Showing posts with label to. Show all posts
Showing posts with label to. Show all posts
Wednesday, February 15, 2017
Fantastic Beasts and Where to Find Them 2016 Telugu Dubbed Watch Online Free
Fantastic Beasts and Where to Find Them 2016 Telugu Dubbed Watch Online Free
FANTASTIC BEASTS AND WHERE TO FINDTHEM (2016) (TELUGU DUBBED)Watch Full Torrent Movie
FANTASTICBEASTS AND WHERE TO FIND THEM (2016) (TELUGU DUBBED)Watch On Dailymotion
FANTASTIC BEASTS AND WHERE TO FINDTHEM (2016) (TELUGU DUBBED)Watch On Youtube.com
FANTASTICBEASTS AND WHERE TO FIND THEM (2016) (TELUGU DUBBED)Watch Online Free Dwonload
FANTASTICBEASTS AND WHERE TO FIND THEM (2016) (TELUGU DUBBED)Watch Full MovieMp4,HDRip,BR720p,1080p
FANTASTICBEASTS AND WHERE TO FIND THEM (2016) (TELUGU DUBBED)Watch Full Movie OnlineFree
FANTASTICBEASTS AND WHERE TO FIND THEM (2016) (TELUGU DUBBED)Watch Movie DVDRip
FANTASTICBEASTS AND WHERE TO FIND THEM (2016) (TELUGU DUBBED)Watch Movie On Fullscreen
FANTASTICBEASTS AND WHERE TO FIND THEM (2016) (TELUGU DUBBED)Watch Movie HDCam
FANTASTICBEASTS AND WHERE TO FIND THEM (2016) (TELUGU DUBBED)Watch Online Dwonload
FANTASTICBEASTS AND WHERE TO FIND THEM (2016) (TELUGU DUBBED)Watch Videohut,Cloudy
FANTASTICBEASTS AND WHERE TO FIND THEM (2016) (TELUGU DUBBED)Watch HC-HDCam
FANTASTICBEASTS AND WHERE TO FIND THEM (2016) (TELUGU DUBBED)Watch Putlocker
FANTASTICBEASTS AND WHERE TO FIND THEM (2016) (TELUGU DUBBED)Watch Openload
FANTASTICBEASTS AND WHERE TO FIND THEM (2016) (TELUGU DUBBED)Watch Full Movie
Available link for download
Fantastic Beasts and Where to Find Them full movie Download HD
Fantastic Beasts and Where to Find Them full movie Download HD
Name and Year: Fantastic Beasts and Where to Find Them full movie Download HD
Category: Hollywood movies
Language: English
File format: mkv
File size: 818mb
Quality: 720p
Movie type: fantasy , action
Rating: 8/10
Fantastic Beasts and Where to Find Them full movie Download HD
If you want to search a movie by its genre or types, Its here you can:
ü Action Movies
ü Adventure Movies
ü Animation Movies
ü Biography
ü Comedy
ü Crime Movies
ü Drama
ü Fantasy
ü History Movies
ü Horror Movies
ü Martial Art Movies
ü Mystery Movies
ü Romantic Movies
ü Science Fictions
ü Sports
ü Thriller
Available link for download
Tuesday, February 14, 2017
Monday, February 13, 2017
Fact Finding Mission To Indian Occupied Kashmir
Fact Finding Mission To Indian Occupied Kashmir
Let UN send a fact-finding mission to Indian Occupied Kashmir
 |
Indian atrocities in Occupied Kashmir have broken all past records. Starting with the martyrdom of a freedom fighter Burhan Wani in Early July, the Indian occupation forces and the police have killed more than 100 Kashmiris and wounded hundreds of others in Firing and Tear gassing on unarmed mobs who come out in the streets to protest. In the capital Srinagar and other areas the Indian police have rendered many youngsters partially or even fully blind by small pallets being fired by them to disperse the protestors. But the angry, though unarmed crowds continue to protest against the brutalities of the Indian Police and military. The protesters set fire to three police station s and two government buildings recently.
Read more Click Here
Available link for download
First trip to the ER
First trip to the ER
Well, it turns out my last post was posted too soon! That very same day, guess whos fever shot up again.
Guess whos headache was so bad that he cried out in pain at the sunshine.
And guess whos neck was so stiff that he couldnt move it AT ALL.
Mommy called the doctor and the doctor said... "bring him into the ER right now. Were going to have to do a spinal tap to test for meningitis."
