Everybody forced here ripping 2022 tops museum collection baseball hobby six box half case number 26 pick your team style Andrew a Andrew R. Has the Dodgers Christopher S. Tigers Cody S. Brewer's Braves Rockies Daniel B. Cubs Denny M with the White Sox Ed B. Phillies Eric R. Angels Mariners Jonathan Q. Red Sox Kevin R. Cardinals Nationals Padres Matthew B. Rangers Michael P with the Diamondbacks To oh no no here we go Michael B has the Royals and Rays Ryan B with the Guardian Satoshi Red Scott F. Yankees Sean M. Metz Sean H. Giants Shemez with the Blue Jays Simeon A's Stephen T. Marlin Stephen K with the Astros Timothy M of Pirates Twins and Troy L with the Orioles Good luck everybody. Thank you for joining Copper Peter Lonzo Shane Buzz starting off with a Cardinals archival autograph of Ted Simmons 35 of 50 That's can't stop the room.  Copper Piazza you've got dual Jersey auto Boba Shet Blue Jays 276 of 299 usually it's like one or two that are front-facing and then it just flips All right, blue rookie Angels Brandon Marsh 82 of 150 Thomas got canvas Dodgers Freddie Freeman and Jersey Card Phillies J.T. Romuto 13 of 50 copper rookie Royce Lewis Quad Jersey clean Kershaw Justin Verlander Jacob DeGrom and Garrett Cole 8 of 99 got Dodgers Astros Mets and Yankees You need over 50% majority to get the card out, right? Andrew R with the Dodgers Astros Stephen K Mets is Sean M. That's a random at the end Either by my Phillies playoff tickets right now illegal for when I go to Philly in a couple weeks Maybe they'll still be in it. Yeah, I got waiting to go through Maybe the Phillies will be in it rookie red Red Sox Jerrod Durand 12 of 50 Or 17 of 50 archival auto rookie for the White Sox Gavin sheets 86 of 299 There's got there. They're good. They're gonna flip them. Really? They should be old Those were left here I don't know what goes on when it's not me and you I don't know what happens God canvas angel Shohei Otani Bernie Williams Yankees triple relic auto 92 of 150. All right, third down. Let's go pass.  He looks so good this year CD with a nice game AJ Brown killed it again Jumbo patch one of five Christian Yelich Nasty patch brewers Nice one of five dude, that is a crazy one Congrats to Cody s the Yelich jumbo Don't show Caleb that one Decad a big game to Copper Otani say a Suzuki rookie a quad relic twins Byron Buxton seven of 75 Heavy heavy pack here, what do we got? Framed card probably I'm not thick enough for a book Yeah, framed auto coming. Good luck everybody It's black frame copper Clemens O'Neill cruise Ricky base We've got a two of five black frame auto Mariners Edgar Martinez That's sick. The black frames are awesome, man There you go Mariners Sweet card Magda one for a Mariners copper Rookie O'Neill cruise again for the Pirates Jersey card Braves Ronald Cooney jr. 43 of 50 Gary copper Jersey card for the Braves Gary Sheffield 8 of 50 and Red rookie Alec Thomas for the D-backs nice 3 of 50 on the Alec Thomas Green rookie one-of-one angels Brandon Marsh There you go halos First one-of-one base parallel that I pulled I think that we pulled Congrats on that one. That's awesome and quad relic rays Randy Rosaranda 27 to 75 So what is it again with all the like flags and stuff on there? On there like jerries or whatever like bill check. I was like a Croatia thing on his shirt This is lineage Croatian Sabin Cody all right guys halfway through the break copper Cal Ripken jr Yankees dual Jersey auto Louis Severino 118 of 299 copper Eloy Joe Ryan rookie archival auto Giants Juan Marachal 39 of 125 Blue for the Angels is Anthony Rendon 33 of 150 canvas A's Dennis Eckersley Patch card Astros Alex Pregman 23 of 25 nice three colors there Like we'll see a book in one of the last couple of boxes. I would like that copper Verlander Quad relic here Peter Lonzo Reese Hoskins Freddie Freeman and Ryan Zimmerman Mets Phillies Dodgers and Nationals 73 of 99 Assume that's a random again. You need over 50% majority. So you need three of these Mets Sean M Phillies Ed B Dodgers Andrew R. Yep, that's random at the end Now Carl Pats are in it man Pats are in it Taking it copper Boba Shet Bobby Whit Jr. Rookie base canvas Angels Shohei Otani Rookie superstar showpieces on a Josiah Gray Nationals two of 25 Like those designs. I look like tops five star the superstar showpieces this year It's like five star baseball copper Kirby Puckett Mariana Rivera archival autograph Yankees 110 of 125 Nice Rivera. We'll get that mag for a Yankees and A Yankees quad patch card Jean-Carlo Stanton Aaron judge DJ LaMahieu and Glaver Torres for 25 Great mini box for the Yankees fourth quarter tie game copper Shohei Jayrod Rookie base Jersey card Yankees Luke Voight 16 of 50. Let's go First down from Andre Stevenson. That's right. That's right Purple