@@ -26,26 +26,24 @@ class Metasploit4 < Msf::Auxiliary
26
26
27
27
def initialize
28
28
super (
29
- 'Name' => 'SAP /sap/public/info RFC_SYSTEM_INFO Function Sensitive Information Gathering' ,
29
+ 'Name' => 'SAP ICF /sap/public/info Service Sensitive Information Gathering' ,
30
30
'Description' => %q{
31
- This module uses the RFC_SYSTEM_INFO function within SAP Internet Communication
31
+ This module uses the /sap/public/info service within SAP Internet Communication
32
32
Framework (ICF) to obtain the operating system version, SAP version, IP address
33
- and other information through /sap/public/info
34
-
33
+ and other information.
35
34
} ,
36
35
'Author' =>
37
36
[
38
- # original sap_soap_rfc_system_info module
39
- 'Agnivesh Sathasivam' ,
40
- 'nmonkee' ,
41
- # repurposed for /sap/public/info (non-RFC)
42
- 'ChrisJohnRiley'
37
+ 'Agnivesh Sathasivam' , # original sap_soap_rfc_system_info module
38
+ 'nmonkee' , # original sap_soap_rfc_system_info module
39
+ 'ChrisJohnRiley' # repurposed for /sap/public/info (non-RFC)
43
40
] ,
44
41
'License' => MSF_LICENSE
45
42
)
46
43
register_options (
47
44
[
48
- OptString . new ( 'PATH' , [ true , 'Path to SAP Application Server' , '/' ] )
45
+ Opt ::RPORT ( 8000 ) ,
46
+ OptString . new ( 'TARGETURI' , [ true , 'Path to SAP Application Server' , '/' ] )
49
47
] , self . class )
50
48
end
51
49
@@ -59,23 +57,23 @@ def extract_field(data, elem)
59
57
def report_note_sap ( type , data , value )
60
58
# create note
61
59
report_note (
62
- :host => rhost ,
63
- :port => rport ,
64
- :proto => 'tcp' ,
65
- :sname => 'sap' ,
66
- :type => type ,
67
- :data => data + value
68
- ) if data
60
+ :host => rhost ,
61
+ :port => rport ,
62
+ :proto => 'tcp' ,
63
+ :sname => 'sap' ,
64
+ :type => type ,
65
+ :data => data + value
66
+ ) if data
69
67
# update saptbl for output
70
68
@saptbl << [ data , value ]
71
69
end
72
70
73
71
def run_host ( ip )
74
72
75
- print_status ( "[SAP] #{ ip } :#{ rport } - Sending RFC_SYSTEM_INFO request to SAP Application Server" )
76
- uri = normalize_uri ( datastore [ 'PATH' ] + '/sap/public/info' )
73
+ print_status ( "[SAP] #{ ip } :#{ rport } - Sending request to SAP Application Server" )
74
+ uri = normalize_uri ( target_uri . path , '/sap/public/info' )
77
75
begin
78
- res = send_request_raw ( { 'uri' => uri } , 20 )
76
+ res = send_request_cgi ( { 'uri' => uri } )
79
77
if res and res . code != 200
80
78
print_error ( "[SAP] #{ ip } :#{ rport } - Server did not respond as expected" )
81
79
return
@@ -93,14 +91,12 @@ def run_host(ip)
93
91
# create table for output
94
92
@saptbl = Msf ::Ui ::Console ::Table . new (
95
93
Msf ::Ui ::Console ::Table ::Style ::Default ,
96
- 'Header' => "[SAP] ICF RFC_SYSTEM_INFO" ,
97
- 'Prefix' => "\n " ,
98
- 'Postfix' => "\n " ,
99
- 'Indent' => 1 ,
100
- 'Columns' => [
101
- "Key" ,
102
- "Value"
103
- ] )
94
+ 'Header' => "[SAP] ICF SAP PUBLIC INFO" ,
95
+ 'Prefix' => "\n " ,
96
+ 'Postfix' => "\n " ,
97
+ 'Indent' => 1 ,
98
+ 'Columns' => [ "Key" , "Value" ]
99
+ )
104
100
105
101
response = res . body
106
102
0 commit comments