So thats what this mommy did. I called some people, packed some bags, and put my hotter-than-hot, sicker-than-sick boy into the car and drove to the ER.
Guess who wasnt sick at all 2 hours later, when the doctor came into the room?
Thats right, I said, "wasnt sick at all." No fever, no headache, no sore throat, no stiff neck.
"I promise," I told the doctor, "he was REALLY sick before we got here..." She said its happened before.
I think God answered some prayers and healed this sick boy, because the doctor checked him over, kept him a little white for observation, and decided that no spinal tap would be needed! In fact, the only pain Kade had to go through was a tiny finger prick to test for mono- negative, of course!
Somebodys watchin over this kid!
Available link for download
Saturday, February 11, 2017
fit to be flared
fit to be flared
Available link for download
Friday, February 10, 2017
Failure message to the high mount lamp license lamp left and right failure message
Failure message to the high mount lamp license lamp left and right failure message
Mercedes-Benz E250 Avantgarde name change PrancingHorse windows rt - for uncle that is a once-in-a-lifetime want to ride in the Porsche.
Failure message to the high-mount lamp, license lamp left and right failure message
Thank you all!
Blog Maintenance Ferrari Other Porsche journey already sold vehicle car wish of Stocks News coverage delivered
'95 Mercedes Benz E500LTD dynamo repair '09 Porsche 997 Turbo Early Type the final model yesterday also came to participate in the trader AA. Porsche 996 Carrera 4 continuation vehicle inspection Mercedes-Benz E250 Avantgarde name change Cayenne Turbo to drive recorder mounting Cayenne Turbo brake pad replacement '98 windows rt Porsche 911 Carrera 6MT 02 ? Porsche 911 Carrera Targa TIP 06 ? Alfa Romeo Brera 2.2JTS Sky window 6MT 07 ?Porsche 911 Carrera is S Tip F575M F1 timing belt replacement windows rt '11 Boxster 6MT Ferrari F575M F1 car delivery Lupo GTI vehicle inspection '03 Renault Clio Sport V6 98 ? Rover Mini Mayfair year. Vehicle registration office fuss! It came to air cooling Porsche windows rt carried into trader AA. Yesterday contractors AA
Month the selected April 2015 March 2015 February 2015 January 2015 December 2014 November 2014 October 2014 September August 2014 2014 July 2014 June 2014 2014 5 month April March February January December 2013 November October windows rt September August July June May 2013 2013 2013 2013 2013 2013 2013 2014 2014 2014 2014 2013 year April March 2013 February 2013 January 2013 December 2012 November 2012 October 2012 September 2012 August 2012 July 2012 June 2012 2012 May 2012 April month March 2012 February April January December 2011 November 2011 October September August July June 2011 2011 2011 2011 2011 May 2011 2011 2012 2012 2011 year March February 2011 January 2011 December 2010 November 2010 October 2010 September 2010 August 2010 July 2010 June 2010 May 2010 April 2010 2010 3 month in February 2010 January 2010 December 2009 November October September August July June May April March 2009 2009 2009 2009 2009 2009 2009 2009 2009 2009 February January windows rt May November 2007 December November October September August July 2008 2008 2008 2008 2008 June 2008 2008 2008 2009 year
Limited company Prancing Horse TEL: 03-5310-5577 FAX: 03-5310-1722 Mail: info@p-horse.com
Failure message to the high-mount lamp, license lamp left and right failure message
Thank you all!
