Daniel Berlin on Security Insight on SAP security, development stuff… and all the rest

18Nov 12

Sniffing SAP GUI passwords // Part 1

Hi people,
in June I wrote an article about decompressing ABAP source code, in which I talked about multiple efforts to decode the SAP DIAG protocol. Now I'd like to share my experience with the outcome of those projects. Have fun!

SAP DIAG protocol

The SAP GUI uses a proprietary protocol called DIAG for communication with the application server — which unsurprisingly does not support encryption, only (optional) encryption.
To secure network communication, SNC (Secure Network Communications) comes into play: it adds encryption, single-sign-on capability and support for alternate authentication mechanisms.

Anyway, the following assumes a default SAP setup, i.e. username/password authentication without any encryption mechanism in place.

Test setup

In the below tests, I'll login to client 000 with user DDIC, password ABCD1234 in English.
The clients have the IP addresses 10.0.0.1 and 10.0.0.100, while the server has 10.1.0.20.
The test procedure is the same for all below tools:

  • Start the sniffer,
  • log in to an SAP system,
  • stop the capture and
  • search the captured data for the (plain text) login data.

1st Tool: Cain & Abel v4.9.43

Cain & Abel is a versatile "security tool", which has been actively developed for > 10 years. Wikipedia has a nice overview of its features. The wealth of features might make it's usage a bit unclear — so this is what needs to be done:

  1. Start the sniffer,
  2. switch to the "Sniffer" tab,
  3. select the "Passwords" section,
  4. choose the "SAP Diag" entry and
  5. wait for captures to appear.

The captured and decoded communication is fully stored in a plain text file, so you need to find the needle in the haystack:

Cain is a very powerful tool and a perfect choice for security studies!
It has so many impressive features that most AV companies classified it as malware; you'll probably have to deactivate your AV guard before running it. 😯
The only thing that's missing is a parser for the dump, which directly extracts the credentials!

2nd Tool: SapCap v0.1

This one is implemented in Java and you need to struggle through the dependencies before it starts to cooperate…
You'll need: the JRE 6, SapCap itself, Jpcap, WinPcap and the MS Visual C++ runtime (unless already installed).
I managed to get ot going on Windows XP (x32), but had to give up on my Windows 7 (x64) / JRE 7 workstation… but YMMV.

SapCap works, but is a bit rough around the edges; besides the packet analysis didn't work for me.
Not my favorite!

3rd Tool: Wireshark

Wireshark is a powerful and polished network packet analyzer and probably the best open-source tool for this topic.
Unfortunately it doesn't support decoding the SAP DIAG protocol out of the box – but so-called dissection plugins fill this gap:

The CoreLabs plugin has to be compiled along with Wireshark, but I didn't get it to work before I got bored (approx. 10 serious tries). Seems to be a proof-of-concept, nothing more!

Update: Check this article for a review of the CoreLabs plugin!

The Positive Research Center plugin is only available as a Win32 DLL file – no source code, no documentation… take it or leave it… 🙁
Apart from that, this plugin works really fine and since I'm a big fan of Wireshark, it's my first choice on Windows!

Further reading

 See you next time!