Nicob
16/11/06, 02:41
--=-T6xqwht+p0Ivl/TpCyvB
Content-Type: multipart/mixed; boundary="=-qiw3RWTPsIi/H12yTirt"
--=-qiw3RWTPsIi/H12yTirt
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable
For historical purposes only (everything should compile/run fine). An
TGZ archive is attached to this email, and a mirror is available on my
website : http://nicob.net/mirrors/sap_sploits.tgz
o testing users and passwords with RfcOpenEx (account locking bypass) :
- allow networked attack on SAP passwords
- now deprecated in favor of THC Hydra
- need the RFC SDK to compile
- port : TCP/3300+SYSNR
- exploit : sapchk.c
o customized RFC_SYSTEM_INFO (information disclosure) :
- will leak OS type, SAP version, real IP address, ...
- need the RFC SDK to compile
- port : TCP/3300+SYSNR
- exploit : sap-banner.c
o original Win32 gwrd bug by FX (remote command execution) :
- patched in 4.6D patch 1767 and 6.40 patch 4
- partial control on a CreateProcess() call
- can be used for "cmd /c ..." evil
- port : UDP/3300+SYSNR
- exploit : r3mote_win_UDPexec.pl
o linux port of the gwrd bug (remote command execution) :
- patched in 4.6D patch 1767 and 6.40 patch 4
- partial control on a execve() call
- each argument but the first must be max 8 characters long
- exploitable remotely under some conditions
- port : UDP/3300+SYSNR
- exploit : r3mote_unix_UDPexec.pl and r3mote_unix_wrapper.sh
o two bytes UDP crash in enserver.exe (remote DoS) :
- patched in 6.40 patch 6
- port : UDP/64999
- exploit : SAP_WebAS_UDP_DoS.c
- no, that's not related to the DoS published earlier this month
With many thanks to security@sap.com, the OaiTeam, FX from Phenoelit and
all the valuable Darklab members.
Nicob
--=-qiw3RWTPsIi/H12yTirt
Content-Disposition: attachment; filename=sap_sploits.tgz
Content-Type: application/x-compressed-tar; name=sap_sploits.tgz
Content-Transfer-Encoding: base64
H4sIAKAEV0UAA+w8a3PayLL71fyKjuIkYPOQwI+NHXKX2CRxrY NdYCe7ZbsoIQ2gWEhcSdiw2dzf
frtnRtIIcPzaZM+pilI4aKanu6ennzMSQW3kR6w78Zxp93T/mE2ZVR67v/yjl47Xtq7T/8b2ZuZ/
uqqb29VfDH2zWt3Y3jY2jV90Y6NqbP4C+j/LxvJrEkZmAPCL51h+7xtwt/X/l15Pn1QmYVDpOV5l
zAIXSte5Scjg4Ghnp+NblyzazeWewimqB1yxIHR8D/w+REMGb/+ATuMY2pUaDK4DG64mrlfOPUXo
TwzGZhA5puvOwPK9KPBdMMHCe4h8YFPriuULMDJtBr0ZuJ45tU eV0ByHsxCHN83QwYFsOnZ9JzJ7
LoNrJxqC6yMGMC2LhQS2509cG3oMbN9jEDDSYxw28WwWQOiPGJ G2nQhZDjlbVV2vFYltnMDxkHk+
c50IXvWnv43ju7LNXkP+k+PVquAHzsDxkKLl26wgxm8WoUV6AK +4OvzG/5Y9FuEoVUYInsut/l03
UHq2w0B751wx6Dsu88wR05BJFycB+VXLH41Mz66HQ6cfFXYVYD MYGAogCtQcGcvhavNwtSxcA1Gh
4H2UoDfQwOlDHhkZRMMYbQFew68KdO1b0LUMNOdh6IeRwgPdJh zkVsd+ENW1Ws3YVvmkxhQmYP87
YWEEdcitaOdT3dDK4kuVf3mTXI+8za08hQ4jxSDBCW1kXB2p51 ewhmYQ8pnnVqRwCAdoMIX8r1CC
OcEVsBf7u3ryTxJ5608C1Nk7Eql9g0iNiBANI/nXrcb/YmpOgMJbQuzUc51RxGyJsggMZ86t6Zmu
I3Wpf2USta7hSjwPEYIigVjGIl8oWiI2RWPR8Us46UEMBF9ygN doBqvCAHfTe9fxlFsbVze9I6SI
im7zvEvSwfX/rSs7JEao8ztQXNLOzkGreVJ67bHr/HHgR379tTaxx1rxmLGgYdtB/bVASvfHpGiv
NY5fKxYED4kaChoF+AJcmy3T8/wIBixCD0KkoO8HgnkNvqpslV6bk8jvu5NwmDck1nHgeFHCd6zT
cjqW64csFdPX3L/t+cUVKPH/OjDHGATK4fCfpXFr/Ndl/N9ED71Ro/hf29z6Gf9/xIXxn2J/OKQw
/9EMHIq3IY/5bhSYEA7RbuC0fQjXQxYwcEIeh8mloIcD0xYRVoZJHPbBnEpnA zuJr8t12nt17a+/
