SAP SOAP RFC PFL_CHECK_OS_FILE_EXISTENCE File Existence Check - Metasploit


This page contains detailed information about how to use the auxiliary/scanner/sap/sap_soap_rfc_pfl_check_os_file_existence metasploit module. For list of all metasploit modules, visit the Metasploit Module Library.

Module Overview


Name: SAP SOAP RFC PFL_CHECK_OS_FILE_EXISTENCE File Existence Check
Module: auxiliary/scanner/sap/sap_soap_rfc_pfl_check_os_file_existence
Source code: modules/auxiliary/scanner/sap/sap_soap_rfc_pfl_check_os_file_existence.rb
Disclosure date: -
Last modification time: 2017-07-24 06:26:21 +0000
Supported architecture(s): -
Supported platform(s): -
Target service / protocol: http, https
Target network port(s): 80, 443, 3000, 8000, 8008, 8080, 8443, 8880, 8888
List of CVEs: -

This module abuses the SAP NetWeaver PFL_CHECK_OS_FILE_EXISTENCE function, on the SAP SOAP RFC Service, to check for files existence on the remote file system. The module can also be used to capture SMB hashes by using a fake SMB share as FILEPATH.

Module Ranking and Traits


Module Ranking:

  • normal: The exploit is otherwise reliable, but depends on a specific version and can't (or doesn't) reliably autodetect. More information about ranking can be found here.

Basic Usage


This module is a scanner module, and is capable of testing against multiple hosts.

msf > use auxiliary/scanner/sap/sap_soap_rfc_pfl_check_os_file_existence
msf auxiliary(sap_soap_rfc_pfl_check_os_file_existence) > show options
    ... show and set options ...
msf auxiliary(sap_soap_rfc_pfl_check_os_file_existence) > set RHOSTS ip-range
msf auxiliary(sap_soap_rfc_pfl_check_os_file_existence) > exploit

Other examples of setting the RHOSTS option:

Example 1:

msf auxiliary(sap_soap_rfc_pfl_check_os_file_existence) > set RHOSTS 192.168.1.3-192.168.1.200 

Example 2:

msf auxiliary(sap_soap_rfc_pfl_check_os_file_existence) > set RHOSTS 192.168.1.1/24

Example 3:

msf auxiliary(sap_soap_rfc_pfl_check_os_file_existence) > set RHOSTS file:/tmp/ip_list.txt

Required Options


  • RHOSTS: The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>'

Go back to menu.

Msfconsole Usage


Here is how the scanner/sap/sap_soap_rfc_pfl_check_os_file_existence auxiliary module looks in the msfconsole:

msf6 > use auxiliary/scanner/sap/sap_soap_rfc_pfl_check_os_file_existence

msf6 auxiliary(scanner/sap/sap_soap_rfc_pfl_check_os_file_existence) > show info

       Name: SAP SOAP RFC PFL_CHECK_OS_FILE_EXISTENCE File Existence Check
     Module: auxiliary/scanner/sap/sap_soap_rfc_pfl_check_os_file_existence
    License: Metasploit Framework License (BSD)
       Rank: Normal

Provided by:
  lexey Tyurin
  nmonkee

Check supported:
  No

Basic options:
  Name          Current Setting  Required  Description
  ----          ---------------  --------  -----------
  CLIENT        001              yes       SAP Client
  FILEPATH      /etc/passwd      yes       File Path to check for  (e.g. /etc)
  HttpPassword  06071992         yes       Password
  HttpUsername  SAP*             yes       Username
  Proxies                        no        A proxy chain of format type:host:port[,type:host:port][...]
  RHOSTS                         yes       The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>'
  RPORT         80               yes       The target port (TCP)
  SSL           false            no        Negotiate SSL/TLS for outgoing connections
  THREADS       1                yes       The number of concurrent threads (max one per host)
  VHOST                          no        HTTP server virtual host

Description:
  This module abuses the SAP NetWeaver PFL_CHECK_OS_FILE_EXISTENCE 
  function, on the SAP SOAP RFC Service, to check for files existence 
  on the remote file system. The module can also be used to capture 
  SMB hashes by using a fake SMB share as FILEPATH.

References:
  OSVDB (78537)
  http://www.securityfocus.com/bid/51645
  http://erpscan.com/advisories/dsecrg-12-009-sap-netweaver-pfl_check_os_file_existence-missing-authorisation-check-and-smb-relay-vulnerability/

Module Options


This is a complete list of options available in the scanner/sap/sap_soap_rfc_pfl_check_os_file_existence auxiliary module:

msf6 auxiliary(scanner/sap/sap_soap_rfc_pfl_check_os_file_existence) > show options

Module options (auxiliary/scanner/sap/sap_soap_rfc_pfl_check_os_file_existence):

