Chained to Hit: Discovering New Vectors to Gain Remote and Root Access in SAP Enterprise Software
summary
Three independent research streams combine into a working exploitation chain that yields unauthenticated remote root on SAP systems. Findings include a saoscontrol HTTP 1128 blind OS command injection that creates root-owned files, a P4/GDI remote object lookup exposing ~50 usable services with RCEs, SSRF and OS file download (used to recover decryptable passwords), and an authenticated-scanning tool Javao analyzer that finds an enterprise portal JNDI/GDI gadget to start apps and tunnel P4 over HTTPS. Exploit demo works end-to-end and patches/FAQ are published.
AI-written summary · about
chapters (9)
- 0:00SAP enterprise software research
- 1:25What is SAP and security
- 3:59Blind OS command injection in SAP Control
- 8:38Exploiting P4 protocol in SAP
- 14:00SMD agent vulnerabilities
- 19:18Java RMI lookup injection in SAP Portal
- 30:43Chaining vulnerabilities for root access
- 32:53Key takeaways and defenses
- 35:23Closing remarks
related talks
12mFrom Automated Scans to Hands On Keyboard: China Nexus APTs Exploited SAP NetWeaver to Breach Critic
49mSAP, Credit Cards, and the Bird that Talks Too Much
39mHow to think like a hacker
56mBlended Web and Database Attacks on Real-Time, In-Memory Platforms
46mInfiltrating Corporate Intranet Like NSA - Pre-auth RCE on Leading SSL VPNs
51mNew Exploit Technique In Java Deserialization Attack
58mFinding a three 0-day exploit chain in Ivanti EPMM and Ivanti Sentry
55m2024 Security BSides // John Hammond