get of the money - erpscan.com · 4 facts about sap pos 96 can help us make a trick 1. store...
TRANSCRIPT
![Page 2: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/2.jpg)
2Dmitry Chastuhin
Yet another security researcher: @_chipik
Head of security consulting at ERPScan
Know 3 Spanish words: hola, gracias, sin hogar
![Page 4: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/4.jpg)
Agenda 4
![Page 5: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/5.jpg)
5
Conclusion
![Page 6: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/6.jpg)
Introduction to POS 6
James Jacob Ritty The first cash Register
![Page 7: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/7.jpg)
Introduction to POS 7
![Page 8: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/8.jpg)
8Introduction to POS
![Page 9: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/9.jpg)
9
The previous work
![Page 10: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/10.jpg)
Lucas Zaichkowsky
“Point of Sale System Architecture and Security”
10The previous work
![Page 11: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/11.jpg)
11
Magstripe readers
Unencrypted data
AND
![Page 12: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/12.jpg)
12EMV chip
Chip contains magstripe“equivalent” data
unencrypted
![Page 13: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/13.jpg)
13The previous work
Ross Anderson
“How Smartcard Payment Systems Fail”
![Page 14: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/14.jpg)
14The No-PIN attack
Insert a device between card and terminal
Make card thinks: signature Make terminal thinks: pin
![Page 15: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/15.jpg)
Nils and Jon Butler
15
“PinPadPwn” “Mission mPOSsible”
The previous work
![Page 16: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/16.jpg)
16A “Chippy Pin” game on the terminal
![Page 17: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/17.jpg)
Peter Fillmore
“Crash and Pay: Owning and Cloning Payment Devices”
17The previous work
![Page 18: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/18.jpg)
Stawomir Jasek
“Hacking challenge: steal a car!”
18The previous work
![Page 19: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/19.jpg)
19MITM POS mobile
![Page 20: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/20.jpg)
20
Why did we choose POS software for our research?
![Page 21: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/21.jpg)
21
Credit cardbrand network
Consumers
Payment ServiceProvider (PSP)
Issuer
Acquirers
POS SoftwarePOS HardwareSTART HERE
POS Backend
![Page 22: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/22.jpg)
22
Consumers
Payment ServiceProvider (PSP)
Issuer
POS SoftwarePOS Hardware POS Backend
Credit cardbrand network Acquirers
![Page 23: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/23.jpg)
23
Consumers
Payment ServiceProvider (PSP)
Issuer
POS SoftwarePOS Hardware POS Backend
Credit cardbrand network Acquirers
![Page 24: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/24.jpg)
24
Consumers
Payment ServiceProvider (PSP)
Issuer
POS SoftwarePOS Hardware POS Backend
Credit cardbrand network Acquirers
![Page 25: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/25.jpg)
25
Consumers
Payment ServiceProvider (PSP)
Issuer
POS SoftwarePOS Hardware POS Backend
Credit cardbrand network Acquirers
![Page 26: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/26.jpg)
26
Business day
![Page 27: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/27.jpg)
Business day. The beginning 27
Manager
Store
Open
Manager
Open
Terms Terms
ServerGet
Cashiers
Login
![Page 28: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/28.jpg)
Business day 28
![Page 29: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/29.jpg)
Business day. End of Day 29
Manager
Store
Close
Manager
Close
Terms TermsServer
Send
Cashiers
Logout
![Page 30: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/30.jpg)
30
How did we choose POS system?
