rapid7/metasploit-framework — pull request #1786 by jvazquez-r7 (2013-05-01 19:13:47+00:00)
Title: Fix SAP modules, mainly to make a better use of send_request_cgi

After being proceeding with testing of the auxiliary/scanner/sap/* modules, there are some modules, mainly trying to speak with /sap/bc/soap/rfc, which are failing on because of the use of send_request_raw, mainly because the Content-Length header is sent twice which results in a 400 error response. The error could be due to the last changes around the http libs, or maybe just to some type of SAP weird behavior. Anyway attaching test for the modified modules:

* sap_soap_rfc_ping

```
msf auxiliary(sap_soap_rfc_ping) > reload
[*] Reloading module...
msf auxiliary(sap_soap_rfc_ping) > run

[*] [SAP] 192.168.172.179:8042 - sending SOAP RFC_PING request
[+] [SAP] 192.168.172.179:8042 - RFC service is alive
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
```

* sap_soap_rfc_read_table

```
msf auxiliary(sap_soap_rfc_read_table) > run

[*] [SAP] 192.168.172.179:8042 - sending SOAP RFC_READ_TABLE request
[*] [SAP] 192.168.172.179:8042 - got response

[SAP] RFC_READ_TABLE
====================

Returned Data
-------------
ADMIN hidden
ADSUSER | hidden
ADS_AGENT | hidden
DDIC | hidden
DEVELOPER | hidden
J2EE_ADMIN | hidden
J2EE_GUEST | hidden
ROOT | hidden
SAP* | hidden
SAPCPIC | hidden
SAPJSF | hidden
TOOR | hidden

[+] [SAP] 192.168.172.179:8042 - Data stored in /Users/juan/.msf4/loot/20130501124759_default_192.168.172.179_sap.tables.data_715747.txt
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
```

* sap_soap_rfc_susr_rfc_user_interface

```
msf auxiliary(sap_soap_rfc_susr_rfc_user_interface) > run

[*] [SAP] 192.168.172.179:8042 - Attempting to create user 'MSF' with password 'msf1234'
[+] [SAP] 192.168.172.179:8042 - User 'MSF' with password 'msf1234' created
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
```

* sap_soap_rfc_sxpg_call_system_exec

```
msf auxiliary(sap_soap_rfc_sxpg_call_system_exec) > run

[*] [SAP] 192.168.172.179:8042 - sending SOAP SXPG_COMMAND_EXECUTE request
[*] [SAP] 192.168.172.179:8042 - got response

[SAP] SXPG_CALL_SYSTEM
=======================

Output
------
[ -T timestamp option ] [ -Q tos ] [hop1 ...] destination
[-M mtu discovery hint] [-S sndbuf]
[-p pattern] [-s packetsize] [-t ttl] [-I interface or address]
External program terminated with exit code 2
Usage: ping [-LRUbdfnqrvVaA] [-c count] [-i interval] [-w deadline]

[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
```

* sap_soap_rfc_sxpg_command_exec

```
msf auxiliary(sap_soap_rfc_sxpg_command_exec) > run

[*] [SAP] 192.168.172.179:8042 - sending SOAP SXPG_COMMAND_EXECUTE request
[*] [SAP] 192.168.172.179:8042 - got response

[SAP] SXPG_COMMAND_EXECUTE
===========================

Output
------
[ -T timestamp option ] [ -Q tos ] [hop1 ...] destination
[-M mtu discovery hint] [-S sndbuf]
[-p pattern] [-s packetsize] [-t ttl] [-I interface or address]
External program terminated with exit code 2
Usage: ping [-LRUbdfnqrvVaA] [-c count] [-i interval] [-w deadline]

[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
```