Ted Williams Red Sox 62 of 99 twins dual Jersey Otto Byron Buxton 70 of 299 Nt basketball seven to go everybody Seven to go No, not yet frost. You're in the last box here. You won't come in Maybe a wit maybe a wander copper Miguel Cabrera. We got Bruhan Artist-proof jazz shism jr. On the Canvas there. So yeah, no hitting that pack. A lot of times there's two in one though So we'll see copper Null and our Renato. There's a wander base Dual Jersey Salvador Perez Buster Posey Royals and Giants probably random at the end Giants Sean H. Royals Michael B. Yep, random at the end. This game is flying by. Yeah So like I said Do a relic Otto for the Rockies Larry Walker that and Jersey 57 of 100 Come on. Come on zappy tearing it out. Oh, he's got him down to the 10 copper Albert pools And a patch card for the Rockies in the back 10 of 10 is Charlie Blackman I think I'm out of college, but he's he's had a he's had a tough role, but he also hasn't improved much so The three randoms in the half case. I've that's that's a lot from museum All right, so three multi-randoms here first one is going to be between the Royals of the Giants dual Jersey Perez and Posey After that it's going to be quad relic for Alonzo Mets, Hoskins Phillies Freeman Dodgers Zimmerman Nationals Then so quad relic for some pitchers here Kershaw Dodgers Verlander Astros Degrom Mets and Cole Yates. Good luck Randomize five times whoever's up top gets the cards five times on all of them one two three four and five Royals get the dual relic five times on the first basement card here one two three four five Dodgers get it and then five times on the pitcher quad relic one two three four and five Yankees get that one. So Yankees got the pitcher quad Dodgers got the first basement quad there Royals got the dual pitcher Jersey card Rockies patch card Charlie Blackman at the 10 Yankees Jersey Voight to 50 Yankees quad patch there to 25 nice patches on the Yankees card Astros Bregman to 25 Razor Rosa Reina to 75 quad relic Braves Jersey Gary Sheffield. That's interesting Braves Jersey Ronald Acunia Twins Byron Buxton quad relic to 75 jumbo patch one of five Christian yellows Brewers Jersey card Billy Israel Muto to 50 autos now Rockies Larry Walker dual relic auto to 100 Buxton for the Twins to 299 Superstar showpieces rookie on-card auto Nats Josiah Gray 225 archival auto Giants Marichael the 125 Dual Jersey auto Yankees Louis Severino to 299 triple relic auto Bernie Williams Yankees to 150 Rookie auto White Sox Gavin sheets at 299 dual Jersey auto Boba shed blue jays to 299 archival auto Cardinals Ted Simmons to 50 You get a Yankees archival auto Mary on a Rivera 125 one of one rookie green parallel Brandon Marsh Angels and Two of five black frame auto Edgar Martinez Mariners. That's gonna do it. Thanks everybody. We've got more baseball coming up


The Senate narrowly voted to strip Biden of his authority to mandate vaccines, so Biden doesn't have the power, according to the U.S. Senate, to save lives by mandating vaccines. However, they do believe that he should have the power and authority to sell Saudi Arabia weapons that they will almost certainly use against innocent civilians in Yemen. So according to the U.S. Senate, can't save lives, but you can take lives. That's what they approve of with regard to Biden's executive power. Now, one Democrat in particular, Chris Murphy, has done a 180 seemingly for partisan reasons because he once thought that the president shouldn't have the power to sell Saudi Arabia weapons while they're carrying out a genocide against the Yemeni people. But now, all of a sudden, that Biden is in control, it's a different story. So Sarah Sarota and Austin Allman of the Intercept report, the Senate tonight voted 67 to 30 against the resolution to ban a 650 million air-to-air missile sale to Saudi Arabia approved by the State Department. The resolution was introduced last month by Senators Rand Paul, Bernie Sanders, and Mike Lee. A message needs to be sent to Saudi Arabia that we don't approve of their war in Yemen, Paul said at the time. By participating in this sale, we would not only be rewarding reprehensible behavior, but also exacerbating a humanitarian crisis in Yemen. Senator Chris Murphy, who partnered with Sanders and Lee in November of 2018 to invoke the 1973 war powers resolution to prohibit U.S. participation in the Saudi bombing offensive in Yemen, notably didn't back his colleagues in this latest effort. His vote of opposition represents a significant shift for Murphy, who claimed in an email to the Intercept last month explaining his support of the sale, I have been the leading critic of Saudi Arabia's war in Yemen. Quote, this is a true defensive weapon sale, he told the Intercept ahead of the vote. Murphy, who led reforms to exert congressional oversight of the White House during the Trump administration, claimed that the power to use AMRAAM sale as leverage should rest with Biden. I don't think Congress should take that ability away from the president, he said. I think the president should have this sale and be able to use it in discussions with the Saudis about their policy going forward. So this is an incredibly disingenuous and hacky argument. His argument for why we should give these weapons to Saudi Arabia is because it is defensive because Saudi Arabia needs to have the capability to shoot down Houthi drones, except everybody knows these are inevitably going to be used against Yemeni civilians.  