ykb5aqAR9rcyFsbZhO1fe66PGYHNw+Q8oi2JKN9jlkkJCg7TSk cYnjy4RnMt5N4eHDbrWrlSLpc5
gRP0hmi/lKKELMC4DAfH2NzyMVUIo8CxiG3YLRVyJ432u+ZJXTNeVsvG1q/lqm6UDYMj6SAG9Khc
RMwa+nRjs95kkNtvvjl9V9cI6uEXUsheHUpbVlFYQBxeiryFBC EEaVoR5heYSHmU96AY7CL6KZj5
E95GcuG+nSQCO3xwCUxvhlMnQZGcA9MbcOkZZZ3+lTbL1Q38VD fK1c3N3NOVEmh8+Et5aZDH0Rmo
QoJXaAcFCr6WrnPJ4IVc5hcKsmTlaeCQTYkh0w7IB6N/Ja+JDSNnymRwQpv0bBOTSuahWjkYKAkX
R2Ug09OaYUCevpVrZWO7kOnd/nUz2/eI9UF+96ViFnEFRj6mDRhAXXPiWRjcIbQCZxyRepjBjKQ6
I6NARXEsxpVwNnYsbhs8zPLQHE3IeIROlkIHc2BcKVDFBJgKD6 6NbSgdmT0L3n16f9Q5qVuYUiMS
vO002x/rMczeUevjwX6dg2IixfUSuK5qMesoP0UvuIFIuHIlWFr/CUiuiKWjVTItWBVmkpAIXcbG
YFR1mKO6R2IqEc0ldn036kLS25ub8C3a1TnCTRw9iWLCd6cmaE ynU/6ZpyVwd4ZxtaFfezUbPP9a
IM/9h8Txh15SJteO993K/1vj/3Y1if/V2haP/7rxM/7/kOtO9T8V5dy4WMhtK3ZnAyz+PDBDNDZZ
f0xGDJ05tmC5P3TQYsaBb3E33wfEwjcKMBJhhY2OIeSbB8y7cg Lfo4FhGdqyEBybPP0emTOgjJx2
EUwcGGI7JQdJNIS8Pq3qhTKcKHxhQGHBOGDUP8IFBr935fiT0J 2RBaNvcfoOOiTEQ+m9j1NCPKet
gz8KWW7us22gVPwYsjv7LXR9FheHGcldk72AYeJ0LCSSL3C/P4yi8U6lMgptrzxyrMAP/X5UxolU
XKcXYFSpMK80CSu265IoKz0zZBWLI5KiLZvhWN1lkEK40ybDtw r3pG7HwvDGuj1G/X9hBSpYQ76s
DO5Qzp9PNwz8VPFTi3tikKoet+jxRzZs6nf5xMDGXT4xcPUunx i4dpdPDLwhPvrLb304cONuUDdf
qshisdE2mbAJzFxR9x3vM2YglDdyu0h2A54/h9DxLAxvOBBoHNrOCNMarru2j4ZPZnjtB5dAdQBy
Yo1svuAW/c1r5XQvoSC41Z4/5yzTtsLPfYX/0H0FTCNLPeQOy37r+0QYEf+3boz/xlZ1ezOO/7Xq
9gbG/2q1avyM/z/iCik8WTyeYjVjYT1ydoHWov2Wf1qA1QN7ByoUcyobW/uVMLAql4FXCfoW7dY7
Xt8vW08NWKUqm6y8sganoYn15c6KuNYq1FaupFqGuQGPMrxA08 tVCGehF9R1iKFXMkPRe40dl3L6
LMr20dFJvTLEcrnCF6aCHBBfoX1ZQvDJNAU9aO0dnu4366s0po JOzp3YrKLgOjx4Izsx5FZUKgPL
AigdrEoUUDpcRWBQbQZKPt33vABKLjKAf23MotwRocg9leTgVR jZjl8evs42IcH5NrT1QbbNimZj
lmnSkCLSKg81pY1m71BT7sp3bNg/POzuNfDPm8be7923p629k4OjFiBUlwWBH+TFmq+Bj3mfcPPk
jqU+cBS2E45dc9blmPPQfrvXOcAB/JaAVdghc8d58ZXQIGy32W4ftbsHrbdH3eYfAJxql5QG+0eY
zOV54Y9Jo1WUvKzR3RUUctz9cxytj+r+CHrmLmZou3H3+0ZrH2 u3+Bpi+HFZ0ovVq3rR1AMr6T1u
tBsfmifNtuhlU/LkKPyzWvXiJiBntAzopPFGYQL4kVWoQqDY5jkJHd7J561ea3Q8 xsa0Ht1xFKAp
tk4PD4s5WHp9FMdNbyb9PgvOqptbF8XcyorAg6OVG1P53ou/Y2gZdXuTPo7cvkgbMdn2MEvo8uOH
M0OvblyIYEPrNXc5RfhcpH06ZbjrYNbb7fsTzC4AZ6CnfVhbBE nPXN/YDMNre/k41/QGE/QssrfO
M4Zl8gNAs+oKFs42uCurbelaiom6iYszo3ZBRLRT7xKreW8OhJ g5e3kBAiRkFNfnQIins5oEabY0
KaM+5Emn4RVUC9QgUhlhIDKgA5Ymk8ADg99+5ePQ3ZTud+XEch 54aIeuK+xLmkAg++6FDx0WJCZW
RpR8n1dq4K7ax0lJStif+BSh732rmRZReXguR3G/8JiJHk+oLESVZHwXtB/4o6Tiw+wW6R6Nmdec
lo4JqPxwEcCIjUIW5TN2UER1xBz5L+b3sx2FOEvj1prpEh2U6u UdrAzBeUWagf+vr3PViHWD7AfH
ovPHL6Q9V2fOhRSXkNjekFmXGCuxmpxSKSnJkNdWRCLZJ1NCdH kyjrUCTsYaBjHWIryov+AGG+si
11gaIBa6IFu/JC4no7nzypvor+Dzo+libgrXQ8caQhyaemgpl6GoOLAGQdHSHo BG+2cKy71vsAzL
WO7Ns0xmGVjjWV54tSKkkhTdzA3ZwvTkYsdj0lUWLQVl5lys+G c9nXy8dthaiuntqriX8JOdS+KE
sZH81Qvtxe7yCa0jxLpRRFqLg6XuSJ7n8KgrtOePZ+TI/ayqklIlFpSuSkwfY4mklJAW+k5/12PN
xZukew1v1teJD3ihanJnzCzHdIWjosSOzINOaVx/gNrMq1Gb9c2JG4FtRmbKC7ejz3V9Fz6/yuMM
CgsGA59jw6IFXpGumPrOPl+QtqDuF3LownsBMy9TGapAQgcL6F EmdBiqICgsiJMI0BKPxqmuanuH
B83WSV0rwmaBaOqpemYiYz1VItLL5chOO832UlRKIL0TouNGp/Npn1Btz6PKxN07ITtstN4tRbUQ
piUyKTFc/pYvF9riHs2M4Oi42YLIGbF4paXOZdRzXS511vMSK3vvm3u/13Utdpe8BmGJCgliXJFw
KiMnDEnnJCWaXHZNlNmEvOzu35EPkMv+DLMEJQWROkOE1BV7OB muEAkRwqmQyK7kw4lIZUnIEF6F
zPwqP5wQV6SEDOGVyyjRaMciuAUYU2wmPNaUgt4OnHvPwnPM2r JuTHD54BSD3J8SWx+eQojkCA0g