* sap_soap_rfc_system_info

```
msf auxiliary(sap_soap_rfc_system_info) > run

[*] [SAP] 192.168.172.179:8042 - sending SOAP RFC_SYSTEM_INFO request
[*] [SAP] 192.168.172.179:8042 - Response received

[SAP] SOAP RFC_SYSTEM_INFO
==========================

Key Value
--- -----
Central Database System: ADABAS D
Character Set: 4103
Database Host: NPLHOST
Float Type Format: IEEE
Hostname: nplhost
IPv4 Address: 192.168.234.42
IPv6 Address: 192.168.234.42
Integer Format: Little Endian
Kernel Release: 720
Machine ID: 390
Operating System: Linux
RFC Destination: nplhost_NPL_42
RFC Log Version: 011
Release Status of SAP System: 702
System ID: NPL
Timezone (diff from UTC in seconds): 0

[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
```

* sap_soap_th_saprel_disclosure

```
msf auxiliary(sap_soap_th_saprel_disclosure) > run

[*] [SAP] 192.168.172.179:8042 - sending SOAP TH_SAPREL request

[SAP] System Info
=================

Info Value
---- -----
DB version SQLDBC 7.8.1.020
OS Kernel version Linux GNU SLES-9 x86_64 cc4.1.2 use-pr101108
SAP Version 720_REL
SAP compile time Feb 13 2011 20:27:41
SAP patch level 80

[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
```

* sap_soap_rfc_dbmcli_sxpg_call_system_command_exec

```
msf auxiliary(sap_soap_rfc_dbmcli_sxpg_call_system_command_exec) > run

[*] [SAP] 192.168.172.179:8042 - sending SOAP SXPG_CALL_SYSTEM request
[*] [SAP] 192.168.172.179:8042 - got response
[*] [SAP] 192.168.172.179:8042 - sending SOAP SXPG_CALL_SYSTEM request
[*] [SAP] 192.168.172.179:8042 - got response

[SAP] SXPG_CALL_SYSTEM dbmcli Command Injection
===============================================

Output
------
>;!id
uid=1001(npladm) gid=100(users) groups=100(users),1000(sapsys)

[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
```

* sap_soap_rfc_dbmcli_sxpg_command_exec

```
msf auxiliary(sap_soap_rfc_dbmcli_sxpg_command_exec) > run

[*] [SAP] 192.168.172.179:8042 - sending SOAP SXPG_COMMAND_EXECUTE request
[*] [SAP] 192.168.172.179:8042 - got response
[*] [SAP] 192.168.172.179:8042 - sending SOAP SXPG_COMMAND_EXECUTE request
[*] [SAP] 192.168.172.179:8042 - got response

[SAP] SXPG_COMMAND_EXEC dbmcli Command Injection
================================================

Output
------
>;!id
uid=1001(npladm) gid=100(users) groups=100(users),1000(sapsys)

[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

* sap_soap_bapi_user_create1

msf auxiliary(sap_soap_bapi_user_create1) > run

[*] [SAP] 192.168.172.179:8042 - Attempting to create user 'MSF' with password 'msf1234'
[+] [SAP] 192.168.172.179:8042 - User 'MSF' with password 'msf1234' created
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
```

* sap_mgmt_con_abaplog: was working, just printing the path where the loot is stored

```
msf auxiliary(sap_mgmt_con_abaplog) > run

[*] 192.168.172.179:50013 [SAP] Connecting to SAP Management Console SOAP Interface
[*] 192.168.172.179:50013 [SAP] ABAP syslog downloading
[*] 192.168.172.179:50013 [SAP] Storing looted SAP ABAP syslog XML file
[+] 192.168.172.179:50013 [SAP] SAP ABAP syslog XML file stored at /Users/juan/.msf4/loot/20130501133926_default_192.168.172.179_sap.abap.syslog_177904.xml
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
```

* sap_soap_rfc_brute_login

```
msf auxiliary(sap_soap_rfc_brute_login) > run

[*] Brute forcing clients 000,001,066

[SAP] Credentials
=================

host port client user pass
---- ---- ------ ---- ----
192.168.172.179 8042 001 SAP* 06071992
192.168.172.179 8042 001 SAP* PASS
192.168.172.179 8042 001 SAP* 06071992

[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
```