88 lines
No EOL
2.2 KiB
Text
88 lines
No EOL
2.2 KiB
Text
#######################################################################
|
|
|
|
Luigi Auriemma
|
|
|
|
Application: SAP MaxDB
|
|
https://www.sdn.sap.com/irj/sdn/maxdb
|
|
http://www.sap.com
|
|
Versions: <= 7.6.03 build 007
|
|
Platforms: Windows, Linux and Solaris
|
|
Bug: pre-auth remote commands execution
|
|
Exploitation: remote
|
|
Date: 09 Jan 2008
|
|
Author: Luigi Auriemma
|
|
e-mail: aluigi@autistici.org
|
|
web: aluigi.org
|
|
|
|
|
|
#######################################################################
|
|
|
|
|
|
1) Introduction
|
|
2) Bug
|
|
3) The Code
|
|
4) Fix
|
|
|
|
|
|
#######################################################################
|
|
|
|
===============
|
|
1) Introduction
|
|
===============
|
|
|
|
|
|
SAP MaxDB is a commercial and widely known and used database.
|
|
|
|
|
|
#######################################################################
|
|
|
|
======
|
|
2) Bug
|
|
======
|
|
|
|
|
|
The MaxDB server executes "cons.exe DATABASE COMMAND" through system()
|
|
when some special commands are called by the user.
|
|
Some of these special commands are "show" and "exec_sdbinfo" and this
|
|
last one is just one of the small amount of commands which can be
|
|
executed by the unauthenticated users before logging in.
|
|
|
|
The usage of system() for executing the cons program allows an external
|
|
unauthenticated attacker to execute any command he wants on the target
|
|
SAP MaxDB server simply passing the "&&" or other patterns for the
|
|
execution of multiple commands in the shell.
|
|
|
|
So it's just enough to use the following SAP command to see the content
|
|
of C: on Windows (the bug is naturally exploitable on any other
|
|
platform supported by the server):
|
|
|
|
exec_sdbinfo && echo dir c:\ | cmd.exe
|
|
|
|
Then the rest and all the other possibilities of exploiting this
|
|
vulnerability are in the fantasy of the attacker...
|
|
|
|
|
|
#######################################################################
|
|
|
|
===========
|
|
3) The Code
|
|
===========
|
|
|
|
|
|
http://aluigi.org/poc/sapone.zip
|
|
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/4877.zip (2008-sapone.zip)
|
|
|
|
|
|
#######################################################################
|
|
|
|
======
|
|
4) Fix
|
|
======
|
|
|
|
|
|
No fix
|
|
|
|
|
|
#######################################################################
|
|
|
|
# milw0rm.com [2008-01-09] |