Blog Maintenance Ferrari Other Porsche journey already sold vehicle car wish of Stocks News coverage delivered
'95 Mercedes Benz E500LTD dynamo repair '09 Porsche 997 Turbo Early Type the final model yesterday also came to participate in the trader AA. Porsche 996 Carrera 4 continuation vehicle inspection Mercedes-Benz E250 Avantgarde name change Cayenne Turbo to drive recorder mounting Cayenne Turbo brake pad replacement '98 windows rt Porsche 911 Carrera 6MT 02 ? Porsche 911 Carrera Targa TIP 06 ? Alfa Romeo Brera 2.2JTS Sky window 6MT 07 ?Porsche 911 Carrera is S Tip F575M F1 timing belt replacement windows rt '11 Boxster 6MT Ferrari F575M F1 car delivery Lupo GTI vehicle inspection '03 Renault Clio Sport V6 98 ? Rover Mini Mayfair year. Vehicle registration office fuss! It came to air cooling Porsche windows rt carried into trader AA. Yesterday contractors AA
Month the selected April 2015 March 2015 February 2015 January 2015 December 2014 November 2014 October 2014 September August 2014 2014 July 2014 June 2014 2014 5 month April March February January December 2013 November October windows rt September August July June May 2013 2013 2013 2013 2013 2013 2013 2014 2014 2014 2014 2013 year April March 2013 February 2013 January 2013 December 2012 November 2012 October 2012 September 2012 August 2012 July 2012 June 2012 2012 May 2012 April month March 2012 February April January December 2011 November 2011 October September August July June 2011 2011 2011 2011 2011 May 2011 2011 2012 2012 2011 year March February 2011 January 2011 December 2010 November 2010 October 2010 September 2010 August 2010 July 2010 June 2010 May 2010 April 2010 2010 3 month in February 2010 January 2010 December 2009 November October September August July June May April March 2009 2009 2009 2009 2009 2009 2009 2009 2009 2009 February January windows rt May November 2007 December November October September August July 2008 2008 2008 2008 2008 June 2008 2008 2008 2009 year
Limited company Prancing Horse TEL: 03-5310-5577 FAX: 03-5310-1722 Mail: info@p-horse.com
Available link for download
Thursday, February 9, 2017
FDA Certain heart devices may be vulnerable to hacking
FDA Certain heart devices may be vulnerable to hacking
More Health News
You Might Also Like:
Should You Get The HPV Vaccine?
Understanding Chronic Obstructive Pulmonary Disease
How Do We Know that Cholesterol Causes Heart Disease?
Could a drug prevent depression and PTSD? | Rebecca Brachman
Marijuanas Newest Revolution: Genome Mapping
The Bioengineered Organs That Will Save Lives
You Now Have A New Organ: Meet The Mesentery!
Chinese doctor perfects special surgery method
New breakthrough drug shows promise for patients with MS
Troubling news for diabetes patients
Understanding Chronic Obstructive Pulmonary Disease
How Do We Know that Cholesterol Causes Heart Disease?
Could a drug prevent depression and PTSD? | Rebecca Brachman
Marijuanas Newest Revolution: Genome Mapping
The Bioengineered Organs That Will Save Lives
You Now Have A New Organ: Meet The Mesentery!
Chinese doctor perfects special surgery method
New breakthrough drug shows promise for patients with MS
Troubling news for diabetes patients
More
Wednesday, February 8, 2017
Flee to the shadows
Flee to the shadows
Ha! Yes. Ive done what I was threatening to do and redirected my personal site to this thing here. Mainly because up until now my system for updating the site was to change each page individually in Frontpage Express and re-upload, and consequently long periods of time would go by when I just couldnt be arsed. But now Ive got this thing thats way easier to update and all I have to do is whore myself to a big blue bar along the top with an orange thing.
Doubtless there are people even now feeling the beginnings of a panic attack because some infitesimal thing has became different to how it has been for quite a while. Those people can mainline some cocaine and go back to sleep. I did this for my sake. Its a lot easier to update now. Look, heres a link to this weeks Zero Punctuation. See, that was easy. If you honestly liked my old hideous site with all its reams of disorganised crap then theres still a rather obvious link to it on the side right there, along with links to everything else that still matters. Like Mogworld, which you really should buy. Hopefully now I will be considerably more arsed in my regular publishing activities.
Available link for download
Tuesday, February 7, 2017
Five essential oils proven to fight cancer!
Five essential oils proven to fight cancer!
Essential oils are concentrated liquids that are derived from plants. They carry a distinctive scent of the plant and have been used for a variety of medicinal purposes. Essential oil use has grown in popularity over the past several years.(1)
Essential oils can be diluted in a carrier oil and then applied directly to the skin, inhaled through a compress or diffuser, or used in foods and beverages if essential oil brand is safe for consumption.
Essential oils are most powerful via the blood supply to the brain but have an indirect effect through the olfactory nerve pathways!
