Given a demo system for a fair which is based on SAP Netweaver ABAP. Our application has a bug which cannot be fixed easily, at least not in time for the fair. The workaround is to give the users of the demo SAP_ALL access rights.

SAP_ALL is a bad idea, I know. Please, let's not discuss that part. I did already and it will just be that way.

We do not care about the data in the system. It's an IDES demo system and we have a program that can delete the data (our application data) and reset it into the delivery or demo state. So it's not a big deal if someone manipulates data.

As a tester of that system, I have application knowlegde but not enough SAP administration knowledge. I wonder whether it would be possible to somehow transfer an executable to that server (via transaction CG3Z maybe) or create one on the server and later run it.

IMHO this would be an undiscussed attack surface and if it's possible, it would give me a new argument to talk to people again.

Maybe it's relevant: our application needs ICM (Internet Communication Manager) and HTTP, so a port will be open.


Yes, SAP_ALL gives you all you need to get a shell as <SID>ADM on the box. First, you can run report RSBDCOS0 which gives you OS code execution right away. Second, you can make use of the sapxpg mechanism which also executes OS programs. As SAP_ALL user, you can also change the config so that RCE is possible over the network.

Both mechanisms allow you to add another SAP_ALL user for later use by directly inserting 2 lines into USR02 using a DB client which escapes all SAP-internal logging.


Yes, SAP_ALL allows for privilege escalation within the environment -- and there will be a channel out to allow for malicious-logic communications. An attacker can use an executable but even that is not necessary. The ability to execute code though, should go without saying.

For a temporary assignment to SAP*, check out this script -- http://www.geocities.ws/krapinskij/abap.htm#_Getting_a_little_bit_more_authoriza -- which, as you can see, uses SAP_ALL for nearly-invisible privilege escalation. If a Basis administrator uses a standard account checker, this script won't show the elevated privileges.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.