Oracle PeopleSoft applications are under attack (HITB AMS)
1 like749 views
The document discusses the security aspects and vulnerabilities of Oracle PeopleSoft applications, detailing various attack vectors and exploitation techniques. It emphasizes the importance of investing in security solutions, highlighting ERPSCAN's role and achievements in enhancing SAP and Oracle security since 2007. Furthermore, it outlines potential risks associated with personal and financial data hacks, alongside several real-life case studies of security breaches within educational institutions.
Oracle PeopleSoft applications are under attack (HITB AMS)
- 1. Invest in security to secure investments Oracle PeopleSo, applica.ons are under a3acks! Alexey Tuyrin
- 2. About ERPScan • The only 360-‐degree SAP Security solu9on -‐ ERPScan Security Monitoring Suite for SAP • Leader by the number of acknowledgements from SAP ( 150+ ) • 60+ presenta.ons key security conferences worldwide • 25 Awards and nomina.ons • Research team -‐ 20 experts with experience in different areas of security • Headquartered in Palo Alto (US) and Amsterdam (EU) 2
- 3. ERPScan and SAP • Working together since 2007 Senior Director, Head of Global Security Alliance Management Product Security, Technology and Innova9on PlaSorm SAP Labs, Palo Alto, USA 3 “We would like to thank the world-‐class security experts of ERPScan for the highly qualified job performed to help us assess the security of our pre-‐release products”.
- 4. ERPScan and Oracle • ERPScan researchers were acknowledged 15 9mes during quarterly Oracle patch updates since 2008 • Totally 40+ Vulnerabili9es closed in Oracle Applica9ons – Oracle Database – Oracle Peopleso_ – Oracle Weblogic – Oracle JDE – Oracle BI 4 Oracle provides recogni9on to people that have contributed to our Security-‐In-‐Depth program. Oracle recognizes Alexander Polyakov from ERPScan for contribu9ons to Oracle's Security-‐In-‐Depth program.
- 5. About Me • Director of pentesing department of the ERPScan company • WEB/EBA/Network security fun • Hacked many online banking systems • Hacked many enterprise applica9ons Tweeter: @antyurin 5
- 6. Agenda • Introduc9on to Oracle PeopleSo_ • PeopleSo_ Architecture • Ahacks on back-‐end systems • External ahacks on PeopleSo_ 6
- 7. 7 Introduc.on to Oracle PeopleSo,
- 8. What is it? • Oracle PeopleSo_ Apps: HRMS, FMS, SCM, CRM, EPM … • Can work as one big portal or separately • Many implementa9ons in different areas 8
- 9. Industries • Large companies. HRMS/ FMS • Government. HRMS • Universi9es. Student Administra9on system 9
- 10. Regions USA 72% UK 13% EMEA 4% APAC 11% 10
- 11. Industries Pharmaceu9cal, 255 Compu9ng&IT, 940 Educa9onal, 1900 Retail, 437 Manufacturing, 1160 Telecommunica9ons, 227 U9li9es, 230 Agriculture&Food, 170 11
- 12. Why should we care • Personal informa9on – SSN – Salary data • Payment informa9on – Credit card data – Bank account data • Bidding informa9on – RFP – Prices 12
- 13. Why should we care • Espionage – The_ of financial informa9on – Corporate trade secret the_ – The_ of supplier and customer lists – Stealing HR data Employee Data The_ • Sabotage – Denial of service – Tampering with financial reports • Fraud – False transac9ons – Modifica9on of master data 13
- 14. Some cases • Two Charged with Hacking PeopleSo_ to Fix Grades (California state university) -‐ 2007 – hhp://www.pcworld.com/ar9cle/139233/ar9cle.html • Student sentenced to jail for hacking university grades (Florida A & M University) -‐ 2009 – hhp://www.geek.com/news/student-‐sentenced-‐to-‐jail-‐for-‐hacking-‐ university-‐grades-‐742411/ • Undergrad suspected in massive breach (University of Nebraska) -‐ 2012 – hhp://www.computerworld.com/ar9cle/2503861/cybercrime-‐hacking/ undergrad-‐suspected-‐in-‐massive-‐univ-‐-‐of-‐nebraska-‐breach.html • Hacking Higher Educa9on -‐ last years – hhp://www.darkreading.com/security/hacking-‐higher-‐educa9on/d/d-‐id/ 1109684 14
- 15. Some cases 15
- 16. Vulnerabili.es in PeopleSo, Some vulns every year, but no info for pentes9ng… 16
- 17. 17 Oracle PeopleSo, Architecture
- 18. PeopleSo, Internet Architecture • Many applica9ons, but they have one architecture • PeopleSo_ Internet Architecture – Internet oriented since version 8 • Based on several special core technologies 18
- 19. PeopleSo, Internet Architecture PeopleTools: • Technology • Developer tools • Framework • PeopleCode All of the applica9ons are created using PeopleTools. 19