8alz2cQNCf3ztEoqpPlkjK2uFD3dJPLJUBaL7Nx7F6DvkgibPC sc8JZnNoorJVDmrbFXS4f/zmYJ
P3xtlCGXbLY44APmxlT1iwF8UZQhI9EbD6P9vnhn62tmrc+9zo Qe7oMniOLRyWKSFT1wEbnsk3JP
vyjzE27M9Hk9hxXt8VH7RNtdBBP5gFFd7DJtm0Lm87T8y3TTww 6UBYrsgwMVFqFoMwC4Ipz8edzs
7r1vtDlQFtBI+E2S97TA1Rc7Zc0a9wAknY9ahT0qTJBV6E+8R1 qUqN6FRRHaNrOYc8Xy0tSKfGG6
nT87J80PfNNBK0rW7zby+KD1DhUXidH+D6gCKyZNiYDTJiG59P 55tn4vpIvTz8esPBGGfPQ7qAZM
lp6PmRUQzT/2mse0b1OAv/9OXcYcFE5agUyisbLVs4ynTDqsAmtZOWkS/mvqpXLKYMn8A1WElGFf
bDPRczkYscOk/QFKgtfcptXzZLcKHl1p7/Gt9n8iPJCECVmsg3FtLEsrfTf3ldikXTLSyPtsy+W+
5J5i8uN4DI5OT/IQsWlUhCuqy6AA5znFdYP2rFSthvCsVF4TblsAy+Ra8UOl1xwB xmz1FokppP7I
0CrSo2HfJBiHittpnudWpIomrTgA8RcUDlqHB61mSghRK53vm4 39ZlswGDOV8oR83FMhzj3OumAs
T1iJFT5Vzsfu/NeYAY0qnc4sjNgIDjA6BiO+9RrbmDqEr562z8JIHsNpXPp0ZrQ EmpyHFBD+R1vs
VfTm5Gmw/opdgkD5ng59OS4OFiNTvEEKZ6SAidtQuqtL8IjeeI77AiKchWJ nWJkZ5uR0mi2nRXfh
HMQbcUAtAHoqEwlAyOnEIHiXhTg6JggQ/f54oZ8/h4ZRWQA4Y36TgWiz8Ep2h043oLub1orWNmAu
SyZF2/TunFwQ5pIFHnOzoNSWwi6gphjKjyQvfdcVI8Z0m0W+lzwjKECo ksV8YW7KXsQGtFsk5+xF
CyBvXd/kD1IdlwVQ3/UXgGgmI9Makn05toCj++VzQO+gnWCR95fvyRlH9LVIFpTqrW3i cqZ6C/8D
Wn7fnLnOYBhBaF7xh7sQS0HDCkDTYre5xOi4/8x4SuFIH3w2Is4k4lyV1oNiZKUZR9ad2J9lz1OE
sz80w4hn4lgHLKb4j8rc75m33z9rF7mjTNqFXBNBLQYn9RxICU WtQ+6SVb/bOkQnQfuZO3c6INQQ
hZiCCJL/OY/Q/1dfKHhrePn9zv7p+vb5v761XduOz/83awa2G8YGNv08//8B1/c/oc5xXypfjDvb
5Edyermm/ZDz45sPiO988vqvn6fyYaF6LvrzIO3nQdrPg7R/+SDtg3nJgN66oWOikoWZPAjfyPeQ
bjysik/RxFnVyooku+zoKelCLrkvUNT4Xqd4OCDO+/YmQUCPaCfpasLPdzzzE0ZHIvEYo1dBcP0U
I7vlGC05ZVpRPeH6+gNOz+6NYcmx2b1xNDr8/Z1H4ej82WnxqWzdiCInFDTREzprpQfFR4Txmt7E
4Y/wDs0rJt4E40WVuhLCfynBBqswFF1q4bESfTIdXh5u8uFYzYmdQ hvrFKFTChLSXdXxZTk8Ig88
CUJWJP7Mm88Gn8RMkjrRkd+HJurwAVz7/H1/ZN2Um1xoAn+xwKc3FdEwLBbSq1n03p4T8t8SMC2k
6NHJoHWpnAU+5NTRAE3OKmatYdtcuI03jeOueEdQh75rDhT2D/rccyNL6IKwin53StOg14vo0V/a
ELJMd0bvwAVRkb9vhqt3bXp8iMlTpGjohA9iPMPXPPN0bsp/2aGdHOQ+TDp0qodI5vHv+96LiL+l
KGedyuQT/YID/70ImwPx6Wah7sUCWn5XDJfzjAm9RSfE3+AcKGufOEd+vsiTAen Kbz5n5LNK1Dh7
bijw3noGuOS0Lwe3nfjFDzbM7wYQrKHXeP9KPKGzJxdwyE2qbz ruJGD8ZG0lt/I19TXLEVUXEbVY
xJ//Hwc+2tFIHNLFmOaBO5F401RsE2C0sTGBXLLPwEku2apYEX4CVj LnhTEt6kCxv8El8hE5N300
C0xie75wFQkzEubG4+KVpXvxmU2P7F78N3Y7FFWST2bGM45/FySzByOflRbbH+j5hNuT4SLZ/xCu
X9fF0T8q9Vp8Pk//xc8dGLouFiTD+O07JIiv+4n1Gh167aK773e+w1bALc//b+q1jeT9/42NLaz/
a6iAP+v/H3FV1h578SflH3cJHLShzFURA0XngTj+CT6a4oeH6KeJbvqxnx/Bx+PX5f6vH0w8B5tv
3/AJnYFnutk2StPmoGZhRbzutNhOO0Zhthkl6+Cn4ngL7bbks2+z PnQpuDfaxw0FxgzGZoVGczjm
2U6fv45Cb65RPhEyNpKvwMW/LYC1Kf/5BKyeSeCIHMRmtZ3vdt/8edLsHrX3m+0CvRv3JO5R2pO9
7bQN1IExG3OID951m639g0ZrDnHaniJO2kAduAzxHL9LsSK4wi pGeRWlJMllu4RUKtFrx3UxsaYf
1KBiTgoVC1eM9raQpMRFoaVDT8lAzajVtjPt+7x9a+Ply5ccq0 hrx64Z0ZloKaSHRPsYZYfMpPR+
ZNoeveoqrSv/mXZAxu4EdYt+hySipF+C0nv/YYEAUXEnVgTOePglozrK9CYeaTLiUPcodzaKztDd
2djFadM+RxaIdxUT0N1YNlmoyA930ybxMxmRH3UxWV1od+yFpn 5gDrp+v787jzZy55v4MaDluws4
eDahtNJmY0jnm3Nttmj7uhsLbGKTxOawhVilWWyBiHj9cq5x2S QlNymVcDJSqdzCXXbOuMZ3lwPn
5qt4O63DW8bmjH6Sgn7AAaCKfp7ea8eC6uh3oTbpG3ES8uyiDt r5dLt6Pu0z/jor31FBgsKNQZ6q
NKTaNV0zGHHt4wrt9aKu54dj3+/n1Wlhbpb0L/YW50Dn9cXrWpcovvxc+1px+SgS4wB96zgvdslj
4jwNZbKxqMgyBkgmlC98kcAav6+QryezGzpRWStiqvmVi6TH/r+dq/tt2wbi7/4rlAA1SFt27KDL