So will you come out, Chris Murphy, and apologize when we ultimately find out that these weapons were indeed used against Yemeni civilians? Will you apologize when you find out that these weapons that you're agreeing to give to them are used in their blockade of Yemeni ports? I mean, this is catastrophic and yet you're agreeing to this. So it's predictable, but frustratingly so.  Again, let me just put things into perspective for you in terms of the United States' priorities here. Saving lives by mandating vaccines, horrible. Taking lives by giving weapons to Saudi Arabia, which you know will be used against civilians, fine. It's just, it's a joke. Now, I want to share a clip from Rand Paul and Bernie Sanders. I do not like Rand Paul, but Lovramar Haydn, what he says here is absolutely correct. And what Bernie Sanders says with additional data and facts about this situation is absolutely necessary for every single person to hear. So they find out how egregious this is. And we are complicit. We are arming the Saudis and allowing this to happen. Offensive, defensive. They shouldn't get any of our weapons. We should stop selling them any weapons until they stop starving the country of Yemen. President, I find myself in the somewhat uncomfortable and unusual position of agreeing with Senator Paul. The understanding that it is Congress that has the constitutional responsibility to authorize war, not the President, should in fact transcend partisan disagreements. As the Saudi government continues to wage its devastating war in Yemen and repress its own people, we should not be rewarding them with more arms sales. We should be demanding that they end the devastating war in Yemen, which has killed over 230,000 people in one of the very poorest countries on Earth. For more than six years, the Saudi-led military intervention in Yemen's civil war has been a key driver of the largest humanitarian disaster in the world, the largest. According to UNICEF, four out of every five children in Yemen needs humanitarian assistance. That is over 11 million children. 400,000 children suffer from severe malnutrition. 1.7 million children have been displaced from their homes by violence from this war. And some 15 million people, more than half of whom are children, do not have access to safe water, sanitation, or hygiene. Mr. President, my simple question is, why in the world would the United States reward such a regime which has caused such pain in Yemen with more weapons? My friends, the answer is we should not. So they're both absolutely correct. This is a test of morality. It shouldn't be a partisan issue. This should be a human issue. Saudi Arabia is an absolutely brutal, bloodthirsty regime that doesn't care at all about human rights. So for you to agree to give them weapons, I mean, how do you sleep at night? I just, I don't know how you're able to live with yourself knowing that what you're doing is enabling a regime that will ultimately do violence against innocent civilians. It's truly morally reprehensible, but these folks, they have no moral conscience in the Senate. They just, they don't care. They couldn't care less. Now, you know, I bring up this weird double standard where saving lives according to the Senate is bad, but taking lives is fine with them. But what's interesting is that like people such as Rand Paul, you know that he voted against the vaccine mandate. So he's going to preach all high and mighty here about the need to save lives, and he's correct about that. But also he doesn't apply that to the vaccine mandate, which specifically will save GOP lives because they're the ones who are the most vaccine hesitant. And same like Chris Murphy, Chris Murphy, who I ripped on in this video rightfully so, is against, you know, limiting Biden's authority to sell these weapons to Saudi Arabia, but he probably supported the vaccine mandate. So it's just, there's no consistency here. There's no real respect for humanity and human lives. And you know, it's, it's frustrating. But nonetheless, it's totally, totally predictable at this point.


