Releases: OWASP/pysap
Releases · OWASP/pysap
pysap v0.1.19
- Using Scapy version 2.4.4.
pysap/SAPSSFS.py: New module for SAP Secure Store in File System file format.bin/pysaphdbuserstore: New script for interacting withhdbuserstoreSSFS files.requirements-examples.txt: Renamed to matchsetup.py's extra.pysap/SAPHDB.py: Implementation of GSS-based auth method with Kerberos 5.pysap/SAPHDB.py: Handling of Session Cookie values when found in theCONNECTresponse.pysap/SAPRouter.py: Add support to route string inSAPRouterNativeProxy. (#33) Thanks @gloomicious!examples/router_fingerprints.json: New fingerprints for SAP Router version 7450.34.25.5091. Thanks @jvis!examples/router_portfw.py: Add support to route string. (#33) Thanks @gloomicious!tests/sapssfs_test.py: Basic unit tests for the SSFS file format.
pysap v0.1.18
- Using Sphinx 1.8.5 for documentation.
- Replaced AppVeyor and Travis builds with GitHub Actions.
- Added
cryptographyas required library instead of optional requirement. - Replaced the use of deprecated
optparsemodule forargparseacross all tools and examples. - Fixed some PEP8 warnings across modules and example scripts.
pysap/SAPCAR.py: Added signature manifest file type.pysap/SAPHDB.py: New module for SAP HANA SQL Command Network protocol packets, authentication methods and connection classes.pysap/SAPNI.py: Disconnect clients in SAPNIServer if socket errors are catched.pysap/utils/crypto: Added implementation of SCRAM algorithms for use in HDB authentication.examples/hdb_auth.py: New example script to illustrate the use of the different authentication methods in HDB.examples/hdb_discovery.py: New example script to perform discovery of HANA database tenants.examples/diag_login_brute_force.py: Handling valid users (e.g. no dialog users) vs valid passwords. Thanks fabhap!examples/diag_login_brute_force.py: Fixed discovery with right message match ("Client does not exist").examples/default_sap_credentials: Added a couple of default credentials from trial versions.tests/crypto_test.py: Testing output of SCRAM algorithms.tests/saphdb_test.py: Basic unit tests for the HDB protocol.tests/sapni_test.py: Arranged and fixed a couple of tests that were failing on macOS and Windows.
pysap v0.1.17
- Using Scapy version 2.4.3.
- Added documentation of projects using
pysap. - Added documentation of all example scripts.
bin/pysapcar: Add cli option to determine output directory when extracting archives with pysapcar (#24) Thanks @okuuva!pysap/SAPDiag.py: Added support bits for SAP GUI 7.50 and SAP NW 7.52 SP01.pysap/SAPCAR.py: Fixed crafting of archive files by defaulting length fields to zero (#22) Thanks @okuuva!pysap/SAPMS.py: Added theDPInfo[1-3]packets for handling specific Message ServerADMpackets relaying Dispatcher/WP info:[1-3]because of tight SAP kernel version dependency. (#31) Thanks Mathieu (@gelim) and Dmitry (@_chipik)!pysap/SAPRFC.py: Enhanced with mainlySAPCPIC*andSAPRFXPG*new packets. (#31) Thanks Mathieu (@gelim) and Dmitry (@_chipik)!pysap/SAPRouter.py: Fixed padding on SAPRouter client info packets.examples/rfc_monitor.py: Renamed the script togw_monitor.py.examples/router_scanner.py: Add capability to provide a comma separated list of targets/ports to scan.examples/list_sap_parameters: Updated recommended values and added new parameters.examples/ms_dump_info.py: AddedNOTEQUALcheck type.examples/router_fingerprints.json: Added fingerprints for SAP Router 7.49 and 7.45 kernels.
pysap v0.1.16
- Using Scapy version 2.4.0.
- Using Sphinx 1.7.4 for documentation.
- Added missing
pysap.utilspackage in source/binary packages. - Use flake8 to find syntax errors and undefined names in Travis (#20) Thanks @cclauss!
pysap/SAPCAR.py: Improved SAPCAR files parsing, adding proper structure names based on VSI documentation.
pysap v0.1.15
- Version released at Troopers'18
- Added initial support for handling IGS (Internet Graphic Server) packets along with example scripts to play with them (#19) Thanks @iggy38!