- 21. PeopleSo, Internet Architecture Web server • WebLogic /WebSphere • PS Servlets • Forwards request from a browser to an App Server Applica.on server • PS Services + Tuxedo + Jolt • Business logic, SQL transac9on management, Transport Database server • System Tables, PeopleTools metadata , PeopleSo_ applica9on data 21
- 22. Hacker’s targets • High privileged access in PeopleSo_ (“PS” – super admin account) – A"acks on business logic – Cri2cal informa2on in PeopleSo8 • Remote Command Execu9on in OS – Access to a company’s internal network – Cri2cal informa2on in PeopleSo8 We can get RCE in OS if we have high priv. access. Conversely situa2on is true too 22
- 23. 23 A3acks on back-‐end systems
- 25. PeopleSo, “Back End” Authen.ca.on • User ID – an account in PeopleSo_ Applica9on. • Connect ID – a low privileged account in the RDBMS • Access ID – a high privileged account in the RDBMS 25
- 26. PeopleSo, “Back End” Authen.ca.on User authen.ca.on process: • User logs in with his User ID and password to the Applica9on Server. • Applica9on Server, in turn, connects to DBMS using Connect ID. User ID and passwords for it stored in DBMS tables are compared to the ones that were entered by the user. – Connect ID has limited rights, only to retrieve User ID and encrypted password from DBMS tables. • If the comparison went successful, Applica9on Server retrieves the necessary Access ID with the encrypted password. – Access ID with the password are stored in PSACCESSPRFL table. – Access ID account has high privileges. • Finally, the system reconnects to DBMS using Access ID with full access. 26
- 27. RDMBS accounts Some facts : • Common Connect ID – “people” with password “people”/”peop1e” • Default Access ID: “SYSADM” for Oracle “sa” for MSSQL • Connect ID password is o_en the same as Access ID password Let’s try to perform dic2onary a"ack on RDBMS 27
- 28. Connect ID has: • Access to 3 tables • Users’ passwords hashed with salt • AccessID and its password is encrypted Connect ID access in RDBMS 28
- 29. Is Access ID encrypted? • “The ACCESSID and ACCESSID password are stored and encrypted in the PeopleSo_ security table PSACCESSPRFL.” hhp://docs.oracle.com/cd/E18083_01/pt851pbr0/eng/psbooks/tadm/chapter.htm? File=tadm/htm/tadm13.htm • “The Symbolic ID is used as the key to retrieve the encrypted ACCESSID and ACCESSPSWD from PSACCESSPRFL” hhp://docs.oracle.com/cd/E26239_01/pt851h3/eng/psbooks/tsec/chapter.htm? File=tsec/htm/tsec06.htm Is Access ID really encrypted? 29
- 30. Is Access ID encrypted? • Is Access ID really encrypted? – No. • It’s just XOR with a hardcoded key – sBzLcYlPrag= -‐> SYSADM – kCSYMM0Crag= -‐> sa – gjb8YZpHnJo= -‐> asdQWE12 • Some facts for a brute force ahack: – Access ID max length – 8 symbols – Access ID’s max password length – 10 symbols • If we have Connect ID and network access to RDMBS, we can get Access ID. 30
- 32. A3ack on Developers • 2-‐Tier – direct connec9on to DBMS. – Trusted developers (?) Some tools (like DataMover) – A config is stored in the Windows registry – “Encryp9on” is the same • If we steal a config, we can have full access in RDBMS. 32
- 33. Developers • 3-‐Tier – connec9on through Applica9on Server. – A developer uses only his own PS User ID and password – It’s possible to restrict access for a developer (read-‐only privs) – Applica9on Server connects to a RDBMS with Access ID account. – Special “protocol” -‐ WSH, WSL (Tuxedo). – It’s a plain-‐text protocol. A user’s password in each packet. • Man in the middle a"ack will be useful 33
- 34. Developers • 3-‐Tier – connec9on through Applica9on Server. • Data inside packets look like plain SQL queries. Can a 3-‐2er developer send any SQL command to a RDBMS with Access ID? It should be so! 34
- 35. Developers 3-‐Tier – connec9on through Applica9on Server. • Weird Design. We see all queries of the default authen9ca9on process between Applica9on Server and RDMBS • A 3-‐Tier developer knows an Access ID and its password 35
- 36. 36 A3acks on front-‐end systems
- 37. External a3acker 37
- 38. Google Dorks 38
- 39. WebLogic • WebLogic management “/console” • On the same port with PeopleSo_ applica9on by default • Anyone can try to access the inside with default accounts 39