Hi, this is a mock up of the new filtering interface we're developing for the recent changes page. Today I'm going to show you a couple of quick examples to demonstrate how an edit reviewer might use some of the new capabilities we're building. These examples focus on the Aure's filters. Those are contained in the first two groups here in the drop-down menu. The first example is a simple one of how you might use the Aure's tools as a vandalism finder. I'm going to pick the broadest of the quality filters to find edits that may have problems. Okay, I see that I still have a lot of edits in my results, so I'm going to cut down my sample by filtering further for edits that may be bad faith. Now that's a perfectly reasonable setting, but I still have a lot of results, so I'm going to take this a little further. I want to prioritize my work by focusing on the edits that are most likely to have problems. I could do this in two ways. The first would be to change my filtering, so instead of choosing those edits that may have problems, I'm going to filter for the edits that are very likely to have problems. Okay, that worked, but now I don't have many edits to work with. So the second way to prioritize my work is to use highlighting. I'll switch my filtering back to may have problems. Once again, I have a lot of results and don't know where to start, so I click on this highlight results button. That brings up the highlight menus. You can see them here. Now I can leave my filtering options as they were, but use colors to help make these results more meaningful. I'm going to make likely have problems yellow and very likely have problems orange. So now, as you can see, everything here is the intersection of may have problems and may be bad faith, but the most likely problem edits are colored. And incidentally, when I look in the margin here, these dots confirm for me what I might have guessed, that every edit that is very likely is also likely. In other words, very likely is a subset of likely, just as likely as a subset of may. Okay, I'm going to quickly show you one more example. This time, you can use these filters to help support good faith newcomers who might be struggling. I'll click the trash can to clear the settings, then I'll restore the default filters. This time, instead of bad faith, I'm going to filter for good faith. I'll look for likely have problems, but I'll highlight very likely have problems. And I'll go down to the newly added newcomer filter and make that green. Now I can see that every green row is a good faith newcomer who is likely having problems. The green and yellow rows are where I'll start reaching out, since those are the edits that are most likely in trouble. Okay, that's it for now. I hope this new interface looks like something you think will be helpful for your reviewing work.


you want to do some presentation that has to do with you presenting data. How do you go about that? That is what we're starting with. There are some best practices that we need to be aware of that whenever you want to present data, what are the things that you need to bear in mind? What are the things that you need to have put into consideration before you go into that all to present something that has to do with data? That is why we're starting with actions because really whenever you're having a presentation, the essence of the presentation is so that your audience can take some actions. You want them to take a shift from something. You want them to understand where we're coming from and there is a place you want us to be in and then you want us to now take that shift up to get into that place. That is the essence of our presentation because we started our conversation around clarity of our visuals. You want to present something, you should have something clarity about it.


Hello and welcome. This is the ER Pwnage Threat Simulation Against SAP. This is a talk being given to the red team village at Defcon 28 Unfortunately with corona going around we can't really meet in person and talk through this, but Let's try to make the best of it. Hopefully you can get something out of this talk on targeting SAP All right, so who am I? My name is Austin Mark I'm a reformed basis admin. Basis admin is just the sys admin of the SAP world So they might do implementations migrations upgrades stuff like that So I got out of that went into doing a full-time pen testing number years ago, and I've been employed at RSM You've got my website a mark calm my Twitter and then my github And I go by the handle cryo and I have for quite some time Cool, so what is this? This is anthology. This is a talk being given to the red team village. It's a lightning talk about SAP anthology is just a Collection of talks that I'm giving this year and hopefully for years to come. This is just how I organize my talks and make sure things are Easy to digest and if you're interested in one topic, maybe you're interested in another so What is the goal? The goal of this talk is to provide red teams with enough knowledge to target SAP And kind of strike a balance between the new and the practical things that are tried and true and aren't going anywhere But then also speak at least briefly to some of the new and exciting techniques or exploits that we're seeing today Why SAP? Because it's unnecessarily complex in my opinion difficult to update and business critical Some of what we're going to talk about here can be applied to other ERPs What will be focused on SAP? They have allegedly well over a hundred and twenty thousand installations worldwide But some of the techniques that will be will be presenting on here can be applied to any ERP or anything you're attempting to target So some of this is going to be kind of ERP agnostic or target agnostic But really we're going to try to dive deep into SAP and focus mostly on on that ERP so the goal of this talk is to walk through some of those tried and true techniques and And review some of those vulnerabilities and give you a jumping-off point for attacking SAP All right, so on to the agenda. What are we going to cover? We're going to talk really quickly about what SAP is How we get into SAP? What if we want to get out of SAP and maybe move laterally and then what the impact of some of what we're doing is so As Red Teamers, maybe sometimes we just care about access We should we should be able to at least speak to what the impact is to the business and what we were able to get Access to all right. So what is SAP? SAP is an ERP. It's a suite of enterprise tools for management enterprises have to store it