Essential oils exert most of their pharmacological effects via the blood supply to the brain. They also have an indirect effect via the olfactory nerve pathways in the brain. The oil fragrances are absorbed through blood circulation and nerve pathways from the sinuses into the brain.(2)
There are many ways that essential oils can support the healing of cancer. Some essential oils act directly on cancer cells, prevent growth and promote cancer death. Other essential oils help with stress relief and emotional support. (3)
Five essential oils that are effective in cancer treatment
- Thyme essential oil: A 2010 study from Switzerland evaluated the effect of thyme essential oil on breast cancer cells, lung cancer cells and prostate cancer cells. Thyme essential oil exhibited the strongest cytotoxicity toward all three types of cancer cells. Thyme has an active compound, thymol, which has been shown to activate mechanisms that kill cancer. (3)
- Rosemary essential oil: Rosemary has antioxidant properties that help protect agains free radicals that damage cell membranes, alter DNA and kill healthy cells. Recent studies have shown that rosemary extract has anti-tumor properties that are effective in treatment of colon, breast, liver, stomach, skin and blood. One study found that 1 percent concentration of rosemary essential oil was able to deactivate more than 90 percent of ovarian and liver cancer cells. (3)
- Oregano essential oil: Research from Long Island University’s College of Pharmacy and Health Sciences found that oregano compounds use signaling pathways that cause “cancer cell suicide.” Oregano also has anti-inflammatory and antibacterial properties. Oregano essential oil contains carnosol which has been shown to stop the growth of colon cancer cells as well as cause cancer cell death. Oregano essential oil has shown promising results in fighting prostate, breast and skin cancer.(3)
- Chamomile essential oil: In studies, apigenin, a bioactive constituent, found in chamomile has been shown to have significant effects in inhibiting many human cancer cell lines. A 2010 study found that chamomile essential oil killed 93 percent of breast cancer cells. A separate study found that it was able to inhibit cell mutation by 60-75 percent.(3)
- Frankincense essential oil: Frankincense oil has been shown to treat numerous health conditions, including cancer. Western studies are now showing that frankincense essential oils and extracts have a potent anti-tumor activity. Frankincense oil was tested against pancreatic cancer cells and was able to cause high levels of cancer cell death. The same effect took place in a separate study on bladder cancer cells. This study found that the essential oil was able to distinguish between cancerous cells and healthy cells, leaving the healthy cells alone. (3)
If you or someone you know is fighting cancer, consider alternative therapies. These oils won’t be recommended by most doctors. Natural compounds cannot be patented, meaning the profit is not the same as in pharmaceuticals. (3)
Sources included:
(1) http://abc3340.com/archive/essential-oils-continue-to-grow-in-popularity
(2) http://www.floracopeia.com/education/how-to-use-essential-oils-effectively/
(3) http://www.thealternativedaily.com/herbal-essential-oils-cancer-cells/
Available link for download
Monday, February 6, 2017
Favorite How to Draw Books for Kids
Favorite How to Draw Books for Kids
We gave my twins a How To Draw book for Christmas this past year, and it has proven to be one of those surprise gifts that gets used all the time!
As much fun as toys are, I like my boys to get books, art supplies, games, etc... for gifts. Im sure a lot of you feel the same way.
Anyway, we shopped and searched reviews around Amazon when ordering the book for our boys, and I have to tell you we totally hit the jackpot! These books (we only have the monster one right now, but well for sure be adding to our collection!) are absolutely perfect for young kids. My twins are seven and my four-year-old can even do many of the monsters with a bit of help from me. The steps (six for each monster) are simple and easy to follow. Weve tried a few other drawing books, and my boys just get frustrated because the steps are so complicated. Not these! So, so easy!
This is one of my twins latest monsters. We try to draw something every day while on summer vacation, and with 101 monsters, they have plenty to keep them busy!
Heres my other twins favorite monster. Their new technique is to sketch with pencil, then outline with black marker before adding the color. I LOVE how these turn out! I could even make a pretty good/scary looking monster with these books!
And last, but certainly not least is my four-year-olds monster. He was determined to do what brothers were doing, but I was worried hed just end up frustrated because he couldnt do it. Well, I was wrong! I did have to sit with him and kind of talk him through each step, but look what he was able to do. He was so thrilled, and so was I!
You can find these 101 How to Draw books on Amazon for about $5 (awesome price!). There is a fairy one that Im sure my boys wouldnt go for, but I tempted to buy it for myself!
Happy drawing!
Thanks so much for stopping by! I hope you found a little something worth your time.
Linking up to these parties & Savvy Southern Style.