Qx15CFpsNYYhRlpgD50ROLbcGIgtwVLqFQP2t+9+d0d9WV69Zs BeRLSORB4/7oPHu6NI8qp4kqJP
jtFnIXqN0COkAdeizDylUTCo434w8BP5O2rl25efOrOyxSBZbt HmLzQIkfWKT+NcX9o/s8qAS3Tr
8VXiXS8TucNm7H1Kdgt+NIOA/JdltLEz2O8tjsQMEIj7diOKDOrl1Qo2OQ3pzAhmwhaGGs6stS1 H
5vVWPJpl/vkHt36xjoXgDrExEKNnmlX0T5q6nPnnOohzax1thzQIeE9Jtef LGQ+riFih299TFyp0
w+S+z7RZWyYIawmp4hkGCJcWlQ13+6N2+Ob8Wsg7PkdYmNVsfT uICniTqTAzA+nO+Kg4PHS9KAIx
cIJYyclpMmJIPHFEUboxEFgzsDJ2N/Ti7GR+6FAK05KzRfwK/dd2VRZNXErZd0JYBWVhGDDVsZpt
o23P0YrxwvUZpIUVt/431YnMExKEojKNoG+dsqUXgNzjCo05ZdN7IKaZufnpHsfe/Q+3b3+5f/fz
3c2v/mQ6vbv9eAuXEDSc9xPSOav5Zv30NVDwLJsvhHhMo21isoU9r4R O+wn/CVSVQ1gJxzQyGICv
KtZ3ewXyantDf+CbyvBJd7WTud9S2EqptdcHjeQzCgEQMVfQu1 eguYcLB5TUMrf4TD0Pj17yzw3A
q4xPn8MtvvOglYN1v3INNLBHeXeMc/7hMnjITFKD0RazuAQcA2VoRtGvsd9JjnM9M4jof2m5x09p
ZcbPCAjLVSPebr73DMRB7y8QJb8y5qgk3d38VpIjez3ImbHgcC fC0dkxQ/SgbQsTYBVSIfWLcBwu
RpNvvci4w04CApU4/tBLnuP4Cde5rGO1AZ09D4tvMr1//+4OB7hF8FL0EcWpCJ8b4GTq54C+Wyfb
0daJZbQtaud8+Ajk5jXd5Q4R7yIrHmof/sezSPhuyjOBOGu75SxwN8srzItRS7fr2uuYZtphOwUI
auMAhNsVLn2RrUqQA4ZZyMdzfdlWBpe0GevNH6IvoUhO3Cc7Ov hhhCe1pYPX/KZWshKD0bRcIOuW
riP8+0aVu301+GOlSWCXJYVDjaZPgbl63TFZjcvu0AqsMxyDgr RygTPCgysaGeHbl1WpwKYPyiYU
Ysms4SCKcnRO5Q1RVXfKeB9xEe124SK1YkXT1BRPiB6UKo48I8 5burxlngfOQE3gOcO4gL2UfNdI
N9gIpdoXi/nTwnvgs+j5FCVV6EbdL2Ai6uPMJIGbbRtWBZWOoYtqRbpVHQ34 mc9Qbcx6ovZ1Kqok
Jry0vKAfbgmbEYnfppp+TVsFmG5Nsc+Tqn5K/VO9uiH6raNrqAogMyDI/IYDx8EmB2vqsc5qhWC1
C2m5PEEa1i8SBlZvL2Kza6HIwHWVD6r91ifRrbZqkR4xuUlAXe 3UNCLL+1HXKEY6riLNOu9f4Anl
7PSk+07iOFoOontYeoJQxt0Tl5zjUilkYSMMdCkYX0qSknUomH 2PLSgkOWb/kUR+rjP9mHVx1ezL
7iPdEPMi0cpsGcED+fh2ejGZVnTzqT67+Be5PYcPWg6CL/Ntsg/Z/92Rh53gWrtqO/tAdH0GgMa2
T+EqDfAxGXWN6vtHIoLh7PEQJubzpht09vh8gDN7waV6qFI1AF DHlJ31jjVtGZENDsv2I2lVINAa
+jb0Mx4Pr2wXT21Zr62CZoWjlmL6F5ufwgKjfSkraPokTpewiT F3jvHF9nkT7taLMv2r0Q8AA3OR
F7zhc5hOWo2UgVxs4AYIK7PtZbiuFYfbpPChkfPwFWfmXKGbKZ kRmWT2ZNobP94rw0VorQsIJEFA
mjQRFjPWiUOYpn4vft7FOHvE26QXfGWaO1GXexileA5BFkM6Xl iMf5zN1KUnKHGJQ8s+aVgS/P97
b6pJTWpSk5rUpCY1qUlNalKTmtSkJjWpSU1q0svS3yO6NdAAeA AA
--=-qiw3RWTPsIi/H12yTirt--
--=-T6xqwht+p0Ivl/TpCyvB
Content-Type: application/pgp-signature; name=signature.asc
Content-Description: Ceci est une partie de message
=?ISO-8859-1?Q?num=E9riquement?= =?ISO-8859-1?Q?_sign=E9e?=
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.2 (GNU/Linux)
iD8DBQBFVwb6uhlqje80vsMRAoFTAKDYshxHgVVGfPXM8jP6lR eGvHDMeACfTdkE
MdEqkiZ6MnOQIdcvi3TeVs0=
=kyZL
-----END PGP SIGNATURE-----
--=-T6xqwht+p0Ivl/TpCyvB--
Content-Type: multipart/mixed; boundary="=-qiw3RWTPsIi/H12yTirt"
--=-qiw3RWTPsIi/H12yTirt
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable
For historical purposes only (everything should compile/run fine). An
TGZ archive is attached to this email, and a mirror is available on my
website : http://nicob.net/mirrors/sap_sploits.tgz
o testing users and passwords with RfcOpenEx (account locking bypass) :
- allow networked attack on SAP passwords
- now deprecated in favor of THC Hydra
- need the RFC SDK to compile
- port : TCP/3300+SYSNR
- exploit : sapchk.c
o customized RFC_SYSTEM_INFO (information disclosure) :
- will leak OS type, SAP version, real IP address, ...