![Page 31: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/31.jpg)
31
![Page 32: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/32.jpg)
33
SAP Point of Sale
![Page 33: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/33.jpg)
WHOIS SAP POS
Platform: Windows 32-bit and 64-bit
34
Language: C++
Actual version: SAP POS 2.3 SP 11 build 1171
Old name: Triversity Transactionware GM (2005)
![Page 34: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/34.jpg)
Architecture POS Client
35
Store Server Head Office
Store Configurator
POS Client
Xpress POS Server
Database Store Manager
![Page 35: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/35.jpg)
36POS Client
Map
![Page 36: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/36.jpg)
37POS Client
Map
![Page 37: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/37.jpg)
38POS Client
Map
![Page 38: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/38.jpg)
39POS Client
Map
![Page 39: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/39.jpg)
40POS Client
Map
![Page 40: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/40.jpg)
41POS Client
Map
![Page 41: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/41.jpg)
42Xpress Server
Map
![Page 42: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/42.jpg)
43Xpress Server
Map
![Page 43: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/43.jpg)
44Xpress Server
Map
![Page 44: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/44.jpg)
45Store Manager
Map
![Page 45: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/45.jpg)
46Store Configurator
Map
![Page 46: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/46.jpg)
47Store Configurator
Map
![Page 47: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/47.jpg)
48
SAP POS: Going Deeper
![Page 48: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/48.jpg)
Store Configurator
POS Clients
49
Store Server Head Office
Database
Xpress POS Server
Store Manager
PART I
POS Client
![Page 49: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/49.jpg)
POS Clients
50
Store Server Head Office
PART IIPOS Client
Store Configurator
Database
Xpress POS Server
Store Manager
![Page 50: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/50.jpg)
POS Clients
51
Store Server Head Office
PART III
POS ClientStore
Configurator
Database
Xpress POS Server
Store Manager
![Page 51: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/51.jpg)
How does it work? Part 1 52
Store Server Head Office
Xpress POS Server
Store Configurator
/ SAP/Retail Systems/Store Configurator/
data/parm/
/ SAP/Retail Systems/Xpress Server/parm/
SMB
Go from the back.
![Page 52: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/52.jpg)
Xpress ServerFile Architecture
53
…\Xpress Server\ dnloaddocumentemaillogs
rdatasdatatxnsave…
FRENCHGERMANITALIANSPANISHcnummask.cmkrcptlogo.rcpcashier.clgLAYOUT.UI0…
Parm
![Page 53: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/53.jpg)
Store Manager
How does it work? Part 2 54
Store Server Store Server
Xpress POS Server
Monitoring is not always good
Port: 2202
Port: [1433,1521,2638…]Database
![Page 54: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/54.jpg)
Handmade… 60
![Page 55: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/55.jpg)
61
999 *** XPRESS SERVER MOST COMMON COMMAND HELP ***999 MONXPS [ON|OFF] 999 [SHOWTERM|TERMINAL-STATUS] [ALL|Term#]999 [MONTERM|MONITOR-TERMINAL] [ALL|XPS|Term#] [START|STOP|ON|OFF]999 OPEN-TERMINAL [ALL|Term#]999 OPEN-STORE [TODAY|NumberOfSecsSinceJan1-1970] 999 CLOSE-TERMINAL [ALL|Term#] [FORCE|NO-FORCE|ABORT]999 TERMINAL-BALANCE [Term#] [BAL|UNBAL]999 CASHIER-BALANCE [Cashier#] [1|2|3] [ShortOver Amount] [netTenderTotal] <-- 1=BALANCED 2=UNBALANCED 3=PREVIOUS BALANCE NOW OUT OF DATE
Help response
![Page 56: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/56.jpg)
62
999 UPDATE-CASHIER [Cashier#]999 DELETE-CASHIER [Cashier#]999 END-OF-DAY [FORCE|NO-FORCE|ABORT] 999 STORE-TOTALS [CLOSE-DAY|CLOSE-WEEK|CLOSE-PERIOD|DONE-END-OF-DAY|...] 999 STORE-TOTALS CONSOL-DAY [RTOT|SRTOT|CTOT|SPROD|...] 999 COMMS-RESET [1|2|3] <-- 1=ALL 2=REMOTE 3=MODEMS 999 FLUSH-PLUCACHE 999 TRIGGER-NEWPROMOS 999 SHUTDOWN 999 . <-- Use to repeat previous command
![Page 57: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/57.jpg)
DEMO 163
![Page 58: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/58.jpg)
64
BACKDOORS
BACKDOORS EVERYWHERE
![Page 59: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/59.jpg)
65
![Page 60: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/60.jpg)
66
![Page 61: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/61.jpg)