all somewhere and SAP wants to be that single point of truth. So if you can manipulate that single point of truth, the impact can be pretty substantial All right, and lastly, how do we get into SAP? So there are a number of recent exploits that have been released including 10k blaze recon, etc These are going to take a while for a lot of businesses to patch many SAP systems don't go through the standard patch Tuesday that you see with other Back end systems that support a business that tend to wait for a support pack or something that will effectively Hatch all of this at once with minimal downtime in the case of 10k blaze or to have regularly miss patched or Applied what they believe to be a patch without adjusting their ACLs And this vulnerability is unlikely to go away anytime soon But we're red team here. We really don't rely on poor patching practices practices to gain access And move laterally tried and true techniques such as session hijacking credential harvesting and phishing haven't exactly gone by the wayside Lastly, we'll talk a little bit about some of the impact of getting access into SAP Where it might help you elevate your privileges or crack bigger passwords or even pivot into a new exciting network Finding SAP so where's the fun at the SAP router is something that we regularly find because SAP requires it for support So if you're trying to get support from SAP you have to have this router installed And exposed to the web Also, we regularly find web services that are disclosing the exact landscape OS patch level Services running on the SAP Internal infrastructure and of course LinkedIn right we have third-party contractors all the time that are disclosing the exact client They're working for what they implemented what patch the level they moved everything to And support packs some of them are even kind enough to explain exactly what Security systems have been implemented in the case of the consultant on the very bottom But kind of the same thing that you would do for any other type of red team or any other type of investigation there are some SAP specific services and In background information that you can use to just further inform where you're going to target if you're trying to get into SAP All right, so moving on to some common exploits 10k blaze I don't think this is going anywhere 10k blaze is what I like to think of as the MS-17010 of the SAP world It gives you full-blown RCE. You can find it pretty much out anywhere and the impact is typically severe What's worse than MS-17? It's difficult and can be confusing for a business to patch Great research and proof of concepts were published by Dmitri and Matthew of for what was actually an older vulnerability They got a lot of attention during the proof of concept and During the talk they gave at opcode At the bottom of the screen, you've got a one-liner to dump hashes from the database this is a fully anonymous No, no authentication required command execution vulnerability with an SAP that without appropriate ACLs put in place You're going to get code execution as SID ADM SID ADM user is effectively the the SAP administrator, so you have full Accessful rights to add users dump tables You've essentially a full control over over the SAP system at that point. All right recon the new hotness a Few onapsis researchers identified in disclose cv 2020 6287 and 6286 Both of these are impacting the SAP Netweaver Java stack application servers. These servers are regularly exposed to the web That's a big part of why this is a concerning vulnerability Proof of concepts were developed and released by Dmitri same individual who also released 10k blaze This proof of concept was later built upon by zero Steiner and That proof of concept has since been merged into Metasploit the POC adds an administrative user that can then take full control of the SAP Java system The vulnerability relies on an authentication bypass and the application configuration wizard The fix is a little bit more straightforward than 10k blaze You can simply patch or disable the LM manager altogether And if you are to do that you're you're relatively safe The the high risk of this is that while 10k blaze is typically only seen on internal networks and relies on a Weakness and say the SAP router ACL This is something that's just directly exposed to the web and it's gotten a lot of attention from bug bounty hunters You are going out and creating proof of concept admin users And disclosing them to companies probably a little risky for that to be going on on some of your business critical systems All right, so fast-tracking your career as a basis admin SAP volans are fun, but there are plenty of ways to get initial access We do red team stuff We aren't here to be limited by a couple volans or patch management if you have a target or you want to have a target Basis admins are probably one of the best targets for gaining substantial access into SAP Basis is just a fancy word for SAP admin sometimes they are Sometimes they have special admin access sometimes special network access But they definitely have the rights that we're after And typically they're over provisioned with roles like SAP all which is effectively domain administrator for SAP admins one of my go-to's and tried and true techniques is RDP hijacking a basis session still works in most environments Getting that level of access typically means that we're going to go down the 80 pen testing road And I don't want to talk too much about that here But RDP hijacking is still super useful in environments and not just for SAP, right? This is something that we've used plenty of times when we're trying to get access into another ERP that might be the target and We might not have the software that's required even if we have credentials to log into those systems If your access permissions and rights or my access permissions and rights, I'll get where I need to go at the end of the day Regularly you'll find these basis administrators in their own group instead of active directory that should really narrow down where you're trying to We're trying to target and they regularly post contact information on an intranet. That should also give you a couple Directing points on where you can go find some of these users We also have a couple RDP hijacking demos here on the right That I've pulled off a double pulsar Just in case you're not familiar with RDP hijacking. There is a Mimi Katz module for it as well I believe this works since up all the way up to server to 2016 oh, we've got him hijacking a session and he's got some some sort of I was