hashes, but we're not going to really talk about that.
949390	951390	Those are better covered by other talks.
951390	957010	What I'm really most excited to see is backward compatibility enabled for logons,
957010	958810	which will mean that there's B code hashes.
958810	964250	B code hashes will force every character to be uppercase,
964250	967570	and it will truncate the password to eight characters.
967890	970010	You might actually have a password that's much longer,
970010	972170	but if you can crack the first eight with B code,
972170	977150	and then maybe the last seven with a hashcat mask attack for a 15-character password,
977150	984130	you can start cracking out very, very long admin passwords that would be difficult to crack otherwise.
984350	989930	There's a lot of ways to gather those hashes via different table reading boppies,
989930	996470	or even just accessing the USR02 table in SAP and exporting a CSV.
997930	1002990	On the bottom, you can see some of the hashcat codes to crack these passwords.
1002990	1008570	In the back, you can see a simple mask attack that executed almost immediately,
1008570	1015090	where we were attempting to crack out a B code hash using just a uppercase, uppercase, uppercase,
1015090	1017750	eight-character password, which cracked out with password.
1018430	1022850	And then on the right-hand side, you can kind of see what it would look like to pull these out of USR02.
1022850	1025530	There are also scripts that will pull these exact same tables.
1026370	1030990	And if you're trying to grab similar hashes, you can do that inside of rcpwn as well.
1031490	1035450	But B code is the best code. That is definitely what I'm looking for.
1035630	1041610	And I regularly see, because it is required for supporting older kernel versions of SAP,
1041610	1046950	I think anything before 7.0, you have to be supporting B code.
1050650	1055050	Code execution. So everybody loves code execution.
1055050	1058710	So we have hashes, we have access into SAP, but everybody wants shells.
1059530	1065110	If you're new to SAP, SAP comes with this handy T code called se38.
1065230	1071930	And there's a transaction that you can run called rsbdcos0.
1071930	1075410	You run that report, it will give you a very basic shell.
1075410	1080050	And you can cat out etc password and run some very standard commands.
1080050	1087310	But if you want to go above and beyond, and you want to find your own commands and run pretty much anything you want,
1087310	1091510	sm69 is the way you want to go. That is another T code within SAP.
1092230	1097710	It's a little finicky to get a reverse shell or netcat out shell.
1097710	1103130	A simple fix that works for me is to curl over a one-liner name pipe reverse shell.
1103370	1108410	And after pulling that over, you can execute it as a custom transaction.
1108410	1114370	This is a very loud attack, right? You're going to show up as a brand new program type within this table.
1114370	1118530	But if you're looking for a shell, this may be a way to get access.
1118530	1121470	So we've got a quick video of kind of what that looks like.
1121470	1125530	On the right-hand side, you have a transaction that I've created here.
1125530	1130250	I'm just executing the script that I just curled into the standard directory.
1131830	1138490	I'm not listening yet, so we ran it once, not listening, come back up, run it again, and we've got a shell.
1145380	1148160	All right, and lastly, we're going to talk a little bit about fuzzing SAP.
1148160	1153020	Just some things that I've seen work. Redamsa has been very, very successful in fuzzing SAP in the past.
1153020	1160140	You can see a few ERP scan security researchers who have found vulnerabilities using it back in 2016, 2017.
1161320	1166780	Using that same framework, I like to use Cisco Mutiny, which leverages part of Redamsa
1166780	1172760	and automates a lot of the process of extracting potential fuzzers, creating the fuzzer,
1172760	1179260	and then being able to do fuzz cases all based off of just some PCAPs that you can pull out of Wireshark.
1179560	1182120	And then you can, of course, use that Wireshark dissector that we talked about
1182120	1190040	and begin to understand what exactly is being fuzzed, how it's being fuzzed, and dive deeper into the binary.
1190900	1195520	And to that end, one of the things that I've been finding kind of interesting,
1195520	1199140	and I haven't seen a ton of success with it yet, but I'm really excited about it,
1199140	1204160	is this Voln Fanatic plugin for Binary Ninja that will go out, look for sources and syncs,
1204160	1207760	and start highlighting parts of the code inside of the control flow graph
1207760	1217260	and maybe show you where a potential buffer overflow from a memcpy or a scanf could be happening within the binary itself.
