Introduction
In this case study, we detail a comprehensive penetration test of a client’s SAP ABAP deployment within our financial industry client. Our objective was to identify security weaknesses that could compromise the integrity and confidentiality of critical financial data and transactions managed by this core system.
SAP is a pivotal platform in the dynamic enterprise software industry, powering critical business processes across sectors with its seamless integration, robust development environment, and optimized performance. These processes include finance, logistics, and human resources. As one of the most widely used Enterprise Resource Planning (ERP) software applications, SAP, short for Systems, Applications, and Products in Data Processing, provides a comprehensive suite of solutions. ABAP, which stands for Advanced Business Application Programming, is the programming language utilized to create applications within the SAP ecosystem. Therefore, the most common components of this information system include finance, planning, costs, commercial, marketing, manufacturing, logistics, maintenance, quality control, and HR functions.
SAP ABAP Attack – Walkthrough
This section will focus on exploitation attacks to see how to approach pentesting towards an ERP (SAP-ABAP),
An SAP system that uses both ABAP and J2EE is known as a “dual stack instance.”
Prerequisites
The main objective will be to obtain access to a SAP-ABAP system, which will be achieved through client software called SAP-GUI. In order to log in, specific parameters are required, which are listed below:
- IP Address
- System ID
- Instance Number
- Client Number
- Credentials (Username and Password)
Essential Tools for SAP ABAP Pentesting
The following tools are required to perform pentesting on SAP ABAP systems, available for both Windows and Linux (Kali)
- Nmap: For network discovery and security auditing.
- Metasploit: For penetration testing.
- Sapyto: A specific tool for SAP security testing.
- SAP-GUI: SAP graphical user interface for connecting to the system.
Nmap
NOTE: If the Kali distribution is used as the hacker system, all the tools mentioned will be preinstalled by default, except SAP-GUI and Sapyto.
Tools like Nmap, Metasploit, and Sapyto help identify the SAP server and its open ports. Common SAP ports include 32XX, 33XX, 36XX, 39XX, 3299, 50XX, and 81XX. Commands for these tools can help discover server details.
nmap –sV 10.49.96.206 –p 3200-3299,3300-3399,8000-8099,8100-8199,50000-59913,80,443
Metasploit
We can use the Metasploit framework to accomplish the same result using the sap_service_discovery auxiliary. The output of the previous command should resemble
msf auxiliary(sap_service_discovery) › run
Sapyto
Using the Sapyto framework enables us to achieve the same outcome but requires more advanced configuration. To get started, we must configure the Sapyto options and specify a target with its respective IP address and connector, as shown in the following images.
Executing the target and help commands on Sapyto
Running Sapyto’s addTarget and set host command
Execution of the discoverConnectors command associates a target with a Sapyto’s connector, and the back command triggers the connector discovery.
As can be seen in the different images, a large amount of helpful information has been obtained, within which the database used by the ERP has been identified, in this case, a database (MSSQL).
Reconnaissance
Once the objective has been identified, the next task is to obtain the SAP server’s System ID, which can be done with Metasploit or Sapyto.
Metasploit – System ID
Using the Metasploit framework, the System ID can be obtained with the following auxiliary sap_mgmt_con_version
Sapyto – System ID
To obtain the System ID with Sapyto, we must select the sapinfo plugin located at plugins/audit, as shown in the images below.
Once Sapyto is configured, the next step is to execute it with the start command.
Up to this point, we have obtained the IP address and the System ID, so the instance number is still needed. Most of the time, the instance number is the last two numbers of the RFC Destination, in this case, “00“
Instance Number
If, for some reason, the instance number was not obtained with the sapyto plugin called sapinfo, it could be checked by hand; the following instances are the most common:
- 00
- 01
- 02
- 03
- 04
- 05
- 06
Sapyto – Client Number
Using the Sapyto framework, it can be obtained with getClients plugin, which is located in the following path /plugin/Discover/getClients/
Configuring SAP-GUI
Once you have all the required parameters, configure SAP-GUI to create a new system entry. Use the gathered information to establish a connection to the SAP system.
Once you have done the above, a new window will open. Click on continue. A window will open again, and you will have to provide all the parameters previously obtained with the Metasploit and Sapyto tools and click on the continue button.