- need the RFC SDK to compile
- port : TCP/3300+SYSNR
- exploit : sap-banner.c
o original Win32 gwrd bug by FX (remote command execution) :
- patched in 4.6D patch 1767 and 6.40 patch 4
- partial control on a CreateProcess() call
- can be used for "cmd /c ..." evil
- port : UDP/3300+SYSNR
- exploit : r3mote_win_UDPexec.pl
o linux port of the gwrd bug (remote command execution) :
- patched in 4.6D patch 1767 and 6.40 patch 4
- partial control on a execve() call
- each argument but the first must be max 8 characters long
- exploitable remotely under some conditions
- port : UDP/3300+SYSNR
- exploit : r3mote_unix_UDPexec.pl and r3mote_unix_wrapper.sh
o two bytes UDP crash in enserver.exe (remote DoS) :
- patched in 6.40 patch 6
- port : UDP/64999
- exploit : SAP_WebAS_UDP_DoS.c
- no, that's not related to the DoS published earlier this month
With many thanks to security@sap.com, the OaiTeam, FX from Phenoelit and
all the valuable Darklab members.
Nicob
--=-qiw3RWTPsIi/H12yTirt
Content-Disposition: attachment; filename=sap_sploits.tgz
Content-Type: application/x-compressed-tar; name=sap_sploits.tgz
Content-Transfer-Encoding: base64
H4sIAKAEV0UAA+w8a3PayLL71fyKjuIkYPOQwI+NHXKX2CRxrY NdYCe7ZbsoIQ2gWEhcSdiw2dzf
frtnRtIIcPzaZM+pilI4aKanu6ennzMSQW3kR6w78Zxp93T/mE2ZVR67v/yjl47Xtq7T/8b2ZuZ/
uqqb29VfDH2zWt3Y3jY2jV90Y6NqbP4C+j/LxvJrEkZmAPCL51h+7xtwt/X/l15Pn1QmYVDpOV5l
zAIXSte5Scjg4Ghnp+NblyzazeWewimqB1yxIHR8D/w+REMGb/+ATuMY2pUaDK4DG64mrlfOPUXo
TwzGZhA5puvOwPK9KPBdMMHCe4h8YFPriuULMDJtBr0ZuJ45tU eV0ByHsxCHN83QwYFsOnZ9JzJ7
LoNrJxqC6yMGMC2LhQS2509cG3oMbN9jEDDSYxw28WwWQOiPGJ G2nQhZDjlbVV2vFYltnMDxkHk+
c50IXvWnv43ju7LNXkP+k+PVquAHzsDxkKLl26wgxm8WoUV6AK +4OvzG/5Y9FuEoVUYInsut/l03
UHq2w0B751wx6Dsu88wR05BJFycB+VXLH41Mz66HQ6cfFXYVYD MYGAogCtQcGcvhavNwtSxcA1Gh
4H2UoDfQwOlDHhkZRMMYbQFew68KdO1b0LUMNOdh6IeRwgPdJh zkVsd+ENW1Ws3YVvmkxhQmYP87
YWEEdcitaOdT3dDK4kuVf3mTXI+8za08hQ4jxSDBCW1kXB2p51 ewhmYQ8pnnVqRwCAdoMIX8r1CC
OcEVsBf7u3ryTxJ5608C1Nk7Eql9g0iNiBANI/nXrcb/YmpOgMJbQuzUc51RxGyJsggMZ86t6Zmu
I3Wpf2USta7hSjwPEYIigVjGIl8oWiI2RWPR8Us46UEMBF9ygN doBqvCAHfTe9fxlFsbVze9I6SI
im7zvEvSwfX/rSs7JEao8ztQXNLOzkGreVJ67bHr/HHgR379tTaxx1rxmLGgYdtB/bVASvfHpGiv
NY5fKxYED4kaChoF+AJcmy3T8/wIBixCD0KkoO8HgnkNvqpslV6bk8jvu5NwmDck1nHgeFHCd6zT
cjqW64csFdPX3L/t+cUVKPH/OjDHGATK4fCfpXFr/Ndl/N9ED71Ro/hf29z6Gf9/xIXxn2J/OKQw
/9EMHIq3IY/5bhSYEA7RbuC0fQjXQxYwcEIeh8mloIcD0xYRVoZJHPbBnEpnA zuJr8t12nt17a+/
ykb5aqAR9rcyFsbZhO1fe66PGYHNw+Q8oi2JKN9jlkkJCg7TSk cYnjy4RnMt5N4eHDbrWrlSLpc5
gRP0hmi/lKKELMC4DAfH2NzyMVUIo8CxiG3YLRVyJ432u+ZJXTNeVsvG1q/lqm6UDYMj6SAG9Khc
RMwa+nRjs95kkNtvvjl9V9cI6uEXUsheHUpbVlFYQBxeiryFBC EEaVoR5heYSHmU96AY7CL6KZj5
E95GcuG+nSQCO3xwCUxvhlMnQZGcA9MbcOkZZZ3+lTbL1Q38VD fK1c3N3NOVEmh8+Et5aZDH0Rmo
QoJXaAcFCr6WrnPJ4IVc5hcKsmTlaeCQTYkh0w7IB6N/Ja+JDSNnymRwQpv0bBOTSuahWjkYKAkX