67
23%
77%
Methods
PublicPrivate
![Page 62: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/62.jpg)
68
Correct password and login:APM-VALIDATE-PASSWD 0 1119 1 1337;1234567a
1119 0 1 1 Disp=Authenticated;APMCode=0;
Correct login:
Incorrect login:
Request Response
APM-VALIDATE-PASSWD 0 1119 1 1337;123451119 0 1 1 Disp=Authenticated;APMCode=1;
APM-VALIDATE-PASSWD 0 1119 1 1337;123451119 0 1 1 Disp=Authenticated;APMCode=10;
Password and Login are OK
Wrong Password
Wrong Login
![Page 63: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/63.jpg)
69
Reset passwordAPM-RESET-PASSWD 0 1119 1 1337;CHANGEDPWD1
1119 0 1 1 Disp=Authenticated;APMCode=0;
Update Database rowsUPDATE-CASHIER 1337
170 CASHIER-UPDATED 1337
![Page 64: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/64.jpg)
70
FILE-FIND [file_path]FILE-FIND C:\1234.txt
168 FILE-FIND 32 34680 19073 7 1234.txt
FILE-OPEN [file-path] [mode]FILE-OPEN C:\windows\win.ini
160 FILE-OPEN 0
FILE-READ [file_id] [buff_size]FILE-READ 0 120
EGVideo m4v=MPEGVideo mod=MPEGVideo …
![Page 65: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/65.jpg)
DEMO 2
71
![Page 66: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/66.jpg)
POS Client
How does it work? Part 3 72
POS Clients Store Server
Xpress POS ServerPort: 2200
![Page 67: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/67.jpg)
73
{ } , , ;Type Len Where? What? End
![Page 68: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/68.jpg)
Message standardMT_FILE_BAD = 42h BMT_FILE_END = 43h CMT_DATAGRAM = 44h DMT_FILE_REQ_ERR = 45h EMT_FILE_DATA = 46h FMT_FILE_GOOD = 47h GMT_REQ_DIR = 49h IMT_FILE_REQ_SEND = 52h RMT_FILE_SEND = 53h SMT_UNTYPED = 55h UMT_SEND_CANCEL = 58h XMT_RESP_DIR = 69h iMT_RECV_CANCEL = 78h x
74
![Page 69: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/69.jpg)
75
Attacker Xpress ServerS Len Where? What? Size xps.exe
![Page 70: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/70.jpg)
76
Attacker Xpress ServerS Len Where? What? Size xps.exe
![Page 71: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/71.jpg)
77
Attacker Xpress ServerS Len Where? What? Size xps.exe
F DATASize
![Page 72: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/72.jpg)
78
Attacker Xpress ServerS Len Where? What? Size xps.exe
F DATASize
![Page 73: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/73.jpg)
79
Attacker Xpress ServerS Len Where? What? Size xps.exe
F DATASize
C
![Page 74: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/74.jpg)
80
Attacker Xpress ServerS Len Where? What? Size xps.exe
F DATASize
C
![Page 75: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/75.jpg)
81
Attacker Xpress ServerS Len Where? What? Size xps.exe
F DATASize
C
Write file
![Page 76: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/76.jpg)
82
Attacker Xpress ServerS Len Where? What? Size
G
xps.exe
F DATASize
C
Write file
![Page 77: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/77.jpg)
83
Attacker Xpress ServerS Len Where? What? Size
G
xps.exe
F DATASize
C
Write file
G
![Page 78: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/78.jpg)
84
DEMO 3
![Page 79: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/79.jpg)
85
How to buy MacBook for $3
![Page 80: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/80.jpg)
86
Xpress Server
POS Client
POS client
![Page 81: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/81.jpg)
87
Xpress Server
POS Client
POS client
![Page 82: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/82.jpg)
88
Xpress Server
POS Client
POS client
![Page 83: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/83.jpg)
89
![Page 84: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/84.jpg)
90
![Page 85: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/85.jpg)
91
![Page 86: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/86.jpg)
92
![Page 87: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/87.jpg)
93
![Page 88: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/88.jpg)
94
Xpress Server
POS client
![Page 89: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/89.jpg)
95
Step by step we`ll get success
![Page 90: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/90.jpg)
964 facts about SAP POScan help us make a trick
1. Store configurator creates config files and Xpress Server will apply them, if it finds a ”newparm.trg” file in the special directory.
2. We can write any data we want in any file on Xpress Server using port 2200.
3. POS Clients (Terminals) update their parameters after opening.4. We can close and open POS Terminals using telnet and port 2202.