Available link for download
Five Ways to Take IKEA Furniture From Boring to Beautiful
Five Ways to Take IKEA Furniture From Boring to Beautiful
If youre on a tight budget when it comes to furnishing your home, IKEA is likely one of the first resources that comes to mind, right? Theyve rightly gained a solid reputation for having pieces that are both stylish and affordable, but theres one problem...everyone has the same pieces. If youve ever spent any time at this giant warehouse of a store, you start to be able to spot an IKEA piece from a mile away. While this isnt exactly a life-threatening issue, I do think that seeing the same IKEA furniture over and over can get a little bit tiresome.
Enter: the IKEA hack. This phrase has become a buzzword all over the blog and design world and its a fantastic way to make your IKEA furniture not look like everyone elses. Its a way bring custom-looking furniture into your home at a fraction of the price. Ive done a few of these hacks myself (see my Expedit makeover and semi-custom shelves for examples) and Im sure there will be more in my future.
Today I wanted to show you five ways you can transform an IKEA piece and make it look custom. These five ideas range from super simple (even someone with no DIY skills can do it) to a little bit challenging (you might need a power tool or two), so theres something for everyone. Ill use the ubiquitous TARVA drawer chest to show you how many ways there are to take a boring piece and make it beautiful.
The TARVA is a great example because its a solid wood piece (no particle board or hollow core here!), making it really versatile to hack. Youll see why in the examples below!
1 | KNOBS
Changing knobs and pulls is something anyone can do for a modest price and it automatically changes the look of a piece. This is by far the easiest and lowest commitment change you can make. Many of the examples below also involve other changes, but check out those knobs! |
| {Centsational Girl} |
 |
| {The World According to Jessica Claire} |
 |
| {Cherished Bliss} |
2 | PAINT (OR STAIN)
Painting or staining a piece of furniture certainly takes time and effort, but its another simple way to customize the TARVA. Combine paint with new knobs and youll have a beautiful piece in no time.
 |
| {Smitten Studio} |
 |
| {By Stephanie Lynn} |
 |
| {Chris Loves Julia} |
3 | OVERLAYS
Overlays is a brilliant company that makes, yep, overlays that are made to fit on select IKEA pieces to give them a custom look. They involve no saws, no tricky cuts and no intricate math problems. Hooray! They have an immediate impact on the pieces style.
 |
| {My Pretty Little House} |
 |
| {Overlays} |
 |
| {Sarah and Ben} |
4 | LEGS
Changing the legs on the TARVA probably involves a bit of DIY skill, but I think this, plus paint and knobs, may be the ultimate way to turn a boring piece into a custom one. Because the shape of the TARVA is a very standard box with drawers, the legs can turn the piece into anything from mid-century to farmhouse to industrial. You can even add casters! |
| {Smitten Studio} |
 |
| {City Farmhouse} |
 |
| {Design Sponge} |
5 | TOP
Lastly, another DIY opportunity comes in the form of changing the top. It was harder to find examples of this, but in my mind, there are all sorts of ways you could do this! Staining the top and painting the rest a different color is certainly an option, but how about a faux marble top, or even a metal one? |
| {My Bella Bug} |
.jpg) |
| {Classy and Fabulous} |
Happy IKEA hacking, friends!
Available link for download
Finish up with SAP From a users password to a top managers salary
Finish up with SAP From a users password to a top managers salary
Introduction
Sometimes, obtaining access to SAP, a security analysis specialist has no idea what to do next and how to demonstrate possible consequences of the detected vulnerabilities.
This article covers methods of obtaining access to the production system and data of the SAP HCM module.
One, two, three, out goes he
Weve obtained access to the companys internal network. How can we find SAP applications? The most interesting services:
Run Nmap and analyze the scan results.
Obtaining access
Brute Force
Brute Force is a common method of obtaining access. The list of default accounts:
A library for development of applications working with SAP via the SAP RFC protocol will be used as an instrument. The library contains Startrfc.exe, a utility for RFC testing. Try to connect to the detected system using the default accounts.
If youve managed to guess the password of the SAP* user, then you only need to connect to the system through SAPGUI (start saplogon.exe), and SAP is in your hands.
If default user brute force has failed, then it is possible to sort out passwords using companys employee list (obtained from AD, telephone directories, etc.).
Authentication credential hijacking
If authentication credentials brute force has failed, there is still a chance to hijack them. One of the following utilities can be used to hijack passwords with the help of the DIAG protocol:
Moreover, RFC can be used to perform hijacking. Mariano Nunez Di Croce described the RFC protocol vulnerabilities and SAP access methods in his presentation Attacking the Giants: Exploiting SAP Internals.
