Skip to content

Releases: OWASP/pysap

pysap v0.1.19

29 Apr 15:56
Compare
Choose a tag to compare
  • Using Scapy version 2.4.4.
  • pysap/SAPSSFS.py: New module for SAP Secure Store in File System file format.
  • bin/pysaphdbuserstore: New script for interacting with hdbuserstore SSFS files.
  • requirements-examples.txt: Renamed to match setup.py's extra.
  • pysap/SAPHDB.py: Implementation of GSS-based auth method with Kerberos 5.
  • pysap/SAPHDB.py: Handling of Session Cookie values when found in the CONNECT response.
  • pysap/SAPRouter.py: Add support to route string in SAPRouterNativeProxy. (#33) Thanks @gloomicious!
  • examples/router_fingerprints.json: New fingerprints for SAP Router version 7450.34.25.5091. Thanks @jvis!
  • examples/router_portfw.py: Add support to route string. (#33) Thanks @gloomicious!
  • tests/sapssfs_test.py: Basic unit tests for the SSFS file format.

pysap v0.1.18

15 Jul 17:08
Compare
Choose a tag to compare
  • Using Sphinx 1.8.5 for documentation.
  • Replaced AppVeyor and Travis builds with GitHub Actions.
  • Added cryptography as required library instead of optional requirement.
  • Replaced the use of deprecated optparse module for argparse across all tools and examples.
  • Fixed some PEP8 warnings across modules and example scripts.
  • pysap/SAPCAR.py: Added signature manifest file type.
  • pysap/SAPHDB.py: New module for SAP HANA SQL Command Network protocol packets, authentication methods and connection classes.
  • pysap/SAPNI.py: Disconnect clients in SAPNIServer if socket errors are catched.
  • pysap/utils/crypto: Added implementation of SCRAM algorithms for use in HDB authentication.
  • examples/hdb_auth.py: New example script to illustrate the use of the different authentication methods in HDB.
  • examples/hdb_discovery.py: New example script to perform discovery of HANA database tenants.
  • examples/diag_login_brute_force.py: Handling valid users (e.g. no dialog users) vs valid passwords. Thanks fabhap!
  • examples/diag_login_brute_force.py: Fixed discovery with right message match ("Client does not exist").
  • examples/default_sap_credentials: Added a couple of default credentials from trial versions.
  • tests/crypto_test.py: Testing output of SCRAM algorithms.
  • tests/saphdb_test.py: Basic unit tests for the HDB protocol.
  • tests/sapni_test.py: Arranged and fixed a couple of tests that were failing on macOS and Windows.

pysap v0.1.17

05 Nov 18:43
Compare
Choose a tag to compare
  • Using Scapy version 2.4.3.
  • Added documentation of projects using pysap.
  • Added documentation of all example scripts.
  • bin/pysapcar: Add cli option to determine output directory when extracting archives with pysapcar (#24) Thanks @okuuva!
  • pysap/SAPDiag.py: Added support bits for SAP GUI 7.50 and SAP NW 7.52 SP01.
  • pysap/SAPCAR.py: Fixed crafting of archive files by defaulting length fields to zero (#22) Thanks @okuuva!
  • pysap/SAPMS.py: Added the DPInfo[1-3] packets for handling specific Message Server ADM packets relaying Dispatcher/WP info: [1-3] because of tight SAP kernel version dependency. (#31) Thanks Mathieu (@gelim) and Dmitry (@_chipik)!
  • pysap/SAPRFC.py: Enhanced with mainly SAPCPIC* and SAPRFXPG* new packets. (#31) Thanks Mathieu (@gelim) and Dmitry (@_chipik)!
  • pysap/SAPRouter.py: Fixed padding on SAPRouter client info packets.
  • examples/rfc_monitor.py: Renamed the script to gw_monitor.py.
  • examples/router_scanner.py: Add capability to provide a comma separated list of targets/ports to scan.
  • examples/list_sap_parameters: Updated recommended values and added new parameters.
  • examples/ms_dump_info.py: Added NOTEQUAL check type.
  • examples/router_fingerprints.json: Added fingerprints for SAP Router 7.49 and 7.45 kernels.

pysap v0.1.16

21 Jun 22:57
2b2d842
Compare
Choose a tag to compare
  • Using Scapy version 2.4.0.
  • Using Sphinx 1.7.4 for documentation.
  • Added missing pysap.utils package in source/binary packages.
  • Use flake8 to find syntax errors and undefined names in Travis (#20) Thanks @cclauss!
  • pysap/SAPCAR.py: Improved SAPCAR files parsing, adding proper structure names based on VSI documentation.