R2Ug09OaYUCevpVrZWO7kOnd/nUz2/eI9UF+96ViFnEFRj6mDRhAXXPiWRjcIbQCZxyRepjBjKQ6
I6NARXEsxpVwNnYsbhs8zPLQHE3IeIROlkIHc2BcKVDFBJgKD6 6NbSgdmT0L3n16f9Q5qVuYUiMS
vO002x/rMczeUevjwX6dg2IixfUSuK5qMesoP0UvuIFIuHIlWFr/CUiuiKWjVTItWBVmkpAIXcbG
YFR1mKO6R2IqEc0ldn036kLS25ub8C3a1TnCTRw9iWLCd6cmaE ynU/6ZpyVwd4ZxtaFfezUbPP9a
IM/9h8Txh15SJteO993K/1vj/3Y1if/V2haP/7rxM/7/kOtO9T8V5dy4WMhtK3ZnAyz+PDBDNDZZ
f0xGDJ05tmC5P3TQYsaBb3E33wfEwjcKMBJhhY2OIeSbB8y7cg Lfo4FhGdqyEBybPP0emTOgjJx2
EUwcGGI7JQdJNIS8Pq3qhTKcKHxhQGHBOGDUP8IFBr935fiT0J 2RBaNvcfoOOiTEQ+m9j1NCPKet
gz8KWW7us22gVPwYsjv7LXR9FheHGcldk72AYeJ0LCSSL3C/P4yi8U6lMgptrzxyrMAP/X5UxolU
XKcXYFSpMK80CSu265IoKz0zZBWLI5KiLZvhWN1lkEK40ybDtw r3pG7HwvDGuj1G/X9hBSpYQ76s
DO5Qzp9PNwz8VPFTi3tikKoet+jxRzZs6nf5xMDGXT4xcPUunx i4dpdPDLwhPvrLb304cONuUDdf
qshisdE2mbAJzFxR9x3vM2YglDdyu0h2A54/h9DxLAxvOBBoHNrOCNMarru2j4ZPZnjtB5dAdQBy
Yo1svuAW/c1r5XQvoSC41Z4/5yzTtsLPfYX/0H0FTCNLPeQOy37r+0QYEf+3boz/xlZ1ezOO/7Xq
9gbG/2q1avyM/z/iCik8WTyeYjVjYT1ydoHWov2Wf1qA1QN7ByoUcyobW/uVMLAql4FXCfoW7dY7
Xt8vW08NWKUqm6y8sganoYn15c6KuNYq1FaupFqGuQGPMrxA08 tVCGehF9R1iKFXMkPRe40dl3L6
LMr20dFJvTLEcrnCF6aCHBBfoX1ZQvDJNAU9aO0dnu4366s0po JOzp3YrKLgOjx4Izsx5FZUKgPL
AigdrEoUUDpcRWBQbQZKPt33vABKLjKAf23MotwRocg9leTgVR jZjl8evs42IcH5NrT1QbbNimZj
lmnSkCLSKg81pY1m71BT7sp3bNg/POzuNfDPm8be7923p629k4OjFiBUlwWBH+TFmq+Bj3mfcPPk
jqU+cBS2E45dc9blmPPQfrvXOcAB/JaAVdghc8d58ZXQIGy32W4ftbsHrbdH3eYfAJxql5QG+0eY
zOV54Y9Jo1WUvKzR3RUUctz9cxytj+r+CHrmLmZou3H3+0ZrH2 u3+Bpi+HFZ0ovVq3rR1AMr6T1u
tBsfmifNtuhlU/LkKPyzWvXiJiBntAzopPFGYQL4kVWoQqDY5jkJHd7J561ea3Q8 xsa0Ht1xFKAp
tk4PD4s5WHp9FMdNbyb9PgvOqptbF8XcyorAg6OVG1P53ou/Y2gZdXuTPo7cvkgbMdn2MEvo8uOH
M0OvblyIYEPrNXc5RfhcpH06ZbjrYNbb7fsTzC4AZ6CnfVhbBE nPXN/YDMNre/k41/QGE/QssrfO
M4Zl8gNAs+oKFs42uCurbelaiom6iYszo3ZBRLRT7xKreW8OhJ g5e3kBAiRkFNfnQIins5oEabY0
KaM+5Emn4RVUC9QgUhlhIDKgA5Ymk8ADg99+5ePQ3ZTud+XEch 54aIeuK+xLmkAg++6FDx0WJCZW
RpR8n1dq4K7ax0lJStif+BSh732rmRZReXguR3G/8JiJHk+oLESVZHwXtB/4o6Tiw+wW6R6Nmdec
lo4JqPxwEcCIjUIW5TN2UER1xBz5L+b3sx2FOEvj1prpEh2U6u UdrAzBeUWagf+vr3PViHWD7AfH
ovPHL6Q9V2fOhRSXkNjekFmXGCuxmpxSKSnJkNdWRCLZJ1NCdH kyjrUCTsYaBjHWIryov+AGG+si
11gaIBa6IFu/JC4no7nzypvor+Dzo+libgrXQ8caQhyaemgpl6GoOLAGQdHSHo BG+2cKy71vsAzL
WO7Ns0xmGVjjWV54tSKkkhTdzA3ZwvTkYsdj0lUWLQVl5lys+G c9nXy8dthaiuntqriX8JOdS+KE
sZH81Qvtxe7yCa0jxLpRRFqLg6XuSJ7n8KgrtOePZ+TI/ayqklIlFpSuSkwfY4mklJAW+k5/12PN
xZukew1v1teJD3ihanJnzCzHdIWjosSOzINOaVx/gNrMq1Gb9c2JG4FtRmbKC7ejz3V9Fz6/yuMM
CgsGA59jw6IFXpGumPrOPl+QtqDuF3LownsBMy9TGapAQgcL6F EmdBiqICgsiJMI0BKPxqmuanuH
B83WSV0rwmaBaOqpemYiYz1VItLL5chOO832UlRKIL0TouNGp/Npn1Btz6PKxN07ITtstN4tRbUQ
piUyKTFc/pYvF9riHs2M4Oi42YLIGbF4paXOZdRzXS511vMSK3vvm3u/13Utdpe8BmGJCgliXJFw
KiMnDEnnJCWaXHZNlNmEvOzu35EPkMv+DLMEJQWROkOE1BV7OB muEAkRwqmQyK7kw4lIZUnIEF6F
zPwqP5wQV6SEDOGVyyjRaMciuAUYU2wmPNaUgt4OnHvPwnPM2r JuTHD54BSD3J8SWx+eQojkCA0g
