SAP Smashing (Internet Windows)

 It is designed to analyse and restrict SAP network traffic, which is allowed to pass through the firewall.

The SAProuter can be used for:

• Filtering requests based on IP addresses and/or protocol.
• Logging connections to SAP systems.
• Enforcing the use of a secret password for communications.
• Enforcing transport level security using Secure Network Communications (SNC).

From SAP:

'' SAProuter is an SAP program that acts as an intermediate station (proxy) in a network connection between SAP Systems, or between SAP Systems and external networks. SAProuter controls the access to your network (application level gateway), and, as such, is a useful enhancement to an existing firewall system (port filter).

Figuratively speaking, the firewall acts as an impenetrable wall around your network. However, since particular types of connections need to penetrate this wall, a “hole” has to be made in the firewall. SAProuter assumes the control of this hole. In short, SAProuter provides you with the means of controlling access to your SAP system.

In 2010 Mariano Nunez from Onapsis gave a presentation at Hack in the Box titled The SAProuter – An Internet Window to your SAP Platform. If you haven’t seen this material before, I suggest reading it before continuing, it provides a very good overview of the SAProuter.

During his presentation Mariano eluded to the fact that it is possible to route native TCP connections through the SAProuter. He also mentioned that two Bizploit plugins would be made available to detect if native connections are possible (saprouterNative) for a given SAProuter and that could be used to establish native proxy connections (saprouterAgent). Unfortunately Mariano to this date has not released the plugins. However today Onapsis have just released a new white paper focussing on the SAProuter and a new version of Bizploit is due very soon (which I believe will include these plugins and some more goodies). However I had need of these, so had to write them myself.

After many Google searches and traversing the forums at the SAP Developer Network, I could not find any documentation or references on how to establish such a connection. In fact many of the posts on the subject actually stated that only SAP OSS (Online Service System) teams had this capability.

I found a resource that details how connections should be established. The resource details the construction of the route message.

A second resource details the operation modes/talk modes. Native connections are not discussed or referenced. However the NI_RAW_IO mode description was enticing.

'' The NI_RAW_IO mode is used to communicate between SAP applications without any further interpretation of the data blocks.

To demonstrate native routing a small PoC was crafted. A SAProuter instance is started on the host 192.168.1.21 with an ACL that permits ANY source to ANY destination host using TCP port 23.

A netcat listener is started on the remote host (10.0.0.1) on TCP port 23.

The SAPcat.rb script is then executed on the local system.

Lets check the logs on the SAProuter.

Metasploit supports HTTP and Socks proxies, so I added support for NI proxies (SAProuter). Now we can execute Metasploit modules through the SAProuter against systems behind the SAProuter. An example execution is presented below. The auxiliary module ssh_version is being executed against the host 10.0.0.1 via the SAProuter 192.168.1.21.

We can even get Meterpreter to work through the SAProuter.

Unfortunately not all Metasploit modules will ‘honour’ the proxy settings for example the auxiliary ssh_login module does not. From the “Metasploit Acceptance Guidelines” specifically the Hacking Guide:

'' 4. Always use Rex sockets, not ruby sockets. This includes third-party libraries such as Net::Http. There are several very good reasons for this rule. First, the framework doesn’t get notified on the creation of ruby sockets and won’t know how to clean them up in case your module raises an exception without cleaning up after itself. Secondly, non-Rex sockets do not know about routes and therefore can’t be used through a meterpreter tunnel. Lastly, regular sockets missout on msf’s proxy and ssl features.

I’m sure there are more and I intend to ‘fix’ any that I need going forwards, but feel free to have a play and let me know of any modules that do not play nice. I’ll be submitting the patch to Metasploit; however if you want to try it out for yourself now, it can be downloaded from here here. I’ll also be releasing some more modules very soon that can be used to port scan systems behind the SAProuter and retrieve the connection table from a SAProuter, these will be released shortly after I demo them at SEC-T.