forked from OWASP/pysap
-
Notifications
You must be signed in to change notification settings - Fork 0
This Python library provides modules for crafting and sending packets using SAP's NI, Message Server, Router, RFC, SNC, Enqueue and Diag protocols.
License
jcmuniz/pysap
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Folders and files
Name | Name | Last commit message | Last commit date | |
---|---|---|---|---|
Repository files navigation
pysap - Python library for crafting SAP's network protocols packets Copyright (C) 2014 Core Security Technologies The library was designed and developed by Martin Gallo from the Security Consulting Services team of Core Security Technologies. Version 0.1.5 (XXX 2014) Overview: ======== SAP Netweaver [1] is a technology platform for building and integrating SAP business applications. Communication between components uses different network protocols. While some of them are standard and well-known protocols, others are proprietaries and public information is not available. This Python library provides modules for crafting and sending packets using SAP's NI, Message Server, Router, RFC, SNC, Enqueue and Diag protocols. The modules are based on Scapy [2] and are based on information acquired at researching the different protocols and services. Detailed information about the research can be found at [3], [4], [5], [6] and [7]. Features: ======== This tool counts with the following components: - SAPNI module Scapy class for the SAP NI (Network Interface protocol). It also includes a Stream Socket implementation for the SAP NI protocol, as well as a base proxy and server implementations. - SAPDiag module Contain Scapy classes for craft and dissect DiagDP headers, Diag packets and items. The main class is SAPDiag that is in charge of handling compression/decompression of payload items and serve as a container for them. - SAPDiagItems module Some classes for craft and dissect common Diag items. - SAPDiagClient module Basic class for establishing a connection with an application server. - SAPEnqueue module Scapy classes for the Enqueue protocol. - SAPRouter module Scapy classes for the different SAP Router packets (route, control, error and admin messages). - SAPMS module Scapy classes for the Message Server protocol. - SAPSNC module Basic class to serve as container of SNC Frames found in SAPRouter and SAP Diag packets. - Examples Example and proof of concept scripts to illustrate the use of the different modules and protocols: login brute force, gather information on the application server, intercept communications, a rogue Diag server implementation, test of Denial of Server issues [4], a Message Server monitor implementation, listener/messager for Message Server, SAP Router internal networks scanner and port forwarder, etc. Installation & Build: ==================== The tool relays on the Scapy [2] library for crafting packets. Epydoc is also required for building the API documentation. To install the required libraries use: pip install -r requirements.txt Some example scripts has additional required libraries: tabulate netaddr wxPython fau_timer (https://code.google.com/p/fau-timer/) Those libraries can be installed using: pip install -r requirements-optional.txt Install using Python's setuptools. Installation is as follows: 1) python setup.py test 2) python setup.py install Some scapy installations also requires the following steps: Edit the file supersocket.py (located for example on /usr/local/lib/python2.7/dist-packages/scapy/supersocket.py) Add the line: from scapy.packet import Padding Example uses: ============ Examples can be found at the examples directory. License: ======= This library is distributed under the GPLv2 license. Check the COPYING file for more details. References: ========== [1] https://www.sap.com/platform/netweaver/index.epx [2] https://www.secdev.org/projects/scapy/ [3] https://corelabs.coresecurity.com/index.php?module=Wiki&action=view&type=tool&name=pysap [4] https://www.coresecurity.com/content/sap-netweaver-dispatcher-multiple-vulnerabilities [5] https://www.coresecurity.com/content/SAP-netweaver-msg-srv-multiple-vulnerabilities [6] https://corelabs.coresecurity.com/index.php?module=Wiki&action=view&type=publication&name=Uncovering_SAP_vulnerabilities [7] https://corelabs.coresecurity.com/index.php?module=Wiki&action=view&type=publication&name=saps_network_protocols_revisited Contact: ======= Whether you want to report a bug or give some suggestions on this package, drop us a few lines at [email protected] or contact the author email [email protected].
About
This Python library provides modules for crafting and sending packets using SAP's NI, Message Server, Router, RFC, SNC, Enqueue and Diag protocols.
Resources
License
Stars
Watchers
Forks
Packages 0
No packages published