8alz2cQNCf3ztEoqpPlkjK2uFD3dJPLJUBaL7Nx7F6DvkgibPC sc8JZnNoorJVDmrbFXS4f/zmYJ
P3xtlCGXbLY44APmxlT1iwF8UZQhI9EbD6P9vnhn62tmrc+9zo Qe7oMniOLRyWKSFT1wEbnsk3JP
vyjzE27M9Hk9hxXt8VH7RNtdBBP5gFFd7DJtm0Lm87T8y3TTww 6UBYrsgwMVFqFoMwC4Ipz8edzs
7r1vtDlQFtBI+E2S97TA1Rc7Zc0a9wAknY9ahT0qTJBV6E+8R1 qUqN6FRRHaNrOYc8Xy0tSKfGG6
nT87J80PfNNBK0rW7zby+KD1DhUXidH+D6gCKyZNiYDTJiG59P 55tn4vpIvTz8esPBGGfPQ7qAZM
lp6PmRUQzT/2mse0b1OAv/9OXcYcFE5agUyisbLVs4ynTDqsAmtZOWkS/mvqpXLKYMn8A1WElGFf
bDPRczkYscOk/QFKgtfcptXzZLcKHl1p7/Gt9n8iPJCECVmsg3FtLEsrfTf3ldikXTLSyPtsy+W+
5J5i8uN4DI5OT/IQsWlUhCuqy6AA5znFdYP2rFSthvCsVF4TblsAy+Ra8UOl1xwB xmz1FokppP7I
0CrSo2HfJBiHittpnudWpIomrTgA8RcUDlqHB61mSghRK53vm4 39ZlswGDOV8oR83FMhzj3OumAs
T1iJFT5Vzsfu/NeYAY0qnc4sjNgIDjA6BiO+9RrbmDqEr562z8JIHsNpXPp0ZrQ EmpyHFBD+R1vs
VfTm5Gmw/opdgkD5ng59OS4OFiNTvEEKZ6SAidtQuqtL8IjeeI77AiKchWJ nWJkZ5uR0mi2nRXfh
HMQbcUAtAHoqEwlAyOnEIHiXhTg6JggQ/f54oZ8/h4ZRWQA4Y36TgWiz8Ep2h043oLub1orWNmAu
SyZF2/TunFwQ5pIFHnOzoNSWwi6gphjKjyQvfdcVI8Z0m0W+lzwjKECo ksV8YW7KXsQGtFsk5+xF
CyBvXd/kD1IdlwVQ3/UXgGgmI9Makn05toCj++VzQO+gnWCR95fvyRlH9LVIFpTqrW3i cqZ6C/8D
Wn7fnLnOYBhBaF7xh7sQS0HDCkDTYre5xOi4/8x4SuFIH3w2Is4k4lyV1oNiZKUZR9ad2J9lz1OE
sz80w4hn4lgHLKb4j8rc75m33z9rF7mjTNqFXBNBLQYn9RxICU WtQ+6SVb/bOkQnQfuZO3c6INQQ
hZiCCJL/OY/Q/1dfKHhrePn9zv7p+vb5v761XduOz/83awa2G8YGNv08//8B1/c/oc5xXypfjDvb
5Edyermm/ZDz45sPiO988vqvn6fyYaF6LvrzIO3nQdrPg7R/+SDtg3nJgN66oWOikoWZPAjfyPeQ
bjysik/RxFnVyooku+zoKelCLrkvUNT4Xqd4OCDO+/YmQUCPaCfpasLPdzzzE0ZHIvEYo1dBcP0U
I7vlGC05ZVpRPeH6+gNOz+6NYcmx2b1xNDr8/Z1H4ej82WnxqWzdiCInFDTREzprpQfFR4Txmt7E
4Y/wDs0rJt4E40WVuhLCfynBBqswFF1q4bESfTIdXh5u8uFYzYmdQ hvrFKFTChLSXdXxZTk8Ig88
CUJWJP7Mm88Gn8RMkjrRkd+HJurwAVz7/H1/ZN2Um1xoAn+xwKc3FdEwLBbSq1n03p4T8t8SMC2k
6NHJoHWpnAU+5NTRAE3OKmatYdtcuI03jeOueEdQh75rDhT2D/rccyNL6IKwin53StOg14vo0V/a
ELJMd0bvwAVRkb9vhqt3bXp8iMlTpGjohA9iPMPXPPN0bsp/2aGdHOQ+TDp0qodI5vHv+96LiL+l
KGedyuQT/YID/70ImwPx6Wah7sUCWn5XDJfzjAm9RSfE3+AcKGufOEd+vsiTAen Kbz5n5LNK1Dh7
bijw3noGuOS0Lwe3nfjFDzbM7wYQrKHXeP9KPKGzJxdwyE2qbz ruJGD8ZG0lt/I19TXLEVUXEbVY
xJ//Hwc+2tFIHNLFmOaBO5F401RsE2C0sTGBXLLPwEku2apYEX4CVj LnhTEt6kCxv8El8hE5N300
C0xie75wFQkzEubG4+KVpXvxmU2P7F78N3Y7FFWST2bGM45/FySzByOflRbbH+j5hNuT4SLZ/xCu
X9fF0T8q9Vp8Pk//xc8dGLouFiTD+O07JIiv+4n1Gh167aK773e+w1bALc//b+q1jeT9/42NLaz/
a6iAP+v/H3FV1h578SflH3cJHLShzFURA0XngTj+CT6a4oeH6KeJbvqxnx/Bx+PX5f6vH0w8B5tv
3/AJnYFnutk2StPmoGZhRbzutNhOO0Zhthkl6+Cn4ngL7bbks2+z PnQpuDfaxw0FxgzGZoVGczjm
2U6fv45Cb65RPhEyNpKvwMW/LYC1Kf/5BKyeSeCIHMRmtZ3vdt/8edLsHrX3m+0CvRv3JO5R2pO9
7bQN1IExG3OID951m639g0ZrDnHaniJO2kAduAzxHL9LsSK4wi pGeRWlJMllu4RUKtFrx3UxsaYf
1KBiTgoVC1eM9raQpMRFoaVDT8lAzajVtjPt+7x9a+Ply5ccq0 hrx64Z0ZloKaSHRPsYZYfMpPR+
ZNoeveoqrSv/mXZAxu4EdYt+hySipF+C0nv/YYEAUXEnVgTOePglozrK9CYeaTLiUPcodzaKztDd
2djFadM+RxaIdxUT0N1YNlmoyA930ybxMxmRH3UxWV1od+yFpn 5gDrp+v787jzZy55v4MaDluws4