Obtained access analysis
If we know authentication credentials of a dialog user, then we only need to install the SAP GUI client and use it to try accessing the system. In case of a successful access, analyze the privileges.
There is a HR management module in the system, which gives us an opportunity to access the employees data.
Privilege gaining
If the account has limited rights, it is worth trying to increase your privileges.
One of the methods to do it is to obtain password hashes. Tables with password hashes: USR02, USH02, USRPWDHISTORY. Methods used to obtain the data:
Use SAPGUI, MIL Read Table, VBS, and SQLplus as instruments. If we know user authentication credentials, we can connect to SAP and obtain password hashes by means of reading the USR02 table with transaction SE16 (if we have an access to it).
John the Ripper 1.7.9-jumbo-5 can be used for hash value brute force, as it comprises analysis of password hash generation algorithms of SAP systems (type B and F). Youll also need password dictionaries (for example, paid downloading of the dictionary Openwall Wordlists Collection Full Version is available).
Alternatively, you can use the automated tools of SAP system security analysis, which allow obtaining user passwords.
SAP HCM security
The SAP HCM system has several peculiarities that often make it vulnerable.
First of all, all data is stored in infotypes. Infotypes are data structures stored in particular tables. The most important infotypes are:
The next SAP HCM peculiarity is authorization settings. General authorizations and structural authorizations may intersect. Not obvious configuration very often results in too much authority granted to common users.
And finally, SAP HCM has a special authorization object P_PERNR, which allows configuring an employees access to his own HR data. Experience has showed that this object is often configured in a way that users can edit their own data.
Data access in HCM SAP
HR transactions
SAP gives you a possibility to access HR data in several ways. First of all, using the HR transactions:
Start transaction PA30, select infotype 0008 and learn the salary of the employee you are interested in. Or increase the salary amount. Substitute the bank account with transaction PA30 and infotype 0009.
Access to HR tables
One more method to access HR information is to read table contents. We are interested in the following transactions:
We need tables, which names start with PA (they contain employees data).
Starting ABAP programs
SAP gives rights to run transactions, and each transaction calls an ABAP program. Therefore, if a user has rights to transaction SA38, he or she can launch a necessary program bypassing the authority needed for the connected transaction.
Here is a list of programs, which can be used to collect information about employees:
Use transaction SE93 to get the names of the programs used to launch other transactions.
Conclusion
We have considered the attack to the SAP system and the possibility not only to obtain information about employees but to gain financial benefit as well.
What can be recommended to increase the SAP protection level?
First of all, pay attention to Basis security. Regular installing of SAP Notes will allow avoiding the majority of threats. Second, do not neglect standards and best practices, especially in configuring SAP Basis or SAP HCM (SAP, DSAG, ANAO). Third, it is necessary to create audit procedures and carry them out regularly. And finally, do not forget about the SAP environment. The SAP system does not exist in vacuum — its security also depends on the security of the operating system, which it is based on, and on the DBMS security, where the data is stored.
Sometimes, obtaining access to SAP, a security analysis specialist has no idea what to do next and how to demonstrate possible consequences of the detected vulnerabilities.
This article covers methods of obtaining access to the production system and data of the SAP HCM module.
One, two, three, out goes he
Weve obtained access to the companys internal network. How can we find SAP applications? The most interesting services:
- SAP DIAG - 32xx-3299 TCP;
- SAP RFC - 33xx-3399 TCP;
- ICM HTTP - 80xx TCP;
- Message Server HTTP -81xx;
- HTTP – 5xxxx.
Run Nmap and analyze the scan results.
Obtaining access
Brute Force
Brute Force is a common method of obtaining access. The list of default accounts:
- SAP* — 06071992;
- SAP* — PASS;
- DDIC — 19920706;
- SAPCPIC — ADMIN;
- EARLYWATCH — SUPPORT;
- TMSADM — PASSWORD.
A library for development of applications working with SAP via the SAP RFC protocol will be used as an instrument. The library contains Startrfc.exe, a utility for RFC testing. Try to connect to the detected system using the default accounts.
If youve managed to guess the password of the SAP* user, then you only need to connect to the system through SAPGUI (start saplogon.exe), and SAP is in your hands.
If default user brute force has failed, then it is possible to sort out passwords using companys employee list (obtained from AD, telephone directories, etc.).
Authentication credential hijacking
If authentication credentials brute force has failed, there is still a chance to hijack them. One of the following utilities can be used to hijack passwords with the help of the DIAG protocol:
- SAP DIAG Decompress plug-in for WireShark;
- SApCap;
- Cain&Abel.
