Message Server Example scripts

ms_change_param

This example script changes a parameter using SAP Message Server Administration requests. In order to be able to change a parameter the Message Server should be configured in monitoring mode (ms/monitor=1, see corresponding help for more details) and the internal port should be reachable. Keep in mind that some of the parameters are not “dynamic” and can’t be changed using this method. If the parameter value is not specified, the script retrieve the current value.

ms_dos_exploit

This example script can be used to tests a Denial of Service vulnerability affecting the Message Server (CVE-2017-5997). For more details about the vulnerability see ERPScan’s Security Advisory and SAP Security Note 2358972.

This example script was contributed by Vahagn Vardanyan and Mathieu Geli.

ms_dump_info

This example script provides a way to dump different type of configuration and parameters about an SAP’s instance made available via the Message Server service. The script connects to the internal port of the MS service (by default 39NN) and by running the dump command it will obtain the configuration values.

The following is an example result of running the command:

$ examples/ms_dump_info.py -d XXX.XXX.XXX.XXX -p 3901
[*] Connected to the message server XXX.XXX.XXX.XXX:3901
[*] Sending login packet:
[*] Login OK, Server string: MSG_SERVER
('[*] Sending dump info', 'MS_DUMP_CON')
-------------------------- dump of mscon table -----------------------------
  NR ADDRESS > Unique key                      FIHDL NEXTREQ NEXTREP
----------------------------------------------------------------------------

#entries = 0


('[*] Sending dump info', 'MS_DUMP_PARAMS')

Release = 753
Release no = 7530
Build version = 753.2017.08.01
System name = SYS
Instance name = ASCS01
Trace level = 1
Trace logging = active (52428800)
Trace logging string = on, 50 m
comment = message server SYS
start time = Fri May  3 07:14:19 2019
start time (seconds) = 1556892859
up time = 0:30:35 (1835 secs)
build time = Aug 18 2017 23:27:38
build with Unicode = TRUE
build with Threads = TRUE
system type = AMD/Intel x86_64 with Linux
system id = 0x186
server host = sapserver
server host (fqn) = sapserver
server addr = XXX.XXX.XXX.XXX
server service = sapmsSYS
server port = 3601
server service (internal) = 3901
server port (internal) = 3901
use unix domain sockets = TRUE
J2EE send notification = message/request
J2EE advanced login = on
J2EE broadcast time = 0/Wed Dec 31 16:00:00 1969
J2EE reconnect support = 1
ms/timeout = 5000
ms/timeout2 = 10000
ms/conn_timeout = 300
ms/max_sleep = 20
ms/sapevt_lb = 0
ms/keepalive = 300
ms/max_clients = 600
ms/ext_client_quota = 50
#clients = 2
#clients external = 0
ms/max_counter = 100
ms/max_vhost = 16
ms/audit = LOGIN/OUT  (0x1)
statistic activated
ms/max_queue = 600
ms/warn_queue = 5
ms/cache_check = 900
cache count = 0
cache size = 10
allocated buffer = 2
ms/max_open_requests = 10000
#max_open_requests = 0
ms/server_port_0 = PROT=HTTP,PORT=8101,TIMEOUT=20,PROCTIMEOUT=60
ms/http_port = 8101
http state = LISTEN
ms/https_port =
https state = INIT
ms/http_lookup = 1
ms/http_domain = TRUE
ms/http_timeout = 20
ms/http_proctime = 60
ms/http_bufferln = 65536
ms/redirect_version = 1
ms/http_max_clients = 500
ms/http_max_ports = 20
ms/http_enable_handler = TRUE
ms/http_handler_retry = 10
ms/http_handler_timeout = 60
ms/http_was_required = FALSE
ms/url_fqn = 1
is/HTTP/default_root_hdl = abap
is/instname_encoding = none
#http client = 0
#https client = 0

ms_dump_param

This example script connects to the internal Message Server port and retrieves the SAP’s instance profile parameters configured and available to the service. While similar to ms_dump_info, instead of just dumping the values it will allow for performing checks against a defined set of expected values. The list of expected parameters and their values should be provided in a file with the following format:

#<SAP parameter>:<check type in [FILE|EQUAL|NOTEQUAL|INF|SUP|REGEX]>:<expected value>

The supported check types are:

  • FILE: The parameter defines an external configuration file.
  • EQUAL: The parameter is compared with an expected value and checked if equal.
  • NOTEQUAL: The parameter is compared with an expected value and checked if not equal.
  • INF: The parameter is compared with an expected integer value and checked if inferior.
  • SUP: The parameter is compared with an expected integer value and checked if superior.
  • REGEX: The parameter is compared against a regular expression and expected to be matched.

A set of of default recommended values is provided in examples/list_sap_parameters but each user should create their own set of expected values. The script can be used then to create a baseline configuration and automate the validation of a set of Application Servers against it. It’s worth noting that due to the way parameters are stored and made available to the Message Server service there might be false positives. Additionally, configuration stored in external files (e.g. ACL files, secinfo, reginfo) need to be checked by other means as the script will only point out the location of the file but not it’s content. Other dump commands might be helpful as to obtain those values programmatically, check the output of ms_dump_info for more details.