- Added initial support for handling PSE and SSO Credential format files.
bin/pysapgenpse: New binary tool for working with PSE and SSO credential files.bin/pysapcar: Added options for creating a new archive and appending files to an existing one.pysap/SAPCredv2.py: New module for SSO Credential files definitions and decryption logic.pysap/SAPDiagItems.py,extra/parsesupportbits.py: Corrected order of support data bit fields (#19). Thanks @hnzlmnn!pysap/SAPIGS.py: New module for IGS packets layer (#19).pysap/SAPLPS.py: New module for LPS definitions and INT/DP API decryption logic.pysap/SAPMS.py: Added Message Server Domain field, MS J2EE Cluster/Header/Service packets. Thanks Albert Zedlitz!pysap/SAPPSE.py: New module for PSE files definitions and decryption logic.pysap/utils.py: Moved utils classes into a package.examples/diag_login_brute_force.py: Detect invalid clients while logins (#17). Thanks @hnzlmnn!examples/dlmanager_decrypt.py: Replaced use of PyCrypto with Cryptography library.examples/igs_*.py: New example scripts to interact with IGS services (#19).examples/rfc_monitor.py: Addednoopcommand in the monitor and version command line option.examples/ms_*.py: Added command line option to specify Message Server Domain.extra/pse2john.py: New extra script to extract crypto material in John the Ripper format.
pysap v0.1.14
- Added initial support for handling SNC frames and some of their fields.
pysap/SAPNC.py: Added fields for SNCFrames and helper wrapper/unwrapper functions.pysap/SAPRouter.py: Fixed route request for more than one SAP Router when using the native proxy.pysap/SAPRouter.py: Allow route strings to use lowercase separator chars (e.g. "/h/host/s/port").pysap/SAPRouter.py: Allow aSAPRoutedStreamSocketto bypass the NI layer if no route was specified but talk mode
was set to raw (#10).pysap/SAPRouter.py: Enhanced the version retrieve routine by not failing when an error is returned by the server
(#11). Thanks @gelim!.pysap/SAPRouter.py: Fixed missing eyecatcher in control messages (#10).
Thanks @gelim!.examples/diag_login_screen_info.py: Script was improved by better printing technical information and
outputting login screen text items (language, input fields, login text) (#14).
Thanks @gelim!.examples/diag_login_brute_force.py: Script was improved to handle currently logged in users
(#16). Thanks @hnzlmnn!.example/router/admin.py: Improved client list table display and fixed timestamps (#12).
Thanks @gelim!.examples/ms_dump_param.py: New example script to list Message Server parameters and check them against a list of
expected values (#15). Thanks @iggy38!examples/ms_dos_exploit.py: New example script to check for CVE-2017-5997
DoS vulnerability on Message Server and fixed at SAP Note 2358972
(#10). Thanks @vah13 and @gelim!
pysap v0.1.13
- Documentation now includes graphical representation of the main packets of each protocol.
- Example scripts now accept route strings without requiring remote host option.
pysap/SAPRouter.py: Fixed route request for more than one SAP Router.pysap/SAPEnqueue.py:SAPEnqueueStreamSocketnow can connect to an Enqueue server through a SAPRouter.examples/router_niping.py: New example script that implements a very basic
version of thenipingtool. It works on client or server mode.examples/enqueue_monitor.py: The script now accepts route strings for connecting through a SAPRouter.
pysap v0.1.12.1
- Minor release.
- Source build didn't included header files and thus builds from pip source were failing.
pysap v0.1.12
- Using Scapy version 2.3.3.
- Minor fixes and code arrangements.
- Building and testing in OSX with Travis and Windows with Appveyor.
pysap/SAPDiagItems.py: Added default support bits from SAP GUI 7.40 version.examples/diag_capturer.py: Added option to display available capture interfaces.examples/enqueue_dos_exploit.py: New example script to check for CVE-2016-4015
DoS vulnerability on Standalone Enqueue Server and fixed at SAP Note 2258784
(#6). Thanks @vah13!examples/router_fingerprints.json: Added fingerprints from SAP Router releases 745.
pysap v0.1.11
- Some documentation improvements. Hosting the documentation in Read the Docs.
- ChangeLog file in Markdown format for better documentation.
- Improvements over the
pysapcartool, general fixes and added handling of multi-block SAP CAR archive files. Thanks
Hans-Christian Esperer for the feedback! pysap/SAPDiag.py: SplittedSBA/SFE/SLCfields.pysap/SAPDiag.py: Renamed error flag to error number.examples/diag_capturer.py: Fix imports for running diag capturer example script in Windows.examples/diag_login_brute_force.py: Added SOLMAN default
credentials and improved reading credentials file.