alexey tyurin
Post on 22-Feb-2016
63 Views
Preview:
DESCRIPTION
TRANSCRIPT
Invest in securityto secure investments
Accounting hacking –arch bugs in MS Dynamics GPAlexey Tyurin Director of consulting department in ERPScan
Alexey Tyurin
• Director of consulting in ERPScan• XML/WEB/Win/Network security fun• Hacked a lot of online banking systems• Co-Organizer of Defcon Russia Group • Editor of “EasyHack” column for the “Xakep” magazine
@antyurin
erpscan.com 2ERPScan — invest in security to secure investments
MS
erpscan.com 3ERPScan — invest in security to secure investments
MS
erpscan.com 4ERPScan — invest in security to secure investments
MS
erpscan.com 5ERPScan — invest in security to secure investments
MS
erpscan.com 6ERPScan — invest in security to secure investments
MS
erpscan.com 7ERPScan — invest in security to secure investments
What is it?
• Microsoft Dynamics GP is ERP or accounting software• Many implementations: about 430000 companies
Img from http://www.calszone.com
erpscan.com 8ERPScan — invest in security to secure investments
Architecture
Based on www.securestate.com/Downloads/whitepaper/Cash-Is-King.pdf
erpscan.com 9ERPScan — invest in security to secure investments
Features
• Fat client
• Web is only for info and reporting
• Dexterity language
• The security depends on the security of SQL Server
• Microsoft Dynamics GP does not integrate with Active Directory
erpscan.com 10ERPScan — invest in security to secure investments
Security
Role model:• Security Tasks• Security Roles• Users
Features:• sa• DYNSA• DYNGRP• System password• SQL users
erpscan.com 11ERPScan — invest in security to secure investments
inSecurity
• All the security of Dynamics relies on the visual restrictions of the fat client
• In fact, all users have the rights to the companies’ databases and to DYNAMICS
• The only obstruction: impossible to connect to the SQL server directly (encryption +encryption). How to bypass it?
erpscan.com 12ERPScan — invest in security to secure investments
inSecurity
• Reverse engineering to understand the password “encryption” algorithm
• A MitM attack on ourselvesMS SQL server does not encrypt the process of authentication af a few bytes are replaced upon connection!
* The method itself is described and implemented into a Metasploit Framework module that works like a charm:http://f0rki.at/microsoft-sql-server-downgrade-attack.html
** It is a feature, not a bug, and Microsoft is not going to correct it
erpscan.com 13ERPScan — invest in security to secure investments
What’s next?
• Full access to the company’s information in the databaseFor example, privilege escalation. But a research called “Cash is King” describes subtler methods:http://marketing.securestate.com/cash-is-king-download-our-free-whitepaper
• Attack on OSFor example, if the SQL server is launched under a privileged user account, we can initiate a connection to our host using stored procedures (xp_dirtree) because we have the rights of the “public” role. The result will be a hash which can be used in a bruteforce attack.If Dynamics GP uses a cluster of SQL servers (it happens sometimes), we can conduct an SMB Relay attack on the same server (MS08-068 will not work here). The result will be a shell on the cluster :)erpscan.com 14ERPScan — invest in security to secure investments
erpscan.com 15ERPScan — invest in security to secure investments
DEMO
Greetz to our crew who helped
top related