The AI Perfect Storm: How Mythos-Like AI Models Can Hack SAP Applications

With the first one. . . . . 4s This is the the the screen of the attacker. The attacker will be using Claude Code in this case. So first, it’s showing that it has nothing already pre configured. And you’re gonna see first the prompt. So the prompt, as I was telling you, it’s gonna mention something about, okay, here’s the system that we need to assess. This is the plan, first map, then reason, then exploit. And what we want is you to create a new user and tell me all the different steps that I have to do to connect to that system with this new user. That’s all. And if you see, we are not entering more prompts. Of course, the AI will work. We already see that this has been working for thirteen, fourteen minutes. In the phase one is mapping all the threat landscape and it already sends says that it has a major finding, something around SAP * I just the attacker just paused well, I just paused you to show you the demo, but the phase two is, okay, let’s reason. Now we have these findings. What should I do? And it will start with the recommendation, which is strategy a, the one that is stick. So phase three is just exploit. And again, we can see that after we have been working more or less for twenty, twenty two minutes and the AI tells, hey, are you already finished? You have your new user. This new user is admin has admin privileges, and this is the way to connect to the system. So if you see there, there is the URL. The attacker is connecting to that URL using the credentials of the SAP system sorry, the AI provided. And once it’s logged in, which is yeah. Already, the attacker has a user with full privileges inside the SAP system. This is incredible. And just to show you, when you go to profiles, this user had SAP _ALL So the consequences are drastic because it means that it has full power on that system, and it can do, uh, whatever he wants.

So in this case, we’re gonna go a bit further, and the idea is to change the bank account vendor sorry, the vendor’s bank account. So, initially, in this demo, we’re gonna see at the first that it’s gonna start as likewise, as as the other one launching called cloud sorry, Claude Code. And here is the prompt, which is exactly the same. Exactly the same. The system changes. The system is a different one. Again, the objective. So instead of now creating a user, what I want you to do is to execute something exploit something, sorry, and gave me privileged access. That’s all. So this one was a little bit more I would not say complex, but first of all, it’s assessing a mapping the system landscape, different ports, different service. It realizes that there is a the gateway is misconfigured. But it downloaded a public POC, but it didn’t work because of some small details. So here, as you can see, there is a second prompt, which is, again, not saying anything specific from SAP, just saying more information like Python two installed because it was trying to use Python three. And please consider seeing the results, analyzing the results that you are getting, and trying to change what you did, but nothing specifically. And after a couple more minutes of work, I would say between I don’t know. I don’t recall exactly, but let’s say ten, twelve minutes, we’re gonna start seeing that, um, the AI realizes that the remote execution is confirmed, and that is possible without any kind of authentication to execute remote code in the system remote commands in the system. Um, So here we are. So as you can see there, uh, we have the exploit already finished or yeah. And it’s possible to be used. So the attacker now, what it’s doing is, okay. Now with the access that you have, I would like to talk to list the top ten vendors order by billing, grab the first one, and modify the bank account of that vendor and put some values that the attacker wants. . . 2s So here, what you’re gonna see now is, like, let’s change our shoes, and we are the admin of the system, and we are logging it through SAP GUI. This is not part of the attack. This is just to show you that the vendor data, well, of this specific vendor that is gonna be changed is there, and this is the original values. So going back to the attacker choose, the AI is still working. What it’s been doing basically is through the OS command execution is launching SQL queries directly to the database and modifying those data those the routing number and the account number. So at the end, we’re gonna see a message after fifty minutes more or less of work. We’re gonna see a final message of the of Claude Code saying that the change was already done, as you can see there. So the new values of the routing number and the account number are already in place. So, again, if we show this from an admin perspective and we launch the system and we show the information from the vendor, we’re gonna see that the new values are written over there.

Move on to the final demo, demo number three, which is related to shutting down the SAP system. In this case, we’re gonna see again the same framework of attack launching Claude Code. The prompt is a little bit different now, but again, it says nothing specific about SAP. It’s just saying this is a system. And I heard that there is an exploit from twenty twenty five that is out there created by this, threat actor group, please try to assess if this system is vulnerable to it. So the first thing it does, is collecting different POCs that are published online and start analyzing them, downloads them, analyze them. This is also, I think it was instructed by the prompt because we didn’t want to run any kind of POC. So it tried to look for the POCs, assess them, analyze them, try to understand which was the one that could really work because for this specific vulnerability, there were a lot of, POCs published publicly that were not working at all. So here we have a ranking, and it’s grabbing the first one, the most recommended one, right? So the attacker in this case, it’s just saying, hey, yeah, I don’t know, run this one and try to confirm if there is a remote code execution possible in this system. One way of exploiting this was very famous was to upload a web shell, and this is exactly what this script is doing. So what is going to happen now is that the AI is already demonstrating that the full remote code execution is working and is uploading this web shell, right, to that specific web, to to that specific URL. So finished. The remote code execution is possible. So, if you just as an attacker copy this and wanted to try by yourself to confirm, here you can see that the web shell was deployed and is actually working. So you have remote code execution in the system again once more, in this time in a house system. So now the main goal of this demo was to shut down the system. So the attacker in this case is just prompting this to the AI asking to shut down the system. Could the the attacker do this with a command in the web shell? Yes, of course. But the idea was to use AI, so just ask it. Please shut it down for me. So afterwards, if we go back to the web browser and we refresh, we’re gonna see that system is already down.

Onapsis solutions are seeing like, hey, there is some type of activity in the system. So number one, and if you think about the LLM, what it’s doing is basically pinging different clients to see which ones is receiving a feedback, which one is enabled. So with that being said, they see that client one, which didn’t have a SAP * user enabled. Now it’s basically receiving or sending a response to the LLM. Also from Onapsis secure product or from the continuous monitoring capability, it’s also telling us that someone logs in with the SAP* user into the system, which makes it again, part of the exploitation process that Pablo just demonstrated. Now Onapsis is capturing all that information into the different products. And last one but not least one is look, the scenario is once you’re logged in with a SAP * user, the attackers basically what they want to do is, look, they create another user, they assign a high profile. So when they’re doing the security team is trying to do the investigation and seeing what’s happening in their system, it’s more difficult for them to detect that the attack it’s possible or it was executed. In this case, what we are demonstrating with the Onapsis platform, we’re telling the customer, hey, someone with a SAP * user logs into the system and basically connects it and creates another user inside that high profile, which is something that, you know, from the security perspective shouldn’t happen.