synacktiv/bissapSAP 권한을 신속하게 감사할 수 있는 새로운 오픈소스 도구입니다.
%%%###%%%%%%%%%%%%%%%%%%%%%%%%%%%.
% %
# %
.: #% *
* .===% . ::
% :*%%=====%********##%%%%%*: #
% %%%*= =====%============*#%%%-%
= % *= =====-================# % BBBBBBBBBBBBBBBBB IIIIIIIIII SSSSSSSSSSSSSSS SSSSSSSSSSSSSSS AAA PPPPPPPPPPPPPPPPP
=# *: =====================% + B::::::::::::::::B I::::::::I SS:::::::::::::::S SS:::::::::::::::S A:::A P::::::::::::::::P
%:#%#%%=-===*=======%%#%====+%-. B::::::BBBBBB:::::B I::::::::IS:::::SSSSSS::::::SS:::::SSSSSS::::::S A:::::A P::::::PPPPPP:::::P
% %#+++==%#========%#%%######=% BB:::::B B:::::BII::::::IIS:::::S SSSSSSSS:::::S SSSSSSS A:::::::A PP:::::P P:::::P
* %#*++#####################% % B::::B B:::::B I::::I S:::::S S:::::S A:::::::::A P::::P P:::::P
::%##++#####%=#%######%%####% % B::::B B:::::B I::::I S:::::S S:::::S A:::::A:::::A P::::P P:::::P
#-##++#####%#%%####%*###%##%.= B::::BBBBBB:::::B I::::I S::::SSSS S::::SSSS A:::::A A:::::A P::::PPPPPP:::::P
% %#++%%%##%#####%#########== B:::::::::::::BB I::::I SS::::::SSSSS SS::::::SSSSS A:::::A A:::::A P:::::::::::::PP
% %#*+%##%#####%+#%#######%:% B::::BBBBBB:::::B I::::I SSS::::::::SS SSS::::::::SS A:::::A A:::::A P::::PPPPPPPPP
- %##++#%%%####*%%########%.% B::::B B:::::B I::::I SSSSSS::::S SSSSSS::::S A:::::AAAAAAAAA:::::A P::::P
*=**++****###############%:% =% B::::B B:::::B I::::I S:::::S S:::::S A:::::::::::::::::::::A P::::P
% #*++********###########+:#%= %#% B::::B B:::::B I::::I S:::::S S:::::S A:::::AAAAAAAAAAAAA:::::A P::::P
% %*++**********########%%+==++%#:%*= ... BB:::::BBBBBB::::::BII::::::IISSSSSSS S:::::SSSSSSSS S:::::S A:::::A A:::::A PP::::::PP
+ %**++***********#####%==++++++*%*%=-*%% B:::::::::::::::::B I::::::::IS::::::SSSSSS:::::SS::::::SSSSSS:::::SA:::::A A:::::A P::::::::P
.-***++***********##%%%%=*++%+=*#%*%%#*% B::::::::::::::::B I::::::::IS:::::::::::::::SS S:::::::::::::::SSA:::::A A:::::A P::::::::P
%.#*++***********%=+++++%*+%+%#******%#%: BBBBBBBBBBBBBBBBB IIIIIIIIII SSSSSSSSSSSSSSS SSSSSSSSSSSSSSS AAAAAAA AAAAAAAPPPPPPPPPP
% %*++**********%==+++%=+%*#%%*%%*****%**%:
% %*++**********%=+++#%%*%%+#%#%%%****%:
::#**++**********%=++++%%%#*%%%*++***%
* +%#************#%=***%*%%#*%*+++%
% . .:.:.:.:.:..:%=**#**%*%+%*##***%
% :: :.:.:.:.:.:%=****%**%++******%
.%%%%#+::::::=*%%%=****#.%+++**%:
이 도구는 SAP 데이터베이스를 신속하게 분석하여 위험한 권한 또는 권한 조합으로 구성된 사용자나 역할을 식별할 수 있게 해줍니다. Active Directory용 Bloodhound와 유사합니다.
pipx를 사용할 수 있습니다:
$ pipx install git+https://github.com/synacktiv/bissap.git
또는 pip를 사용합니다:
$ git clone https://github.com/synacktiv/bissap
$ python3 -m venv .venv && . .venv/bin/activate # Optional: Install in a venv
$ pip install .