- 40. WebLogic. Users • A default Weblogic has no addi9onal accounts, except “system” with a custom password – Weblogic with PS has accounts: – system: Passw0rd (password) – main administrator – operator: password – operator role – monitor: password – monitor role * The password of “system” is o_en changed to that of “PS” • WebLogic account bruteforcing is blocked by default If we get access to a Weblogic server with system account, we will get out goal – RCE 40
- 41. WebLogic. Users What about operator and monitor users? Almost nothing 41
- 42. WebLogic. Force browsing Force browsing will help us. There are no sufficient authoriza9on checks. Examples: 1) Browse a server’s file system 42
- 43. WebLogic. Force browsing 2) How about installing a new applica9on (RCE)? Yes, we can do it! Some restric9ons: • Only with .war/.jar extension • Only “local” files 43
- 44. WebLogic. Force browsing How can we upload the file? Some ahempts: 1. SSRF + “jar” trick -‐ No success. The file has a wrong extension 2. Via PS servlet -‐ No success. The file has a wrong extension 3. A classic “UNC” trick for bypassing only “local” files restric.on. We should use any_serverevil.jar + Success! But only for Windows OS • If we have access to a Weblogic console, we can execute our code 44
- 45. 45 DEMO
- 47. PeopleSo, Users • “PS” – super administrator • There are many default users. • Before PeopleTools 8.51: password = login Like, PS:PS, VP1:VP1, PTDMO:PTDMO • A_er PeopleTools 8.51: password = PS’s password PS:Password, VP1:Password, PTDMO:Password • PS account bruteforcing is not blocked be default This is a pre"y good situa2on for brute force a"acks 47
- 48. PeopleSo, Servlets • Informa9on disclosure: 48
- 49. XXEs • Some of input points: PSIGW/*, Business Interlink, SyncServ • !!!No authen9ca9on !!! 49
- 50. XXEs • Common XXE injec9on impact: – We can read plain text files (not all) – SSRF – SSRF+gopher (if JDK <= 1.6) – SSRF+grab NTLM hashes/SMBRelay (if JDK <= 1.6 and OS = Windows) – Classic en99es DoS? – SSRF+jar trick for file uploading + we can list directories and read XML files! (no binary) CVE-‐2013-‐3800, CVE-‐2013-‐3819, CVE-‐2013-‐3821 Patched in CPU on the 16th July 2013 (cpujul2013) 50
- 51. Encryp.on Encryp.on of password in config files: – Some passwords of PeopleSo_ are stored in plaintext – Some – DES – Some – 3DES – Some – AES (Weblogic) DES – The key for DES is hardcoded – Was used for encryp9on in the older systems – Has no ID at the beginning (such as “{V1.1}”) 51
- 52. Encryp.on 3DES – The key for 3DES is standard by default. – You can check it. The string “{V1.1}” before an encrypted password shows the key is default. – A_er each key regenera9on, the number is changed (1.2, 1.3…). – Do you regenerate it? AES – If you want to decrypt with AES, you need SerializedSystemIni.dat. – You can understand that it is AES by the “{AES}” string in the beginning of an encrypted password. 52
- 53. XXE A3ack Vectors 1. If we have network access to the RDBMS, we can read Connect ID, get Access ID and pwn PS DB. 2. From the mul2tude of configura2on files, we can retrieve various accounts (in the case of v. 1.1 or an old PT version with DES). If an administrator re-‐use a password, we can try to login with the PS account in Portal. 53
- 54. PS IGW • PS IGW supports remote configura9on. There are opportuni9es to read and write a IGW configura9on file via special XML requests. Auth is required. • Old PT versions use “password” as a default password for different services. New PT versions use PS’s password as a default password for different services • No defense against brute force ahack • The PS IGW password is stored in a config file. PS IGW’s password is DES/3DES encrypted. The file is readable via XXE. 54
- 55. PS IGW. A3ack Vectors • Turn on a XXE feature for a IGW’s XML parser • Read a lot of different passwords • Change a path of Java classes loca2on and get RCE * • Set a XSL transforma2on and get RCE * • * Haven’t been fully tested yet 55
- 56. 56 PeopleSo_ SSO
- 57. PeopleSo, SSO • A PeopleSo_ applica9on supports his own Single Sign On technology • A PS applica9on sets a special “PS_TOKEN” cookie for a user a_er successful login. Another PS applica9on checks the cookie and authen9cates the user • How does it work? Pre-‐Shared Key. • The same password should be set on each node “Nodes represent any organiza9on, applica9on or system that will play a part in integra9ons.” • A node has a name. It is necessary to set nodes trusted by the system • A user name should be in both applica9ons 57