![Page 91: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/91.jpg)
Attacker Xpress Server
POS Client
PORT 2202
Database
PORT 2200
100
![Page 92: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/92.jpg)
Attacker Xpress Server
POS Client
PORT 2202
Database
PORT 2200
1 Evil Configuration files
101
![Page 93: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/93.jpg)
Attacker Xpress Server
POS Client
PORT 2202
Database
PORT 2200
1 Evil Configuration files
2 Trigger file ”newparm.trg”
103
![Page 94: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/94.jpg)
100
Attacker Xpress Server
POS Client
PORT 2202
Database
PORT 2200
1 Evil Configuration files
2 Trigger file ”newparm.trg”
3 Apply new settings
![Page 95: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/95.jpg)
101
Attacker Xpress Server
POS Client
PORT 2202
Database
PORT 2200
1 Evil Configuration files
2 Trigger file ”newparm.trg”
3 Apply new settings
4 Write some of them in database
![Page 96: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/96.jpg)
102
Attacker Xpress Server
POS Client
PORT 2202
Database
PORT 2200
1 Evil Configuration files
2 Trigger file ”newparm.trg”
3 Apply new settings
4 Write some of them in database
5 Close Terminal
![Page 97: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/97.jpg)
Attacker Xpress Server
POS Client
PORT 2202
Database
PORT 2200
1 Evil Configuration files
2 Trigger file ”newparm.trg”
3 Apply new settings
4 Write some of them in database
5 Close Terminal
6 Close Terminal
107
![Page 98: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/98.jpg)
104
Attacker Xpress Server
POS Client
PORT 2202
Database
PORT 2200
1 Evil Configuration files
2 Trigger file ”newparm.trg”
3 Apply new settings
4 Write some of them in database
5 Close Terminal
6 Close Terminal
7 Open Terminal
![Page 99: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/99.jpg)
Attacker Xpress Server
POS Client
PORT 2202
Database
PORT 2200
1 Evil Configuration files
2 Trigger file ”newparm.trg”
3 Apply new settings
4 Write some of them in database
5 Close Terminal
6 Close Terminal
7 Open Terminal
8 Open Terminal
109
![Page 100: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/100.jpg)
Attacker Xpress Server
POS Client
PORT 2202
Database
PORT 2200
1 Evil Configuration files
2 Trigger file ”newparm.trg”
3 Apply new settings
4 Write some of them in database
5 Close Terminal
6 Close Terminal
7 Open Terminal
8 Open Terminal
9 Get evil Configuration files
110
![Page 101: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/101.jpg)
Attacker Xpress Server
POS Client
PORT 2202
Database
PORT 2200
1 Evil Configuration files
2 Trigger file ”newparm.trg”
3 Apply new settings
4 Write some of them in database
5 Close Terminal
6 Close Terminal
7 Open Terminal
8 Open Terminal
9 Get evil Configuration files
111
![Page 102: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/102.jpg)
108
Any additional features?
![Page 103: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/103.jpg)
109
![Page 104: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/104.jpg)
110
Attacker
Xpress Server
PORT
220
0
…\SAP\Xpress Server\... …\Xpress Server\PARM\...
Listening PORT
![Page 105: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/105.jpg)
111
Attacker
Xpress Server
PORT
220
01 “XPSPARM.bat”
…\SAP\Xpress Server\... …\Xpress Server\PARM\...
Listening PORT
![Page 106: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/106.jpg)
112
Attacker
Xpress Server
PORT
220
01 “XPSPARM.bat”
…\SAP\Xpress Server\... …\Xpress Server\PARM\...2 “newparm.trg”
Listening PORT
![Page 107: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/107.jpg)
113
Attacker
Xpress Server
PORT
220
01 “XPSPARM.bat”
…\SAP\Xpress Server\... …\Xpress Server\PARM\...2 “newparm.trg”
3 Found “newparm.trg”
Listening PORT
![Page 108: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/108.jpg)
114
Attacker
Xpress Server
PORT
220
01 “XPSPARM.bat”
…\SAP\Xpress Server\... …\Xpress Server\PARM\...2 “newparm.trg”
3 Found “newparm.trg”
4 Delete “newparm.trg”
Listening PORT
![Page 109: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/109.jpg)
115
Attacker
Xpress Server
PORT
220
01 “XPSPARM.bat”
…\SAP\Xpress Server\... …\Xpress Server\PARM\...2 “newparm.trg”
3 Found “newparm.trg”
4 Delete “newparm.trg”
Listening PORT
5 Search for “XPSPARM.bat”
![Page 110: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/110.jpg)
116
Attacker
Xpress Server
PORT
220
01 “XPSPARM.bat”
…\SAP\Xpress Server\... …\Xpress Server\PARM\...2 “newparm.trg”
3 Found “newparm.trg”
4 Delete “newparm.trg”
Listening PORT
5 Search for “XPSPARM.bat”6 Execute “XPSPARM.bat”
![Page 111: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/111.jpg)
117
Attacker
Xpress Server
PORT
220
01 “XPSPARM.bat”
…\SAP\Xpress Server\... …\Xpress Server\PARM\...2 “newparm.trg”
Found “newparm.trg”
Delete “newparm.trg”
Listening PORT
Search for “XPSPARM.bat”Execute “XPSPARM.bat”