The following is an example result of running the command:

$ examples/ms_dump_param.py -d XXX.XXX.XXX.XXX -p 3901 -f examples/list_sap_parameters
[*] Initiate connection to message server XXX.XXX.XXX.XXX:3901
[*] Connected. I check parameters...
[*] Sending login packet:
[*] Login OK, Server string: MSG_SERVER

[+] auth/no_check_in_some_cases = Y
[+] auth/rfc_authority_check = 1
[ ] dbms/type = syb
[ ] DIR_AUDIT = /usr/sap/SYS/ASCS01/log
[ ] FN_AUDIT = audit_++++++++
[+] gw/acl_mode = 1
[+] gw/logging = ACTION=Ss LOGFILE=gw_log-%y-%m-%d SWITCHTF=day MAXSIZEKB=100
[+] gw/monitor = 1
[ ] gw/proxy_check = *
[ ] gw/prxy_info = /usr/sap/SYS/ASCS01/data/prxyinfo
[ ] gw/reg_info = /usr/sap/SYS/ASCS01/data/reginfo
[!] gw/reg_no_conn_info = 1
[ ] gw/sec_info = /usr/sap/SYS/SYS/global/secinfo
[+] gw/sim_mode = 0
[!] icm/HTTP/logging_0 = *
[!] icm/HTTP/logging_1 = *
[!] icm/HTTP/logging_2 = *
[!] icm/HTTP/logging_3 = *
[!] icm/HTTP/logging_4 = *
[ ] icm/server_port_0 = PROT=HTTP,PORT=0,TIMEOUT=60,PROCTIMEOUT=60
[ ] icm/server_port_1 = PROT=SMTP,PORT=0,TIMEOUT=120,PROCTIMEOUT=120
[ ] icm/server_port_2 = NOT_EXIST
[ ] icm/server_port_3 = NOT_EXIST
[ ] icm/server_port_4 = NOT_EXIST
[ ] INSTANCE_NAME = ASCS01
[ ] j2ee/dbname = SYS
[ ] j2ee/dbtype = syb
[+] login/fails_to_user_lock = 5
[!] login/min_password_lng = 6
[+] login/no_automatic_user_sapstar = 1
[!] login/password_compliance_to_current_policy = 0
[+] login/password_downwards_compatibility = 0
[ ] login/system_client = 001
[ ] ms/acl_file_admin = NOT_EXIST
[ ] ms/acl_file_extbnd = NOT_EXIST
[ ] ms/acl_file_ext = NOT_EXIST
[ ] ms/acl_file_int = NOT_EXIST
[ ] ms/acl_info = /usr/sap/SYS/SYS/global/ms_acl_info
[+] ms/admin_port = 0
[+] ms/audit = 1
[!] ms/http_logging = PREFIX=/,LOGFILE=dev_ms_logging,LOGFORMAT=SAPMSG
[+] ms/monitor = 0
[ ] rdisp/extbnd_port = *
[!] rdisp/msserv = sapmsSYS
[+] rdisp/msserv_internal = 3901
[!] rec/client = OFF
[!] rsau/enable = 0
[+] rsau/ip_only = *
[+] rsau/max_diskspace/local = 1000000000
[+] rsau/max_diskspace/per_day = 0
[+] rsau/max_diskspace/per_file = 0
[+] rsdb/ssfs_connect = 1
[ ] rslg/local/file = /usr/sap/SYS/ASCS01/log/SLOG01
[+] rslg/max_diskspace/local = 10000000
[ ] SAPDBHOST = sapserver
[ ] SAPFQDN = NOT_EXIST
[ ] SAPSYSTEM = 01
[ ] SAPSYSTEMNAME = SYS
[ ] service/http/acl_file = NOT_EXIST
[ ] service/https/acl_file = NOT_EXIST
[+] service/protectedwebmethods = SDEFAULT
[!] snc/enable = 0
[!] system/secure_communication = OFF
[ ] system/type = ABAP

The script’s output will contain a [+] mark if the value obtained from the Message Server matched the expected one in the provided file or a [!] mark if that’s not the case. Other parameters not checked will have an empty mark [ ].

This example script was contributed by Ivan Genuer. The recommended values and parameters related to the Gateway and Message Server services were obtained from the May 2019 Security Notes Webinar by Frank Buchholz.

ms_impersonator

This example script is a proof of concept that connects with the Message Server service of a SAP Netweaver Application Server and impersonates an application server registering as a Dialog instance server.

ms_listener

This example script connects with the Message Server service and listen for messages coming from the server. Along with the ms_messenger script, it can be used as an example for using the Message Server as a messenger service and send packets from one client to another connected to the service.

ms_messenger

This example script connects with the Message Server service and sends a message to another client connected to it. Along with the ms_listener script, it can be used as an example for using the Message Server as a messenger service and send packets from one client to another connected to the service.

ms_monitor

This script is an example implementation of SAP’s Message Server Monitor program (msmon). It allows the monitoring of a Message Server service and allows sending different commands and opcodes. Includes some commands not available on the msmon program. Some commands requires the server running in monitor mode, while most of them requires access to the Message Server internal port.

The script implements a console-like interface that can be used to specify the operations to perform on the Message Server. A list of implemented commands can be obtained by running help.

ms_observer

This example script connects with the Message Server service of a SAP Netweaver Application Server and monitors the clients to identify new application servers. As the Message Server broadcast the addition, removal or change of clients to all the clients connected to it, it’s possible to identify those state changes and print them. Similar to SAP’s msprot tool.