Bizploit's implementation of the exploit against this vulnerability works by registering an RFC server with the SAP gateway using a Tpname specified by the user while at the same time 'sticking' to the legitimate RFC server that is to be impersonated, blocking all further connections to it. All subsequent requests to this server will be disregarded, allowing the Evil Twin server to deal with the requests instead. 1. Once the pre-requisites have been met and the required information has been acquired, the first step is to register the fake RFC server with the SAPGateway using the same Tpname as the existing server (in this case test-lapv4-34.srfc.serv) Fig 1.4 -- connectExtRFC returns OK, indicating that the legitimate RFC server is reachable with the Tpname configured. The 'stick' plugin is then launched to block all further connections to this server. From here, all incoming RFC calls meant for the server we are intercepting will reach us in a man-in-the-middle style attack, possibly leaking credentials and other sensitive data to us. A stealthier, more advanced version of this attack can be made by turning it into a fully fledged man-in-the-middle attack by forwarding on incoming requests and responses between the client and legitimate RFC server, however this is not supported by Bizploit at the time of this writing. Callback Attack While the previous attack is a man-in-the-middle attack, Callback results in compromise in the form of code execution on the application server with the privileges of the user that made the call. The