#HITBLockdown002 D2T2 - Jackpotting Fortune-500 Treasuries

### Overview In this talk, security researchers Gaston Guerra and Martin Oyanarte examine enterprise resource planning (ERP) systems—specifically Oracle E-Business Suite (EBS)—and how attackers can move beyond basic access (such as cryptomining or ransomware) to execute high-impact financial post-exploitation. Organizations rely on ERP financial modules to handle bank accounts, manage vendors, generate checks, and conduct electronic funds transfers (EFT). Despite handling hundreds of millions of dollars, many production ERP systems remain exposed to the internet and unpatched due to concerns that updates might break legacy business operations.

### Key Topics - **ERP Exposure and Post-Exploitation Gap:** Many internet-facing ERP instances discovered on Shodan run unpatched. While attackers often compromise these systems for low-value goals like Monero mining, understanding ERP financial workflows allows direct monetary theft. - **Thin Client Framework (TCF) Flaws:** Analysis of the TCF communication protocol, authentication bypass mechanisms via unhandled Java null exceptions, and remote method invocation via proxies. - **Deserialization to SQL Injection:** Chaining object deserialization in `ServerPostMaster` with gadget services to achieve second-order SQL injection and modify backend database records. - **EFT Wire Transfer Manipulation:** Intercepting and altering approved payment orders and bank routing details in the database before the automated payment close batch process runs. - **EBS Payment Module File Upload & Remote Command Execution:** Exploiting the `fileDumpFunction` within `IBATransmitServlet` to write arbitrary files, upload a Perl web shell, and hijack the check printing process.

### Technical Details Martin details an authentication bypass in EBS's Thin Client Framework (`APBS TCF servlet`). When a handshake request omits the `TCF-Start` header (making it null), calling `.equals("close")` triggers a Java null pointer exception that is not handled properly, allowing the session to persist and returning a valid `JSessionID` cookie without an EBS authentication cookie. Leveraging proxy classes, the researchers identify `ServerPostMaster`, which decompresses a zipped byte array into an `ObjectInputStream` and calls `readObject()`. By crafting a gadget chain utilizing `FNDMessageRequest`/`FNDMessageService` and `ContextBootstrapRequest`/`ContextBootstrapService`, they set the session's display language with a SQL payload. When calling `respond()` on `SingleResponseService`, the injected language variable triggers second-order SQL injection. By declaring a `pragma autonomous_transaction` in the Oracle database, arbitrary insert, update, or delete statements can be run—allowing the takeover of the `sysadmin` account and modification of approved payment records (updating bank accounts, branch numbers, and bank names) while clearing audit logs.

Gaston demonstrates a separate unauthenticated vulnerability in the `IBATransmitServlet` payment module. The servlet processes an HTTP POST request containing XML specifying a class (`fileDumpFunction`) and method (`transmit`), accepting parameters such as `fileDir`, `fileName`, and `transmitRef`. By supplying root (`/`) as `fileDir`, an empty string for `fileName`, and the relative target path in `transmitRef`, an attacker achieves arbitrary file write without path traversal. Gaston overwrites an existing Perl CGI script on the WebLogic server with a Perl web shell. Using a reverse shell connection to the reports directory, he locates a cached check file (`check.out`), modifies the payee and payment data to his own details, and executes `lp` to send the modified check file to the remote check printing queue, physically printing an unauthorized check.

### Takeaways 1. **Functional Controls Are Ineffective When the Core Platform Falls:** Once attackers obtain underlying database or operating system access, business logic validation and multi-tier approval workflows are completely bypassed. 2. **Blind Trust in ERP Integrity:** Banks and business operators inherently trust batch-generated EFT files and check spoolers because the payments were already approved by authorized personnel. 3. **Deserialization and Legacy Codebases:** Decades-old enterprise frameworks built with Java EE, reflection, and remote method invocation introduce severe modern attack vectors such as deserialization. 4. **Post-Exploitation Risk:** The security community and enterprises must realize that attackers will eventually focus on business logic and financial post-exploitation rather than commodity malware.