또는 Debian 패키지를 선호한다면:
# apt install python3-click python3-colorlog python3-sqlalchemy python3-frozendict python3-rich python3-openpyxl python3-typing-extensions
$ PYTHONPATH=src/ python3 src/bissap/commands/__init__.py
bissap은 3단계로 동작합니다:
$ bissap collect -t sybase
Copy this command, set the appropriate variables and execute the command. Copy the file `/tmp/dump_bissap.csv` to your host.
Call bissap -d DATABASE.sqlite import -i dump_bissap.csv to continue.
isql -X -w9999999999 -s'|' -U$USER -P$PASSWORD -H$HOST -S$SYSTEM -o /tmp/dump_bissap.csv << EOF
...
GO
EOF
$ ... # Manually execute the script
$ scp host:/tmp/dump_bissap.csv npl.csv
$ LOG_LEVEL=debug bissap -d npl.sqlite import -i npl.csv
INFO:src.file_import:Importing the database. Be patient, it may take 5 minutes or more.
...
DEBUG:src.file_import:Denormalizing the database.
$ bissap -d npl.sqlite -m 001 audit
BWDEVELOPER is vulnerable to 9 RCE(s).
BWDEVELOPER can read 17 sensitive tables.
BWDEVELOPER can execute 20 "juicy" transactions. (SE16, RSUDO, SM49, SE38, SE11, SM69, SU10, SU01, PFCG, SA38, SU01D, SM59, SU03, SU20, AL11, ST04, SUIM, SM01, DB02, SM04)
...
TEST2 can execute 1 "juicy" transactions. (SE11)
$ bissap -d npl.sqlite -m 1 audit -u 'SAP*'
SAP* is vulnerable to 9 RCE(s).
# CG3Z+SM36
> Go to CG3Z (File upload)
> Then create a new external command or edit an existing one
> Then set and save the OS command that you want to run
> Finally execute it using SM36 (Simple job selection/scheduler)
...
$ bissap -d npl.sqlite -m 1 audit --roles
ZDEVELOPER is vulnerable to 1 RCE(s).
ZDEVELOPER can execute 3 "juicy" transactions. (SU01, PFCG, SE38)
$ bissap -d npl.sqlite -m 1 audit --roles -u DEVELOPER
ZDEVELOPER is vulnerable to 1 RCE(s).
ZDEVELOPER can execute 3 "juicy" transactions. (SU01, PFCG, SE38)
(DEVELOPER 사용자는 역할이 하나뿐이며, 그 역할이 유일하게 취약한 역할이기도 하므로 출력이 동일한 것은 정상입니다.)
$ bissap -d npl.sqlite -m 1 audit -r ZDEVELOPER
ZDEVELOPER is vulnerable to 1 RCE(s).
# SE38
Go to SE38 (ABAP editor - create/edit/run ABAP program)
> Create a new ABAP program (but you will need a developer key if you don't have a "developer" account)
> Then execute it using SE38.
...
SM16 실행이 허가된 사용자 목록$ bissap -d npl.sqlite -m 1 users by-auth -t SM16
TEST
SAP*
BWDEVELOPER
DDIC
DEVELOPER
DDIC에게 할당된 프로필 목록$ bissap -d npl.sqlite -m 1 profiles of-user DDIC
SAP_ALL
S_A.SYSTEM
SAP_ALL 프로필을 가진 사용자 목록$ bissap -d npl.sqlite -m 1 users by-profile -p SAP_ALL
BWDEVELOPER
DDIC
DEVELOPER
SAP*
TEST