Moreover, RFC can be used to perform hijacking. Mariano Nunez Di Croce described the RFC protocol vulnerabilities and SAP access methods in his presentation Attacking the Giants: Exploiting SAP Internals.
Obtained access analysis
If we know authentication credentials of a dialog user, then we only need to install the SAP GUI client and use it to try accessing the system. In case of a successful access, analyze the privileges.
There is a HR management module in the system, which gives us an opportunity to access the employees data.
Privilege gaining
If the account has limited rights, it is worth trying to increase your privileges.
One of the methods to do it is to obtain password hashes. Tables with password hashes: USR02, USH02, USRPWDHISTORY. Methods used to obtain the data:
- transactions SE16, SE16N, SE17, which provide access to the SAP tables;
- transaction ST04/SQL Command Editor;
- RFC protocol;
- database level;
- obtaining data from the OS file.
Use SAPGUI, MIL Read Table, VBS, and SQLplus as instruments. If we know user authentication credentials, we can connect to SAP and obtain password hashes by means of reading the USR02 table with transaction SE16 (if we have an access to it).
John the Ripper 1.7.9-jumbo-5 can be used for hash value brute force, as it comprises analysis of password hash generation algorithms of SAP systems (type B and F). Youll also need password dictionaries (for example, paid downloading of the dictionary Openwall Wordlists Collection Full Version is available).
Alternatively, you can use the automated tools of SAP system security analysis, which allow obtaining user passwords.
SAP HCM security
The SAP HCM system has several peculiarities that often make it vulnerable.
First of all, all data is stored in infotypes. Infotypes are data structures stored in particular tables. The most important infotypes are:
- 0000 — actions (employment, leaving the enterprise, organizational reassignment);
- 0002 — personal data;
- 0008 — basic pay;
- 0009 — bank details.
The next SAP HCM peculiarity is authorization settings. General authorizations and structural authorizations may intersect. Not obvious configuration very often results in too much authority granted to common users.
And finally, SAP HCM has a special authorization object P_PERNR, which allows configuring an employees access to his own HR data. Experience has showed that this object is often configured in a way that users can edit their own data.
Data access in HCM SAP
HR transactions
SAP gives you a possibility to access HR data in several ways. First of all, using the HR transactions:
- PA20, PRMS —Display HR Master Data;
- PA30, PRMD —Maintain HR Master Data;
- PA40, PA42 — Personnel Actions;
- PA61 —Maintain Time Data.
Start transaction PA30, select infotype 0008 and learn the salary of the employee you are interested in. Or increase the salary amount. Substitute the bank account with transaction PA30 and infotype 0009.
Access to HR tables
One more method to access HR information is to read table contents. We are interested in the following transactions:
- SE16, SE16N, SE17 — General Table Display;
- SM30, SM31 — Call View Maintenance;
- SE11 — ABAP Dictionary.
We need tables, which names start with PA (they contain employees data).
- PA0000 —employment, leaving the enterprise, organizational reassignment;
- PA0002 — personal data;
- PA0008 — basic pay;
- PA0009 — bank details.
Starting ABAP programs
SAP gives rights to run transactions, and each transaction calls an ABAP program. Therefore, if a user has rights to transaction SA38, he or she can launch a necessary program bypassing the authority needed for the connected transaction.
Here is a list of programs, which can be used to collect information about employees:
- RPPSTM00 — HR Master Data Sheet;
- RPLMIT00 — Employee List;
- RPLEHSU0 — Employee History Report;
- RPLNHRU0 — New Hire Reporting.
Use transaction SE93 to get the names of the programs used to launch other transactions.
Conclusion
We have considered the attack to the SAP system and the possibility not only to obtain information about employees but to gain financial benefit as well.
What can be recommended to increase the SAP protection level?
First of all, pay attention to Basis security. Regular installing of SAP Notes will allow avoiding the majority of threats. Second, do not neglect standards and best practices, especially in configuring SAP Basis or SAP HCM (SAP, DSAG, ANAO). Third, it is necessary to create audit procedures and carry them out regularly. And finally, do not forget about the SAP environment. The SAP system does not exist in vacuum — its security also depends on the security of the operating system, which it is based on, and on the DBMS security, where the data is stored.
Author: Evgenia Shumakher
Available link for download
Subscribe to:
Posts (Atom)