1217260	1220840	So on the right-hand side, you've got the HANA database index server
1220840	1227440	and some potential buffer overflows up at the top that Voln Fanatic believes that it's identified.
1227440	1235020	And then lastly, I'm just going to release an old POC that I had for a crash inside of the HANA database server
1235020	1237820	that affected every version up until last August.
1237820	1242000	So if you haven't patched since this time last year, consider patching,
1242000	1246680	but hopefully somebody can find it useful or at least kick some tires for somebody.
1249060	1252340	So those of you with a red teaming background or a pen testing background
1252340	1256160	have definitely touched ImpactKit or a tool that's built off of ImpactKit.
1257000	1259840	Similar, but for SAP is PySAP.
1259840	1263840	It's a library for crafting SAP network packets built off of SCAPI.
1264280	1267520	Martin maintains this. He does a fantastic job.
1267520	1269660	He has a ton of example scripts.
1270080	1274280	Strongly, strongly recommended for trying to craft SAP fuzzers.
1275240	1279180	The hdboff module is something that recently got pushed out.
1279180	1282060	I'm super excited to try that out on my own.
1282060	1284800	One of my favorites, and you can see it on the right-hand side,
1284800	1288120	is this msdumpparam example module
1288120	1292300	that will tell you some of the potentially sensitive settings
1292300	1294880	that may or may not be enabled.
1295300	1298940	If you look at the right-hand side, some of those have exclamation points.
1298940	1300120	And if we look down toward the bottom,
1300120	1304560	we can see login password downwards compatibility is set to zero.
1304560	1306040	Now that would be a good thing.
1306260	1310640	But bear in mind, this is just the operating config,
1310640	1312720	not necessarily the running config.
1312800	1314920	So even if it says zero here,
1314920	1318700	there's a potential that downwards compatibility is enabled
1318700	1320700	in something like RZ11.
1320840	1322760	We won't get into too much of that here.
1322760	1324900	The nuances, just because it's marked there
1324900	1326900	as downward compatibility disabled
1326900	1330900	doesn't mean it's actually disabled in the running system.
1332180	1336200	And if that is disabled, you might not get B code hashes,
1336200	1338660	but maybe you'll get B code hashes because somebody's gone
1338660	1340760	and made that adjustment in the running config.
1340880	1344620	And somebody's logged in or changed their password with that enabled.
1345600	1348880	Further, there's a ton of different protocols that this is supported.
1349500	1352320	Just if you're going to do any sort of packet crafting,
1352320	1357700	this is a strongly recommended tool for fuzzers or for SAP research.
1357840	1361440	And I use a lot of these tools in my pen testing,
1361440	1365820	in addition to some of the standard modules you see inside of something like Metasploit.
1366000	1366940	Cool.
1367700	1369680	All right, so what did we cover?
1369680	1373220	New fangled SAP vulns, how to target SAP users,
1373220	1375820	and which SAP users I would personally target,
1375820	1380400	gathering cleartext credentials, code execution as non-dialogue users,
1380400	1384040	fuzzing SAP as a target, and the PySAP library.
1385020	1389260	Some shoutouts to some fantastic researchers, friends,
1389260	1393600	people that I look for additional research from.
1393600	1395940	These are all fantastic SAP researchers.
1395940	1398320	I strongly recommend following each and every one of them.
1398420	1401200	And then on the right-hand side, you have my Twitter and Discord.
1401200	1403940	Feel free to reach out based on this talk, ask questions,
1403940	1407020	and I'd love to hear from you, collab on some stuff.
1407500	1411060	SAP is definitely an area of growing interest over the last couple of years,
1411060	1412620	and I think it'll continue to be.
1413740	1416560	And with that, we can turn it over for Q&A.
1417420	1421060	I will be in the chat, so feel free to drop me questions there.
1421160	1423680	This is prerecorded just a little bit beforehand,
1423680	1426720	so it's still very fresh, but drop me questions,
1426720	1431020	and I'll be sure to get back to you quickly in the Red Team Village Discord channel.
1432060	1433000	And thank you for coming!