ERPwnage - A Red Team Approach to Targeting SAP - Austin Marck (@icryo)

Security researcher Austin Marck (@icryo) presents ERPwnage, a red team guide to targeting and compromising SAP enterprise resource planning (ERP) environments [00:01]. Marck explains that because SAP systems host critical business logic, financial ledgers, and sensitive HR data, they are among the highest-value targets for enterprise adversaries, yet are rarely audited with modern offensive techniques [03:40].

The talk covers external reconnaissance and discovery of SAP systems. Marck explains how SAP Web Dispatcher and Internet Communication Manager (ICM) components often leak internal hostnames, patch levels, and backend services through standard HTTP headers and diagnostics [11:28]. He examines internal authentication weaknesses, highlighting environments with legacy backward compatibility enabled where BCODE hashes truncate passwords to eight characters and force uppercase, drastically reducing the search space for offline cracking [15:50].

Marck also discusses binary analysis of SAP proprietary protocols and services, demonstrating how Binary Ninja plugins like VulnFanatic can locate source-and-sink patterns in native binaries to identify potential memory corruption vulnerabilities [19:58]. He outlines post-exploitation strategies for pivoting from compromised SAP application servers to underlying database tiers and offers remediation recommendations for SAP Basis administrators [23:50].

(AI summary — Gemini Flash)