here first Really what you're doing is you're just stealing a session and you're assuming though the admin still logged in Doing his work even if the credentials are MFA or anything else You're you have their session at that point. All right, cool All right, phishing SAP users phishing is still consistently and regularly One of our most successful paths for initial access Excel macros continue to be useful But if you have SAP GUI scripting enabled which it almost always is in my experience They work particularly well for phishing for initial access directly into SAP SAP Excel macros aren't gonna have the common indicators of compromise that you would see when you're trying to fish for a Getting a C2 directly into memory Sure, there's a macro with an IPv4 or hostname pattern And an OLE object is created But that's not gonna trip AV or EDR on its own the bottom You can see a virus total looking at some very simple SAP macros that were created No, nothing is going to pick up on this. Yes, you don't have the same type of Shell access that you would have otherwise, but you could potentially use this with Some sort of SAP payload that when executed runs in the context of the user that's executing it if single sign-on is enabled SAP GUI scripting is something that almost every business relies on But if you're following along at home You probably are noticing that you're still gonna need a hostname a client number, maybe even a domain for Sending this type of information on behalf of a user. You still have to know where the SAP systems are which is not a huge problem If you're trying to get hostname so SAP web dispatcher is absolutely everywhere. It's regularly disclosing SAP hostnames domain schema services and patches. I Rarely see it require authentication at all, but if it does require authentication typically if you go from Slash default.html to index.html it bypasses authentication entirely it will disclose the hostname services OS version patches and and in my experience very rarely requires off at all Yes, these services can be disabled But you can also check at slash SAP slash public slash info But if you're able to grab the hostnames of some of these machines that you're trying to target you can pre-create SAP malicious GUI scripts or VBA macros and There's just a quick screenshot of all of the SAP Netweaver ICM services that are potentially disclosing this information Out of the web and I guarantee you there are plenty more All right, so let's talk about grabbing some plain text credentials If you can get shell access on an SAP user system those same SAP GUI scripts We just discussed are also worth hunting for regularly. They'll have hard-coded credentials And there might be some fun back-douring or persistence opportunities for those scripts If a single sign-on is not enabled SAP uses what's called SNC for encryption If you have shell access and you're able to find yourself in a man-in-the-middle type of position You can use an SAP Wireshark sector plug-in That will quickly look through and parse out passwords directly from SAP p-caps There's actually a Wireshark filter that does exactly that shout out to those guys who wrote this fantastic plug-in I've used it somewhat regularly if I can find a way to man in the middle of the traffic between an SAP system and And the the user systems a little bit of background on the user types that you might be able to collect You may get access to Dialog or non-dialogue users a dialogue user will allow you to just log in to SAP You can kind of think of it the same way you would an active directory domain user account and then similar to an active directory Service user account you have non-dialogue users. Those are users that cannot directly log in to SAP instead they will execute RFCs or ABAP code externally and they can't log directly into the system so if you do have access to a Non-dialogue user you may still be able to take advantage of some of the elevated rights that you have in that context Kind of show that and prove that out. I wrote RFC phone. I'm sure there's other tools that do the same thing But this was the tool that I pulled together You can see on the right-hand side Impact style enumeration and exploitation tool We have the IP the clients a user and a password that we were able to gain access to And we're going to copy that user's rights into a dialogue user called SAP priv user Script runs Collects those user pribs and moves them over to a brand new user We can also rag run the flag tack dump and that will give us all of the Shaw hashes for for an SAP system. So this is just a very quick proof of concept I plan to make some updates to this tool here soon Feel free to follow it. I plan to post something here in the next coming weeks But really this tool is designed to demonstrate the impact of compromising service accounts. Cool So let's talk about cracking those hashes B code is best code There are three types of hashes you'll typically see as part of testing SAP systems There are also SAP secure cred store hashes, but we're not going to really talk about that Those are better club covered by other talks. What I'm really most excited to see is backward compatibility enabled for Logons, which will mean that there's B code hashes. B code hashes are Will force every character to be uppercase and it will truncate the password to eight characters You might actually have a password that's much longer But if you can crack the first eight with B code and then maybe the last seven with a Hashcat mask attack for a 15 character password. You can start cracking out very very long admin passwords That would be difficult to crack otherwise There's a lot of ways to gather those those hashes be a different table reading boppies or Or even just accessing the usr-02 table and SAP and exporting a CSV On the bottom you can see some of the hash cat codes to crack these passwords in the back You can see a simple mask attack that executed almost immediately Where we were attempting to crack out a B code hash Using just a uppercase uppercase uppercase eight character password cracked out with password And then on the right hand side, you can kind of see what it would look like to pull these out of usr-02 There are also scripts that will pull these exact same tables And if you're trying to grab similar hashes you can do that inside of our c-pone as well But B code is the best code that is definitely what I'm looking for And I regularly see because it is required for supporting older kernel versions of SAP I think anything before 7.0 you have to be supporting B code All