Credential Discovery
Credentials can be obtained through brute force attacks using tools like Sapyto and Metasploit or by using default credentials often overlooked by administrators. Common default credentials include user SAP* with password PASS.
| User ID | Description | Client | Password |
| SAP* | superuser | 000,001, 066 | 06071992 |
| New Clients | PASS | ||
| DDIC | ABAP SuperUser | 000,001 | 19920706 |
| EARLYWATCH | User for earlywatch service | 066 | SUPPORT |
| SAPCPIC | Communication user | 000, 001 | ADMIN |
| TMSADM | Transportation system administrator user | 000 | PASSWORD / $1Pawd2& |
For this particular case, the following information will be used to enter the SAP system:
- Client 610
- SAP User*
- Password PASS
Gaining System Access
Upon entering the correct credentials, we will gain access to the SAP system, allowing us to perform various post-exploration attacks. Once the information has been entered and if it is correct, the following window will appear.
If all the information is correct, access to the SAP system should be obtained. Once inside the system, various activities could be carried out, remembering that it is a Business Resource Management system. Therefore, the most common components of this Information System include finance, planning, costs, commercial, marketing, manufacturing, logistics, maintenance, quality control, and HR functions. Technologically speaking, the following could be done:
- Obtain System Information
- Listing SAP’s Users
- Creating New Users With Administrative Roles (SAP_ALL)
- Extracting User’s Hashes
- Executing OS-level Commands
- Get RFC Connections
Obtaining System Information
This is achieved by clicking on the following path: Menu > Systems > Status.
Listing SAP’s Users
As shown below, transaction nsu01 will be used to retrieve the users’ names.
Creating New Users With Admin Role (SAP_ALL)
The same transaction (/nsu01) will be used to create a user in the SAP system, as shown below.
Extracting User’s Hashes
Here we will use transaction nse16 and the database table /usr02 to obtain the user hashes, as shown in the images below.
As a recommendation, set the Output List Width parameter to 500 as well as the Maximum Number of Hits. Once finished, click on the clock-shaped icon shown in the image below.
A new window will open, showing the hashes of each user in the SAP systems that handle two types of hashes.
- BCODE
- PASSCODE
John the Ripper (or Hashcat) is used to crack hashes.
Executing OS-level commands
To execute commands at the Operating System level, the /nse38 transaction will be used along with the report number RSBDCOSO. Then, click on the clock-shaped icon.
Once the above is done, a new window will open in which you can enter your preferred command.
NOTE: The level of privileges will depend on the user with whom the SAP system has been installed
Creating a new user and adding it to the Administrator Group.
Exploring RFC connections
Transaction /nsm59 is used to find the system’s RFC (Remote Function Call)connections with other SAP systems. This can be particularly useful if the SAP system has ABAP connections with other SAP systems. Double-clicking on one of these connections might give you automatic access to the other system.
Conclusion
SAP ABAP remains a relevant and critical platform for pentesting in 2024 due to its widespread use in enterprise environments for critical business operations. As SAP systems often handle sensitive data and core business processes, ensuring their security is paramount. At RBT Security, our main focus is to help companies identify vulnerabilities, enhance security measures, and protect against potential cyber threats. This case study was written to help identify and exploit common vulnerabilities in SAP systems.
Credits & References
- SAP TRANSACTION CODES
- SAP password hash algorithms
- SAP-passwords
- SAP-dual stack instance
- Hacktricks
- BlackHat
Christian Ramirez (a.k.a. Polunchis) is a seasoned cybersecurity professional with nearly two decades of hands-on experience in offensive security and adversarial simulations. He specializes in web application, cloud (AWS, Azure, GCP), and infrastructure penetration testing, having led numerous high-impact engagements that strengthened organizational resilience worldwide.
His expertise spans red and purple team assessments, exploit and malware development, advanced evasion techniques, and bypassing AV/EDR defenses. Over his career, Christian Ramirez has tested diverse environments including web services, APIs (SOAP & REST), thick clients, wireless networks, SAP ERP systems, and ATMs.
Renowned for delivering realistic adversary emulation and comprehensive threat analysis, Christian Ramirez empowers organizations to detect, defend, and respond to advanced threats effectively. Blending technical precision with strategic insight, he helps teams uncover vulnerabilities and elevate overall security maturity.
When not dissecting systems or leading red team operations, Christian Ramirez shares his knowledge through research, thought leadership, and collaborative defense initiatives that push the boundaries of modern cybersecurity.