chipik / sap_gw_rce_exploit Goto Github PK
View Code? Open in Web Editor NEWSAP Gateway RCE exploits
License: GNU General Public License v2.0
SAP Gateway RCE exploits
License: GNU General Public License v2.0
I am currently playing with exploit.
One word commands are working perfectly, but when I am trying to run commands with parameters, it seems it ignores them. For example, whoami returns me username, but whoami --help also return username.
Is it possible to encode command string to pass also parameters after space?
kali@kali:~/SAP_GW_RCE_exploit$ python SAPanonGWv1.py -t 172.16.30.28 -p 3300 -c whoami
[*] sending cmd:whoami
Traceback (most recent call last):
File "SAPanonGWv1.py", line 155, in
print run_cmd()
File "SAPanonGWv1.py", line 78, in run_cmd
return RCE_gw() # via gateway
File "SAPanonGWv1.py", line 85, in RCE_gw
result = exploit(cmd, param)
File "SAPanonGWv1.py", line 107, in exploit
s.connect((args.target, args.port))
File "/usr/lib/python2.7/socket.py", line 228, in meth
return getattr(self._sock,name)(*args)
socket.error: [Errno 111] Connection refused
Many thanks for the great work!
I've spotted a problem:
When I try to execute both Scripts, I get an Error, that the function "SAPXPG_END_XPG not found" (tested with SAP Kernel 753) error_K753.zip
python SAPanonGWv1.py -t 192.168.66.19 -c whoami -p 3300
[*] sending cmd:whoami
python SAPanonGWv2.py -t 192.168.66.19 -c whoami -p 3300
[INFO ] [+] Sending GW_NORMAL_CLIENT
[INFO ] Response: OK
[INFO ] [+] Sending F_SAP_INIT
[INFO ] Response: OK
[INFO ] [+] Sending F_SAP_SEND
[INFO ] [+] Sending F_SAP_SEND2
[!] Error. resp_lines = 0 or resp_type = 0
I did a test, to capture the communication between to SAP Systems where an OS command get executed via SM49
sapxpg_working_SM49.zip
I tried the Scripts on an older SAP Kernel (742) and it did work as it should. (that's the reason why I think that the newer Kernel causes the problems)
Would be great if you could have a look at the scripts, to fix the error!
Thanks!
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.