pysap v0.1.15

27 Mar 20:00
Compare
Choose a tag to compare
  • Version released at Troopers'18
  • Added initial support for handling IGS (Internet Graphic Server) packets along with example scripts to play with them (#19) Thanks @iggy38!
  • Added initial support for handling PSE and SSO Credential format files.
  • bin/pysapgenpse: New binary tool for working with PSE and SSO credential files.
  • bin/pysapcar: Added options for creating a new archive and appending files to an existing one.
  • pysap/SAPCredv2.py: New module for SSO Credential files definitions and decryption logic.
  • pysap/SAPDiagItems.py, extra/parsesupportbits.py: Corrected order of support data bit fields (#19). Thanks @hnzlmnn!
  • pysap/SAPIGS.py: New module for IGS packets layer (#19).
  • pysap/SAPLPS.py: New module for LPS definitions and INT/DP API decryption logic.
  • pysap/SAPMS.py: Added Message Server Domain field, MS J2EE Cluster/Header/Service packets. Thanks Albert Zedlitz!
  • pysap/SAPPSE.py: New module for PSE files definitions and decryption logic.
  • pysap/utils.py: Moved utils classes into a package.
  • examples/diag_login_brute_force.py: Detect invalid clients while logins (#17). Thanks @hnzlmnn!
  • examples/dlmanager_decrypt.py: Replaced use of PyCrypto with Cryptography library.
  • examples/igs_*.py: New example scripts to interact with IGS services (#19).
  • examples/rfc_monitor.py: Added noop command in the monitor and version command line option.
  • examples/ms_*.py: Added command line option to specify Message Server Domain.
  • extra/pse2john.py: New extra script to extract crypto material in John the Ripper format.

pysap v0.1.14

04 Oct 19:25
Compare
Choose a tag to compare
  • Added initial support for handling SNC frames and some of their fields.
  • pysap/SAPNC.py: Added fields for SNCFrames and helper wrapper/unwrapper functions.
  • pysap/SAPRouter.py: Fixed route request for more than one SAP Router when using the native proxy.
  • pysap/SAPRouter.py: Allow route strings to use lowercase separator chars (e.g. "/h/host/s/port").
  • pysap/SAPRouter.py: Allow a SAPRoutedStreamSocket to bypass the NI layer if no route was specified but talk mode
    was set to raw (#10).
  • pysap/SAPRouter.py: Enhanced the version retrieve routine by not failing when an error is returned by the server
    (#11). Thanks @gelim!.
  • pysap/SAPRouter.py: Fixed missing eyecatcher in control messages (#10).
    Thanks @gelim!.
  • examples/diag_login_screen_info.py: Script was improved by better printing technical information and
    outputting login screen text items (language, input fields, login text) (#14).
    Thanks @gelim!.
  • examples/diag_login_brute_force.py: Script was improved to handle currently logged in users
    (#16). Thanks @hnzlmnn!.
  • example/router/admin.py: Improved client list table display and fixed timestamps (#12).
    Thanks @gelim!.
  • examples/ms_dump_param.py: New example script to list Message Server parameters and check them against a list of
    expected values (#15). Thanks @iggy38!
  • examples/ms_dos_exploit.py: New example script to check for CVE-2017-5997
    DoS vulnerability on Message Server and fixed at SAP Note 2358972
    (#10). Thanks @vah13 and @gelim!

pysap v0.1.13

16 Feb 20:59
Compare
Choose a tag to compare
  • Documentation now includes graphical representation of the main packets of each protocol.
  • Example scripts now accept route strings without requiring remote host option.
  • pysap/SAPRouter.py: Fixed route request for more than one SAP Router.
  • pysap/SAPEnqueue.py: SAPEnqueueStreamSocket now can connect to an Enqueue server through a SAPRouter.
  • examples/router_niping.py: New example script that implements a very basic
    version of the niping tool. It works on client or server mode.
  • examples/enqueue_monitor.py: The script now accepts route strings for connecting through a SAPRouter.

pysap v0.1.12.1

20 Dec 00:48
Compare
Choose a tag to compare
  • Minor release.
  • Source build didn't included header files and thus builds from pip source were failing.

pysap v0.1.12

16 Dec 19:46
Compare
Choose a tag to compare
  • Using Scapy version 2.3.3.
  • Minor fixes and code arrangements.
  • Building and testing in OSX with Travis and Windows with Appveyor.
  • pysap/SAPDiagItems.py: Added default support bits from SAP GUI 7.40 version.
  • examples/diag_capturer.py: Added option to display available capture interfaces.
  • examples/enqueue_dos_exploit.py: New example script to check for CVE-2016-4015
    DoS vulnerability on Standalone Enqueue Server and fixed at SAP Note 2258784
    (#6). Thanks @vah13!
  • examples/router_fingerprints.json: Added fingerprints from SAP Router releases 745.

pysap v0.1.11

12 Oct 15:06
Compare
Choose a tag to compare
  • Some documentation improvements. Hosting the documentation in Read the Docs.
  • ChangeLog file in Markdown format for better documentation.
  • Improvements over the pysapcar tool, general fixes and added handling of multi-block SAP CAR archive files. Thanks
    Hans-Christian Esperer for the feedback!
  • pysap/SAPDiag.py: Splitted SBA/SFE/SLC fields.
  • pysap/SAPDiag.py: Renamed error flag to error number.
  • examples/diag_capturer.py: Fix imports for running diag capturer example script in Windows.
  • examples/diag_login_brute_force.py: Added SOLMAN default
    credentials and improved reading credentials file.