- 58. PS SSO 1. Login + password 2. Access to PS + PS_TOKEN cookie Node name – FMS1 Node Password – 123 Trusts to HRMS1 Node name – HRMS 1 Node Password – 123 Trusts to FMS1 58
- 59. PS_TOKEN PS_TOKEN: hhp://docs.oracle.com/cd/E15645_01/pt850pbr0/eng/psbooks/tsec/chapter.htm? File=tsec/htm/tsec10.htm • UserID • Language Code • Date and Time Issued • Issuing System – Node name • Signature = SHA1_Hash ( UserID + Lang + Date Time issued + Issuing System + Local Node Pswd ) Local Node Password is a “pre-‐shared key”. This is only one unknown value 59
- 60. PS_TOKEN. Priv Escala.on What can we do in theory? • Get a PS_TOKEN cookie • Get all necessary values and a signature from the PS_TOKEN. It’s base64 encoded • Make offline brute force ahack on PS_TOKEN. Just add passwords to the values and compare results of hash with a signature. • SHA1 – we can do it really fast with GPU If we get a node password, we can create a new cookie with “PS” user name and get full access in PeopleSo8 Applica2on. 60
- 61. PS_TOKEN. Priv Escala.on. Real Life • Reverse Engineering (Thx for hhps://goo.gl/hRklU6 ) General view: – Magic/Sta9c numbers – Lengths of parts – SHA-‐1 hash – Compressed data: o UserID o Lang o Node Name o Date And Time • Don’t trust Oracle’s documenta9on =( • Our new tool -‐ “tockenchpoken” can parse, brute and re-‐create a PS_TOKEN cookie 61
- 62. Worse than you think • A PS applica9on can consist of some nodes. But there must be one default local node. Of course, it trusts itself. • It looks like a PS applica9on uses SSO by default. Even if we have one applica9on, it gives us PS_TOKEN a_er authorisa9on. So we can perform the a"ack on a standalone PS applica2on. 62
- 63. PS SSO 1. Login + password 2. Access to PS App + PS_TOKEN cookie 3. PS_TOKEN cookie 4. Access to PS Node name – HRMS 1 Trusts to itself (HRMS1) Node Password – 123 63
- 64. 64 DEMO
- 65. Worse than you think Restric9on: • As we want to get a PS_TOKEN cookie, we need to have valid creden9als on a PS server for the ahack. And how about an anonymous ahack? 65
- 66. Worse than you think It looks like: • It’s impossible to have access to some resources of a PS Portal without authen9ca9on. • But some9mes it’s necessary. Like, “Jobs forms” or “Forgot your password” • You must set up a special auto-‐login user in a PS applica9on with minimal privs • And, of course, the PS applica9on gives you a PS_TOKEN cookie So, we can get PS_TOKEN and perform an a"ack “without” valid creden2als. 66
- 67. Even worse than you think • PS SSO can be used in other Oracle’s applica9on. Like, JD Edwards • PS_TOKEN can be used for authen9ca9on in PS IGW • A PS_TOKEN cookie is o_en set for a parent domain (.server.com) • There is a (default) value for a node password – “password” How can we defense a PS applica9on? • Use cer9ficates instead of passwords • Set a really strong password for nodes (max – 24 symbols) • Set “No Authen9ca9on” for nodes 67
- 68. Overview Internal a3ack vectors: • Get Connect ID -‐> Get Access ID -‐ > Pwn PS • If you are a developer, you are an admin External a3ack vectors: • Weblogic default account -‐> Authoriz bypass -‐> RCE • XXE -‐> Read configs -‐> Access to Weblogic -‐> RCE • Brute PS IGW account -‐>…-‐> RCE • Get PS_TOKEN -‐> Brute a node password -‐> Create a new PS_TOKEN -‐> Pwn PS 68
- 69. ERPScan – leaders in Research 69 60+ Innova.ve Presenta.ons in security conferences in 25+ countries
- 70. ERPScan – featured in: 70
- 71. ERPScan Research – Leadership in ERP Security • 300+ vulnerabili9es in top vendors including SAP and Oracle • 60+ Innova9ve Presenta9ons in security conferences in 25+ countries • Award-‐winning research papers “SAP Security in figures” • Authors of the Book about Oracle Database security • Experts in different areas from Mobile to Hardware 71 The company exper2se is based on research conducted by the ERPScan research center Research
- 72. About Each ERP landscape is unique and we pay close a"en2on to the requirements of our customers and prospects. ERPScan development team constantly addresses these specific needs and is ac2vely involved in product advancement. If you wish to know whether our scanner addresses a par2cular aspect, or simply have a feature wish list, please e-‐mail us or give us a call. We will be glad to consider your sugges2ons for the next releases or monthly updates. 72 228 Hamilton Avenue, Fl. 3, Palo Alto, CA. 94301 USA HQ Luna ArenA 238 Herikerbergweg, 1101 CM Amsterdam EU HQ www.erpscan.com info@erpscan.com