   Name          Current Setting  Required  Description
   ----          ---------------  --------  -----------
   CLIENT        001              yes       SAP Client
   FILEPATH      /etc/passwd      yes       File Path to check for  (e.g. /etc)
   HttpPassword  06071992         yes       Password
   HttpUsername  SAP*             yes       Username
   Proxies                        no        A proxy chain of format type:host:port[,type:host:port][...]
   RHOSTS                         yes       The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>'
   RPORT         80               yes       The target port (TCP)
   SSL           false            no        Negotiate SSL/TLS for outgoing connections
   THREADS       1                yes       The number of concurrent threads (max one per host)
   VHOST                          no        HTTP server virtual host

Advanced Options


Here is a complete list of advanced options supported by the scanner/sap/sap_soap_rfc_pfl_check_os_file_existence auxiliary module:

msf6 auxiliary(scanner/sap/sap_soap_rfc_pfl_check_os_file_existence) > show advanced

Module advanced options (auxiliary/scanner/sap/sap_soap_rfc_pfl_check_os_file_existence):

   Name                  Current Setting                                     Required  Description
   ----                  ---------------                                     --------  -----------
   DOMAIN                WORKSTATION                                         yes       The domain to use for Windows authentication
   DigestAuthIIS         true                                                no        Conform to IIS, should work for most servers. Only set to false for non-IIS servers
   FingerprintCheck      true                                                no        Conduct a pre-exploit fingerprint verification
   HttpClientTimeout                                                         no        HTTP connection and receive timeout
   HttpRawHeaders                                                            no        Path to ERB-templatized raw headers to append to existing headers
   HttpTrace             false                                               no        Show the raw HTTP requests and responses
   HttpTraceColors       red/blu                                             no        HTTP request and response colors for HttpTrace (unset to disable)
   HttpTraceHeadersOnly  false                                               no        Show HTTP headers only in HttpTrace
   SSLVersion            Auto                                                yes       Specify the version of SSL/TLS to be used (Auto, TLS and SSL23 are auto-negotiate) (Accepted: Auto, TLS, SSL23, SSL3, TLS1, TLS1.1, TLS1.2)
   ShowProgress          true                                                yes       Display progress messages during a scan
   ShowProgressPercent   10                                                  yes       The interval in percent that progress should be shown
   UserAgent             Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)  no        The User-Agent header to use for all requests
   VERBOSE               false                                               no        Enable detailed status messages
   WORKSPACE                                                                 no        Specify the workspace for this module

Auxiliary Actions


This is a list of all auxiliary actions that the scanner/sap/sap_soap_rfc_pfl_check_os_file_existence module can do:

msf6 auxiliary(scanner/sap/sap_soap_rfc_pfl_check_os_file_existence) > show actions

Auxiliary actions:

   Name  Description
   ----  -----------

Evasion Options


Here is the full list of possible evasion options supported by the scanner/sap/sap_soap_rfc_pfl_check_os_file_existence auxiliary module in order to evade defenses (e.g. Antivirus, EDR, Firewall, NIDS etc.):

msf6 auxiliary(scanner/sap/sap_soap_rfc_pfl_check_os_file_existence) > show evasion

Module evasion options:

   Name                          Current Setting  Required  Description
   ----                          ---------------  --------  -----------
   HTTP::header_folding          false            no        Enable folding of HTTP headers
   HTTP::method_random_case      false            no        Use random casing for the HTTP method
   HTTP::method_random_invalid   false            no        Use a random invalid, HTTP method for request
   HTTP::method_random_valid     false            no        Use a random, but valid, HTTP method for request
   HTTP::pad_fake_headers        false            no        Insert random, fake headers into the HTTP request
   HTTP::pad_fake_headers_count  0                no        How many fake headers to insert into the HTTP request
   HTTP::pad_get_params          false            no        Insert random, fake query string variables into the request
   HTTP::pad_get_params_count    16               no        How many fake query string variables to insert into the request
   HTTP::pad_method_uri_count    1                no        How many whitespace characters to use between the method and uri
   HTTP::pad_method_uri_type     space            no        What type of whitespace to use between the method and uri (Accepted: space, tab, apache)
   HTTP::pad_post_params         false            no        Insert random, fake post variables into the request
   HTTP::pad_post_params_count   16               no        How many fake post variables to insert into the request
   HTTP::pad_uri_version_count   1                no        How many whitespace characters to use between the uri and version
   HTTP::pad_uri_version_type    space            no        What type of whitespace to use between the uri and version (Accepted: space, tab, apache)
   HTTP::uri_dir_fake_relative   false            no        Insert fake relative directories into the uri
   HTTP::uri_dir_self_reference  false            no        Insert self-referential directories into the uri
   HTTP::uri_encode_mode         hex-normal       no        Enable URI encoding (Accepted: none, hex-normal, hex-noslashes, hex-random, hex-all, u-normal, u-all, u-random)
   HTTP::uri_fake_end            false            no        Add a fake end of URI (eg: /%20HTTP/1.0/../../)
   HTTP::uri_fake_params_start   false            no        Add a fake start of params to the URI (eg: /%3fa=b/../)
   HTTP::uri_full_url            false            no        Use the full URL for all HTTP requests
   HTTP::uri_use_backslashes     false            no        Use back slashes instead of forward slashes in the uri
   HTTP::version_random_invalid  false            no        Use a random invalid, HTTP version for request
   HTTP::version_random_valid    false            no        Use a random, but valid, HTTP version for request

Go back to menu.