7 Make shell back connect
3
4
56
![Page 112: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/112.jpg)
118
Attacker
Xpress Server
PORT
220
01 “XPSPARM.bat”
…\SAP\Xpress Server\... …\Xpress Server\PARM\...2 “newparm.trg”
3 Found “newparm.trg”
4 Delete “newparm.trg”
Listening PORT
5 Search for “XPSPARM.bat”6 Execute “XPSPARM.bat”
7 Make shell back connect
8 Any command
![Page 113: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/113.jpg)
119
Attacker
Xpress Server
PORT
220
01 “XPSPARM.bat”
…\SAP\Xpress Server\... …\Xpress Server\PARM\...2 “newparm.trg”
3 Found “newparm.trg”
4 Delete “newparm.trg”
Listening PORT
5 Search for “XPSPARM.bat”6 Execute “XPSPARM.bat”
7 Make shell back connect
8 Any command9 Execute command
![Page 114: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/114.jpg)
120
DEMO 4
![Page 115: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/115.jpg)
Fixes
121
![Page 116: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/116.jpg)
122
Note # Title Priority CVSS
2476601 Missing Authentication checks in SAP Point of Sale (POS) Retail Xpress Server High 8.1
Security note was released on the July Patch Day
11th of July 2017
![Page 117: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/117.jpg)
… A new setting, BACKOFFICEIPADDRESS is added. The user can use it to specify the IP address of the system that hosts the Back Office Applications. It is used only if the Back Office Applications are not hosted at the same system as the Xpress Server...
from SAP NOTE #2476601, July 2017
123
![Page 118: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/118.jpg)
124
![Page 119: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/119.jpg)
125
![Page 120: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/120.jpg)
Better late than never
126
Patching
![Page 121: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/121.jpg)
127
![Page 122: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/122.jpg)
One more patch?
128
![Page 123: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/123.jpg)
129
Note # Title Priority CVSS
2520064 Missing Authentication check in SAP Point of Sale (POS) Retail Xpress Server High 8.1
Another security note was released
18th of August 2017
![Page 124: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/124.jpg)
Need more goldsecurity notes...
130
![Page 125: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/125.jpg)
131
Note # Title Priority
2529966 Store Manager crashes after entering credentials.
Correction with medium priority
7th of September2017
![Page 126: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/126.jpg)
All SAP notes 132
• 2476601 – first patch• 252520064 – patch for the first patch• 2529966 – patch for the patch that patched first patch• 2528596 – backdoor user problem
![Page 127: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/127.jpg)
133Conclusion• POS is not only POS terminals and pin pads• Communication between POS workstations and POS server
is insecure• Little bugs bring big troubles for stores and to customers
![Page 128: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/128.jpg)
Conclusion
1. Include SAP systems in scope of your existing services• GDPR audit• ISMS implementation for SAP systems in scope• Threat detection and SAP – SIEM integration
2. Prove your selling proposition is unique with ROI of SAP security
3. Create a 360-degree image of an SAP security provider
134
![Page 129: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/129.jpg)
How We Can Help? 135
SAP Security Consulting:• Implementation of SAP Vulnerability
Management process• SAP security plans, architecture and
project documents expertise• SAP risk assessment
ERPScan Monitoring Suite:• SAP vulnerability assessment• Source Code scanning• Segregation of Duties
assessment
SAP Penetration Testing:• simulate external and internal attacks• provide a list of vulnerabilities• escalate privileges and show you how
much data can leak• try to reach connected systems• estimate overall harm to business
operations
SAP Security Audit:• security assessment of network, OS,
DBMS related to SAP• SAP vulnerability assessment;• security configuration checks• critical access control checks• custom code security review • segregation of duties analysis
![Page 130: GET OF THE MONEY - erpscan.com · 4 facts about SAP POS 96 can help us make a trick 1. Store configurator creates config files and Xpress Server will apply them, if it finds a …](https://reader031.vdocuments.us/reader031/viewer/2022020215/5b5022687f8b9a256e8dbb4f/html5/thumbnails/130.jpg)
Thank you
USA:228 Hamilton Avenue, Fl. 3, Palo Alto, CA. 94301Phone 650.798.5255
EU:Luna ArenA 238 Herikerbergweg, 1101 CM AmsterdamPhone +31 20 8932892
Read our blogerpscan.com/category/press-center/blog/
Join our webinarserpscan.com/category/press-center/events/
Subscribe to our newsletterseepurl.com/bef7h1
Dmitry ChastuhinLead SAP Security [email protected]
136