right code execution So everybody loves code execution. So we have hashes and we have access into SAP, but everybody wants shells If you're new to SAP, SAP comes with this handy decode called se38 and There's a transaction that you can run called rsb-d-c-o-s-0 You run that report it will give you a very basic shell and you can cat out at the password And and run some very standard commands but if you want to go above and beyond and you want to Find your own commands and run pretty much anything you want SM69 is the way you want to go. That is another T code with an SAP It's a little finicky to get a reverse shell or netcat out Shell a simple fix that that works for me is to curl over a one-liner name pipe reverse shell and After pulling that over you can execute it as a custom transaction. This is a very loud attack, right? You're gonna show up as a brand new program type Within this table, but if you're looking for a shell, this may be a way to to gate access So we've got a quick video of kind of what that looks like on the right hand side. You have a Transaction that I've created here. I'm just executing the script that I just curled into the standard directory I'm not listening yet. So we ran it once not listening come back up run it again And we've got a shell all right And lastly, we're going to talk a little bit about fuzzing SAP just some things that I've seen work Radams has been very very successful in fuzzing SAP in the past You can see a few ERP scan security researchers who have found vulnerabilities using it back in 2016 2017 Using that same framework, I like to use Cisco mutiny which leverages part of radamsa and automates a lot of the process of extracting potential fuzzers creating the fuzzer and then Being able to do fuzz cases all based off of just some p-caps you can pull out a wire shark and then you can of course use that wire shark deceptive that we talked about and Begin to understand what exactly is being fuzzed how it's being fuzzed and and dive deeper into the binary And to that end one of the things that I've been finding Kind of interesting and I haven't seen a ton of success with it yet But really excited about is this ball and fanatic plug-in for binary ninja that we'll go out look for sources and sinks and start Highlighting parts of the code inside of the control flow graph and maybe show you where a potential buffer overflow from a mem copy or a scan F Could be happening within the binary itself So on the right-hand side, you've got the HANA database index server and some potential buffer overflows up at the top That ball and fanatic believes that it's identified and then lastly I'm just gonna release a old POC that I had for Crash inside of the HANA database server that affected every version up until last August So if you haven't patched since this time last year consider patching But hopefully somebody can find it useful or at least kick some tires for somebody So those of you with a red teaming background or pen testing background have definitely touched impact it or a tool That's built off of impact it Similar but for SAP is pie SAP. It's a library for crafting SAP network packets built off of Skappy Martin Maintains this he does a fantastic job. He has a ton of example scripts Strongly strongly recommended for trying to craft SAP fuzzers The HDB off module is something that recently got pushed out. I'm super excited to try that out on my own One of my favorites and you can see it on the right hand side is this MS dump param example module that will tell you some of the potentially Sensitive settings that may or may not be enabled If you look at the right hand side Some of those have exclamation points and if we look down toward the bottom, we can see login password Downwards compatibility is set to zero now that would be a good thing, but bear in mind. This is just the The operating config not necessarily the running config. So even if it's a zero here, there's a potential that Downwards compatibility is enabled in something like RZ 11 We won't get into too much of that here the nuances just because it's marked there as downward compatibility disabled doesn't mean it's actually disabled in the running system And If that is disabled you might not get B code hashes but maybe you'll get B code hashes because somebody's gone and it made that adjustment in the running config and Somebody's logged in or changed their password with that enabled Further there's a ton of different protocols that this is supported Just if you're gonna do any sort of packet crafting. This is a strongly recommended tool for fuzzers or for SAP research and I use a lot of these tools in my Pen testing in addition to some of the standard modules you see inside of something like Cool All right, so what did we cover? New fangled SAP phones how to target SAP users and which SAP users I would personally target Gathering clear text credentials code execution as non-dialogue users fuzzing SAP as a target and the pi SAP library Some shout outs to some fantastic researchers friends people that I I look for Additional research from these are all fantastic SAP researchers I strongly recommend following each and every one of them and then on the right hand side You have my Twitter and discord feel free to reach out based on this talk ask questions And I'd love to hear from you collab on some stuff SAP is definitely a area of growing interest over the last couple years and I think it'll continue to be And with that we can turn it over for q&a I will be in the chat so feel free to drop me questions there This is pre-recorded just a little bit beforehand. So it's still very fresh But drop me questions and I'll be sure to get back to you quickly in the red team village discord channel And thank you for coming


The co-gisted government has dragged the Economic and Financial Crimes Commission, EFCC, to court over on some associated allegations that it fixed 19.3 billion air bailout funds received from the federal government. This is just as justice JJ Magibor of a co-gisted high court also granted an interim injunction restraining the EFCC from issuing further official or unofficial publications over the issue involving Stirling Bank account number owned by the state or any other account perpetually belonging to co-gisted government. The co-gisted government account general, account general of the state, Mo Mojibring and Commissioner for Insurance, Budget and Economic Planning Ashuwaju Mokadam Ashiru were claimants in the suit while the EFCC, Stirling Bank and Central Bank of Nigeria were listed as defendants.