Error Messages


This module may fail with the following error messages:

Check for the possible causes from the code snippets below found in the module source code. This can often times help in identifying the root cause of the problem.

<RHOST>:<RPORT> - File <FILEPATH> DOESN'T exist


Here is a relevant code snippet related to the "<RHOST>:<RPORT> - File <FILEPATH> DOESN'T exist" error message:

88:	      })
89:	      if res and res.code == 200 and res.body =~ /PFL_CHECK_OS_FILE_EXISTENCE\.Response/
90:	        if res.body =~ /<FILE_EXISTS>X<\/FILE_EXISTS>/
91:	          print_good("#{rhost}:#{rport} - File #{datastore['FILEPATH']} exists")
92:	        else
93:	          print_warning("#{rhost}:#{rport} - File #{datastore['FILEPATH']} DOESN'T exist")
94:	        end
95:	      elsif res
96:	        vprint_error("#{rhost}:#{rport} - Response code: " + res.code.to_s)
97:	        vprint_error("#{rhost}:#{rport} - Response message: " + res.message.to_s)
98:	        vprint_error("#{rhost}:#{rport} - Response body: " + res.body.to_s) if res.body

<RHOST>:<RPORT> - Response code


Here is a relevant code snippet related to the "<RHOST>:<RPORT> - Response code" error message:

91:	          print_good("#{rhost}:#{rport} - File #{datastore['FILEPATH']} exists")
92:	        else
93:	          print_warning("#{rhost}:#{rport} - File #{datastore['FILEPATH']} DOESN'T exist")
94:	        end
95:	      elsif res
96:	        vprint_error("#{rhost}:#{rport} - Response code: " + res.code.to_s)
97:	        vprint_error("#{rhost}:#{rport} - Response message: " + res.message.to_s)
98:	        vprint_error("#{rhost}:#{rport} - Response body: " + res.body.to_s) if res.body
99:	      end
100:	    rescue ::Rex::ConnectionError
101:	      vprint_error("#{rhost}:#{rport} - Unable to connect")

<RHOST>:<RPORT> - Response message


Here is a relevant code snippet related to the "<RHOST>:<RPORT> - Response message" error message:

92:	        else
93:	          print_warning("#{rhost}:#{rport} - File #{datastore['FILEPATH']} DOESN'T exist")
94:	        end
95:	      elsif res
96:	        vprint_error("#{rhost}:#{rport} - Response code: " + res.code.to_s)
97:	        vprint_error("#{rhost}:#{rport} - Response message: " + res.message.to_s)
98:	        vprint_error("#{rhost}:#{rport} - Response body: " + res.body.to_s) if res.body
99:	      end
100:	    rescue ::Rex::ConnectionError
101:	      vprint_error("#{rhost}:#{rport} - Unable to connect")
102:	      return

<RHOST>:<RPORT> - Response body


Here is a relevant code snippet related to the "<RHOST>:<RPORT> - Response body" error message:

93:	          print_warning("#{rhost}:#{rport} - File #{datastore['FILEPATH']} DOESN'T exist")
94:	        end
95:	      elsif res
96:	        vprint_error("#{rhost}:#{rport} - Response code: " + res.code.to_s)
97:	        vprint_error("#{rhost}:#{rport} - Response message: " + res.message.to_s)
98:	        vprint_error("#{rhost}:#{rport} - Response body: " + res.body.to_s) if res.body
99:	      end
100:	    rescue ::Rex::ConnectionError
101:	      vprint_error("#{rhost}:#{rport} - Unable to connect")
102:	      return
103:	    end

<RHOST>:<RPORT> - Unable to connect


Here is a relevant code snippet related to the "<RHOST>:<RPORT> - Unable to connect" error message:

95:	      elsif res
96:	        vprint_error("#{rhost}:#{rport} - Response code: " + res.code.to_s)
97:	        vprint_error("#{rhost}:#{rport} - Response message: " + res.message.to_s)
98:	        vprint_error("#{rhost}:#{rport} - Response body: " + res.body.to_s) if res.body
99:	      end
100:	    rescue ::Rex::ConnectionError
101:	      vprint_error("#{rhost}:#{rport} - Unable to connect")
102:	      return
103:	    end
104:	  end
105:	end

Go back to menu.


References


See Also


Check also the following modules related to this module:

Authors


  • lexey Tyurin
  • nmonkee

Version


This page has been produced using Metasploit Framework version 6.1.27-dev. For more modules, visit the Metasploit Module Library.

Go back to menu.