eDahtNJmY0jnm3Nttmj7uhsLbGKTxOawhVilWWyBiHj9cq5x2S QlNymVcDJSqdzCXXbOuMZ3lwPn
5qt4O63DW8bmjH6Sgn7AAaCKfp7ea8eC6uh3oTbpG3ES8uyiDt r5dLt6Pu0z/jor31FBgsKNQZ6q
NKTaNV0zGHHt4wrt9aKu54dj3+/n1Wlhbpb0L/YW50Dn9cXrWpcovvxc+1px+SgS4wB96zgvdslj
4jwNZbKxqMgyBkgmlC98kcAav6+QryezGzpRWStiqvmVi6TH/r+dq/tt2wbi7/4rlAA1SFt27KDL
Qx15CFpsNYYhRlpgD50ROLbcGIgtwVLqFQP2t+9+d0d9WV69Zs BeRLSORB4/7oPHu6NI8qp4kqJP
jtFnIXqN0COkAdeizDylUTCo434w8BP5O2rl25efOrOyxSBZbt HmLzQIkfWKT+NcX9o/s8qAS3Tr
8VXiXS8TucNm7H1Kdgt+NIOA/JdltLEz2O8tjsQMEIj7diOKDOrl1Qo2OQ3pzAhmwhaGGs6stS1 H
5vVWPJpl/vkHt36xjoXgDrExEKNnmlX0T5q6nPnnOohzax1thzQIeE9Jtef LGQ+riFih299TFyp0
w+S+z7RZWyYIawmp4hkGCJcWlQ13+6N2+Ob8Wsg7PkdYmNVsfT uICniTqTAzA+nO+Kg4PHS9KAIx
cIJYyclpMmJIPHFEUboxEFgzsDJ2N/Ti7GR+6FAK05KzRfwK/dd2VRZNXErZd0JYBWVhGDDVsZpt
o23P0YrxwvUZpIUVt/431YnMExKEojKNoG+dsqUXgNzjCo05ZdN7IKaZufnpHsfe/Q+3b3+5f/fz
3c2v/mQ6vbv9eAuXEDSc9xPSOav5Zv30NVDwLJsvhHhMo21isoU9r4R O+wn/CVSVQ1gJxzQyGICv
KtZ3ewXyantDf+CbyvBJd7WTud9S2EqptdcHjeQzCgEQMVfQu1 eguYcLB5TUMrf4TD0Pj17yzw3A
q4xPn8MtvvOglYN1v3INNLBHeXeMc/7hMnjITFKD0RazuAQcA2VoRtGvsd9JjnM9M4jof2m5x09p
ZcbPCAjLVSPebr73DMRB7y8QJb8y5qgk3d38VpIjez3ImbHgcC fC0dkxQ/SgbQsTYBVSIfWLcBwu
RpNvvci4w04CApU4/tBLnuP4Cde5rGO1AZ09D4tvMr1//+4OB7hF8FL0EcWpCJ8b4GTq54C+Wyfb
0daJZbQtaud8+Ajk5jXd5Q4R7yIrHmof/sezSPhuyjOBOGu75SxwN8srzItRS7fr2uuYZtphOwUI
auMAhNsVLn2RrUqQA4ZZyMdzfdlWBpe0GevNH6IvoUhO3Cc7Ov hhhCe1pYPX/KZWshKD0bRcIOuW
riP8+0aVu301+GOlSWCXJYVDjaZPgbl63TFZjcvu0AqsMxyDgr RygTPCgysaGeHbl1WpwKYPyiYU
Ysms4SCKcnRO5Q1RVXfKeB9xEe124SK1YkXT1BRPiB6UKo48I8 5burxlngfOQE3gOcO4gL2UfNdI
N9gIpdoXi/nTwnvgs+j5FCVV6EbdL2Ai6uPMJIGbbRtWBZWOoYtqRbpVHQ34 mc9Qbcx6ovZ1Kqok
Jry0vKAfbgmbEYnfppp+TVsFmG5Nsc+Tqn5K/VO9uiH6raNrqAogMyDI/IYDx8EmB2vqsc5qhWC1
C2m5PEEa1i8SBlZvL2Kza6HIwHWVD6r91ifRrbZqkR4xuUlAXe 3UNCLL+1HXKEY6riLNOu9f4Anl
7PSk+07iOFoOontYeoJQxt0Tl5zjUilkYSMMdCkYX0qSknUomH 2PLSgkOWb/kUR+rjP9mHVx1ezL
7iPdEPMi0cpsGcED+fh2ejGZVnTzqT67+Be5PYcPWg6CL/Ntsg/Z/92Rh53gWrtqO/tAdH0GgMa2
T+EqDfAxGXWN6vtHIoLh7PEQJubzpht09vh8gDN7waV6qFI1AF DHlJ31jjVtGZENDsv2I2lVINAa
+jb0Mx4Pr2wXT21Zr62CZoWjlmL6F5ufwgKjfSkraPokTpewiT F3jvHF9nkT7taLMv2r0Q8AA3OR
F7zhc5hOWo2UgVxs4AYIK7PtZbiuFYfbpPChkfPwFWfmXKGbKZ kRmWT2ZNobP94rw0VorQsIJEFA
mjQRFjPWiUOYpn4vft7FOHvE26QXfGWaO1GXexileA5BFkM6Xl iMf5zN1KUnKHGJQ8s+aVgS/P97
b6pJTWpSk5rUpCY1qUlNalKTmtSkJjWpSU1q0svS3yO6NdAAeA AA
--=-qiw3RWTPsIi/H12yTirt--
--=-T6xqwht+p0Ivl/TpCyvB
Content-Type: application/pgp-signature; name=signature.asc
Content-Description: Ceci est une partie de message
=?ISO-8859-1?Q?num=E9riquement?= =?ISO-8859-1?Q?_sign=E9e?=
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.2 (GNU/Linux)
iD8DBQBFVwb6uhlqje80vsMRAoFTAKDYshxHgVVGfPXM8jP6lR eGvHDMeACfTdkE
MdEqkiZ6MnOQIdcvi3TeVs0=
=kyZL
-----END PGP SIGNATURE-----
--=-T6xqwht+p0Ivl/TpCyvB--