This document summarizes security vulnerabilities in PeopleSoft systems. It describes how an attacker could potentially gain remote code execution on the PeopleSoft web server and application server. It then explains how the attacker could use this access to decrypt database credentials and escalate their privileges to compromise sensitive user data and business systems. The document provides details on specific bugs like buffer overflows and hardcoded credentials that could be exploited at different points in this attack chain. It aims to demonstrate a potential "hardcore" attack scenario and the risks of unpatched PeopleSoft instances.

1. PeopleSoft: HACK THE
Planet^W universityby Dmitry Iudin, Security Researcher at ERPScan

2. Security Researcher
Dmitry Yudin
@ret5et

5. PeopleSoft
Used by:
Universities
Government and its institutions
Large enterprises, etc.

6. PeopleSoft
Campus solutions
Human Capital Management
Financial Management
Supplier Relationship Management …

7. Attack Targets
 Personal information
 SSN
 Salary data
 Payment information
 Credit card data
 Bank account data
Bidding information
- RFP
- Prices

8. Attack Targets
 Espionage
 Theft of financial information
 Corporate trade secret theft
 Theft of supplier and customer lists
 Stealing HR data (employee data theft)
 Sabotage
 Denial of service
 Tampering with financial reports
Fraud
- False transactions
- Modification of master data

9. PeopleSoft

10. A Bit of Theory

11. PeopleSoft Pure Internet Architecture

12. The Web Server

13. Web Server
• Host PeopleSoft Servlets
• Communicates with AppServer
• Front end

14. PeopleSoft Application Server

15. DATABASE

16. Configuration and Deployment
Options
AppServer and database on same server

17. Configuration and Deployment
Options

18. PeopleSoft Pure Internet Architecture
 These 3 main components are common for all PeopleSoft
applications.
 All applications mainly differ only in business logic that exists in
a database.
 Pwning these components is equal to Pwning all application
types.

19. Attack from Internet hardcore
scenario
1. Get RCE on Peoplesoft WebServer
Recon Application Server in internal network
1. Get RCE on Application Server
On AppSvr side decrypt low level DB credentials.
1. Gain low level access to a database.
Get and decrypt high-level DB credentials from the db.
AccessID - «this account is the key to the kingdom»
1. Profit

20. Find PeopleSoft CS systems in WWW

21. Or other PeopleSoft Systems ...

22. Default PeopleSoft Servlets on
WebServer
 PORTAL.war - PeopleSoft Interaction Hub
 PSEMHUB.war - Environment Management Framework
 PSIGW.war - Integration gateway
 PSINTERLINKS.war - Business Interlinks
 PSPC.war - PeopleSoft PortletContainer Servlet.

23. Most Critical Known Bugs
 CVE-2017-10061 - RCE (CVSS v3 score – 8.3)
 CVE-2017-10366 – RCE (CVSS v3 score – 9.8)
 Any SSRF + lack authentication from localhost in PeopleSoft Apache
Axis component equal
RCE
 SSRF bugs: CVE-2013-3800, CVE-2013-3821, CVE-2017-3548,CVE-
2017-3547 ...

24. RCE on PeopleSoft
WebServer is
not a PROBLEM

25. RCE on PeopleSoft
WebServer is
not a PROBLEM

26. PSIGW.war
 CVE-2017-10061
 CVSS Severity (version 3.0): 8.3 High
 CVSS Version 3 Metrics:
 Attack Vector (AV): Network
 Attack Complexity (AC): Low

27. DEMO

28. Find AppSvr in internal network
$ pwd
/home/psadm2/apps/PORTAL.war
$ cat WEB-INF/psftdocs/ps/webprof/config_prop | grep -i
appserver -A 1
<string>appServer</string>
<string>192.168.56.101:9033</string>

29.  CVE-2017-10146 - Directory Traversal
 Attack Vector (AV):
 Network
 Attack Complexity (AC):
 Low
 Privileges Required (PR):
 None
Find AppSvr in internal network

30. Find AppSvr in internal network

31. Remote attack: hardcore scenario
1. Get RCE on Peoplesoft WebServer
Recon Application Server in internal network
1. Get RCE on Application Server
On AppSvr side decrypt low level DB credentials
1. Gain low level access to a database.
Get and decrypt «AccessID» from db.
AccessID - «this account is the key to the kingdom»
1. Profit

32. PeopleSoft AppServer

33. Some Theory

34. PeopleSoft AppServer
An application server consists of numerous PeopleSoft services and
server processes.

35. PeopleSoft AppServer processes
 PSAPPSRV
 PSQCKSRV
 PSQRYSRV
 PSSAMSRV
 PSOPTENG
 PSMSGDSP
 PSMSGHND
 PSPUBDSP
 PSPUBHND
 PSSUBDSP
 PSSUBHND
 WSL
 WSH
 JSL
 JSH
 RMI Services
 etc.

36. PeopleSoft AppServer
 Many processes = large attack surface
 But … most of them are binary, native code applications.

37. PeopleSoft AppServer
 After some research, we have found some interesting bugs. Now we
are trying to write exploits for them.
 But we don’t have RCE on AppServer yet.

38. PeopleSoft AppServer
 After some research, we have found some interesting bugs and now
we are trying to write exploits for them.
 But we don’t have RCE on AppServer yet.