As you're watching this, some of the last old growth rainforests across British Columbia are falling. Premier Horgan, you promise to protect them. If you're committed to work with Indigenous peoples, stop the logging of old growth immediately. While you're dragging your feet, elders, youth, teachers, scientists are going to jail. Do the right thing. Defer logging in all at risk. Obros Forest. Not in three years. The day right now. The world is watching.


ling me that Kevin O'Brien is the most overrated player. So you bring stats into that. Kevin O'Brien is not the most overrated player. If you're going to say that, I'm going to bring stats into it. Today?  Today he was poor. I was talking about taking him off for Alvarez. Today he was poor.   And he got taken off of that. That's fair to have that, but he's not the most overrated player at all time. Who out of the 11 wasn't poor today? Vardio. Vardio was sick. You can start saying like, KDB was poor, but everyone wasn't quite at the races today. No one had an outstanding performance. None of our players deserved Man of the Match. Yeah, that's what you're right. Vardio won the match. Yeah, he's the only one. And to be fair, even he made mistakes. Mark makes a good point there. Two great sides today. They both cancelled each other out, which is what happened. They did cancel each other out. Liverpool should be the... They should in their... It's in their hands. It's in Liverpool's hands to go and win this league now. That's the annoying part. It's in their hands to go and win this. But I don't think they're going to... They ain't going to win nine on the bounce. It's all good. It's all in nine games. I don't think they're going to win nine on the bounce. I don't think we're going to win nine on the bounce. I think City have it in them to do that. Let's just see. We basically win every game now. I thought, to be honest, this would be the start of it, to step our foot on the grass and show what we're made of, but it's not quite happening. For one reason or another, we're not quite where we usually are. Yeah, it's not clicking. And that's the whole season. I can't name a handful of games that we've put together. I mean, we're unbeaten in whatever it is. 22, 23. We can't... You know, everyone's having a meltdown. We're unbeaten in 22 games. The last time we lost was that video game. We're not playing like we are in previous games, where we're looking fluent, we're slamming four, five goals. Second half of season six that we always rely on. Yeah, yeah. We are unbeaten.   Which is just struggling to start. Yeah, it ain't... We ain't turning up and doing these performances where we're looking at it going, you know what? Yeah, we look like we can go on and win this. It's just not at the moment. But... I feel like... I feel like, obviously, everyone's got a squad and it's going to blame injuries, but I feel injuries to our key players. Yeah. My cat is a... My cat's just walking as it is now. The cat ate me.   Stressful game. But there's like, like Steve's saying, there's a long way to go. There's a long way to go. It's not over by any stretch of the imagination. Yeah. Appreciate everyone. If you haven't already done so, hit the like button and subscribe channel if you are new. We're back with some more content. We've got the podcast coming out tomorrow, podcast episode. We'll get some clips from that out. And also, we'll have the full episode available on Spotify and Apple Podcast. If you haven't already, go check out the extra time podcast. Me and Ollie have been doing that. So that's coming out. We've got another FIFA stream next week at some point. Not sure when Ollie's back from Scotland, but we'll get one in. And yeah, we'll do some more content very, very soon. Big up to everyone. I appreciate it. It's been a dead game, but you just got to remain hopeful. You've got to have faith, man. Faith. What?   You need to delete this whole club.  We need to delete club. Okay. Round but meow later. Yep, a cat saying bye to you all. But yeah, till next time, innit? Go check out BetterHelp. I'm going to need BetterHelp after that. There's a link in the description. You can use our code or run the ad now to play us out. But big up to everyone. I appreciate it all. And we will see you in the next one. Big up to Steve. Big buff daddy's back. Steve Triore. He's here. So big up to everyone. And we'll see you in the next one. See you in a bit. It's something interfering with your happiness or preventing you from achieving your goals. Regardless, whether you have a clinical mental health issue like depression or anxiety, or if you're just a human like each and every one of us going through a hard time, therapy can give you the tools to approach life in a very different way. That's why we're excited to tell you all about BetterHelp. We're on a mission to make therapy accessible, an important mission, as find a therapist can be so hard. BetterHelp is a platform that makes finding the therapist easy, because online, remote, and by just filling out a few questions, BetterHelp can match you to a credentialed therapist in as little as a few days. You can find a link to BetterHelp in the description. Clicking that link helps not only support everything we do at City Extra, but also gets you 10% off your first month for BetterHelp, so you can connect with a therapist and see if it helps you out. And because finding a therapist is like dating, if you don't like your therapist, which is a common thing some people just don't get on, then you can easily switch to a new one at no additional cost. So if you're struggling, consider online therapy with BetterHelp. Click the link in the description or visit betterhelp.com. Thank you again, BetterHelp for supporting this stream. I hope you enjoyed this video. I'll see you in the next one!