Deep-dive into SAP archive file formats

Abstract

SAP systems make use of custom archive file formats in several different places, such as for distributing software components and in the code transport mechanism. While the compression algorithms used by SAP have been known for a few years, they were only targets of security analysis recently. Additionally, the file formats are proprietary and there is not much public information about how to properly interpret such files.

This talk will shed some light over the compression algorithms and the CAR and SAR file formats, while demonstrating some potential attack vectors involving this type of files. Moreover, we’ll discuss how to dissect and examine these files for both offensive and defensive purposes, using an open source Python library.