39. Remote attack hardcore scenario
1. Get RCE on Peoplesoft WebServer
Recon Application Server in the internal network
2. Get RCE on Application Server
On the AppSvr side decrypt low level DB credentials
1. Gain low level access to a database.
Get and decrypt «AccessID» from the db.
AccessID - «this account is the key to the kingdom»
1. Profit

41. BUT ...

42. AppServer RMI service
We have PeopleSoft RMI service with hardcoded credentials...

43. AppServer RMI service
Java Remote Method Invocation (Java RMI) is a Java API that performs
remote method invocation, the object-oriented equivalent of remote
procedure calls (the RPC), with the support for direct transfer of
serialized Java classes and distributed garbage-collection.

44. PeopleSoft AppServer

45. AppServer RMI service
By using this service, we can get:
• AppSvr runtime info
• AppSvr Network statistic
• Java Memory pool info
• CPU Load info
• FileStore Information
• ...
• Access to AppServer logs

46. AppServer RMI service
By using this service, we can get:
• AppSvr runtime info
• AppSvr Network statistic
• Java Memory pool info
• CPU Load info
• FileStore Information
• ...
• Access to AppServer logs

47. AppServer RMI service
In some cases, access to AppServer logs can lead to a leakage of an
authentication token. For example, if debug logging is enabled on the
server side.

48. AppServer RMI service
DEMO

49.  RCE on PeopleSoft WebServer side
 We can read TOKEN from AppServer log:
 If debug mode is on
 It seems that debug mode is not common for PeopleSoft
production servers
 If we are lucky enough, we can get access to some account tokens.
What we have?

50. What we have?
1. Get RCE on Peoplesoft WebServer
Recon Application Server in the internal network
1. Get RCE on Application Server
On the AppSvr side decrypt low level DB credentials
We got partial “access” to Application Server
1. Gain low-level access to a database.
Get and decrypt «AccessID» from db.
AccessID - «this account is the key to the kingdom»

51. What do we have here?

52. But we can exploit another
bug...

53. DEMO

54. PeopleSoft Application Server
buffer over-read
We can disclose user passwords in plain text, remotely.

55. PeopleSoft Application Server
buffer over-read

56. Attack Scenario
 Get access to PeopleSoft web server
 Recon AppServer
 Passively dump credentials from AppServer
 Collect user names and passwords.
 Find accounts with high business roles in the system
 …
 Profit

57. What if we had RCE on the AppServer
The main target of those pentesting AppServer is psappsvr.cfg
But values in psappsvr.cfg are «encrypted».

58. psappsrv.cfg
 UserPswd=sC33X45qyMXPEbKTYHrJ06Fd31PfKYBdSEgL5e0i1vE=
 ConnectPswd=gizrWPhLwsI5KYakWwvJDLtoEGNNNG4lFfq8W5x/NpM=
 DomainConnectionPwd=iSTwU6g03N1UlzIng6I+fsXdd6L02b3iQrAW5Ah ...

59. psappsrv.cfg „decryption“
$ ubbgen -decr iSTwU6g03N1UlzIng6I+fsXdd6L02b3iQrAW5AhSeOo=
jahce6queiXeevoo1quo0nano #decrtypted password

60. ubbgen utility
UBBGEN’s usage prompt doesn’t show “-decr” and “-encr” options, it
seems that are «hidden».

61. ubbgen utility
UBBGEN’s usage prompt doesn’t show “-decr” and “-encr” options, it
seems that are «hidden».

62. psappsrv.cfg
 DBName=...
 DBType=...
 UserId=PS - # default PeopleSoft admin
 UserPswd=<encrypted password> # admin password
 ConnectID=people # default connection id
 ConnectPswd=<encrypted password>

63. PeopleSoft Administrator Role
(PS user)
This role does NOT have any access to critical business data.

64. ConnectID
 Real Database ID
 Required to establish the initial connection to the database
 Used by AppServer for initial authentication with PeopleSoft database
 Access to encrypted “AccessID”

65. PeopleSoft AppServer Sign In
 Initial connection.
 The application server uses the ConnectID and UserId specified in
its configuration file (PSAPPSRV.CFG) to perform the initial
connection to the database.
 The server performs a SQL Select statement on the security tables.
 Check UserID and UserPswd
 The server reconnects using the AccessID.
 The application server begins the persistent connection to the
database that all users use to access the database.

66. Getting encrypted AccesID
$ sqlplus «ConnecId»@«db ip address»:1522/«dbname»

67. $ select STM_ACCESS_PART1, STM_ACCESS_PART2, STM_ACCESS_ID,
STM_ACCESS_PSWD from SYSADM.PSACCESSPROFILE;
Getting encrypted AccesID

68. $ stmdecr <STM_ACCESS_PART1> <STM_ACCESS_PART2>
<STM_ACCESS_ID> <STM_ACCESS_PSWD>
Getting encrypted AccesID

69. stmdecr
stmdecr will be published soon … :|

70. Conclusion
• Implement latest CPUs
• Perform external Security Audits

71. Read our blog
erpscan.com/category/press-center/blog/
Join our webinars
erpscan.com/category/press-center/events/
Subscribe to our newsletters
eepurl.com/bef7h1
USA:
228 Hamilton Avenue, Fl. 3, Palo Alto, CA. 94301
Phone 650.798.5255
EMEA:
Luna ArenA 238 Herikerbergweg, 1101 CM Amsterdam
Phone +31 20 8932892
erpscan.com
inbox@erpscan.com
Thank you
Dmitry Yudin
Security Researcher at ERPScan
d.yudin@erpscan.com