RECON Authentication Bypass in SAP NetWeaver AS Java LM Configuration Wizard

This repository contains a single Metasploit auxiliary module targeting SAP NetWeaver systems vulnerable to CVE-2020-6287 (RECON). The module exploits an unauthenticated SOAP web service (CTCWebService) to create or remove users with arbitrary roles (defaulting to Administrator) on the target SAP system. The exploit works by submitting a job to the CTCWebService endpoint, monitoring its progress, and then canceling the job to minimize system changes. The module provides two actions: 'ADD' (create user) and 'REMOVE' (delete user). The main fingerprintable endpoint is the '/CTCWebService/CTCWebServiceBean' path, typically accessible on port 50000. The exploit is operational and can be used to gain administrative access to vulnerable SAP systems without authentication. The code is written in Ruby and is designed to be run within the Metasploit framework.

This repository contains a Python proof-of-concept exploit (RECON.py) for the SAP RECON vulnerabilities CVE-2020-6287 and CVE-2020-6286 affecting SAP NetWeaver Application Server Java (LM Configuration Wizard). The exploit leverages missing authentication and a directory traversal flaw in the 'queryProtocol' SOAP method exposed at the /CTCWebService/CTCWebServiceBean endpoint. The script provides several capabilities: (1) checking if a target is vulnerable, (2) downloading arbitrary ZIP files from the server via directory traversal, (3) creating a new SAP Java user with standard privileges, and (4) creating a new SAP Java user with Administrator privileges. The exploit is operational and requires the attacker to specify the target host, port, and desired action via command-line arguments. The main attack vector is network-based, targeting the SOAP web service endpoint over HTTP(S). The repository consists of a single Python exploit script, a README with usage instructions and background, and a .gitignore file.

This repository provides a Python proof-of-concept exploit for CVE-2020-6287, a critical unauthenticated remote code execution vulnerability in SAP NetWeaver. The exploit consists of a single Python script ('sap-CVE-2020-6287-add-user.py') and a README file. The script allows an attacker to create a new user with arbitrary credentials on a vulnerable SAP NetWeaver system by sending a specially crafted SOAP request to the '/CTCWebService/CTCWebServiceBean/ConfigServlet' endpoint. The exploit first checks if the target is vulnerable by accessing the WSDL at '/CTCWebService/CTCWebServiceBean?wsdl'. If the target is vulnerable, it sends a base64-encoded XML payload to create a new user. The exploit does not grant administrator privileges to the new user. The README provides usage instructions and references to the original Metasploit module and research. The attack vector is network-based, requiring only HTTP(S) access to the target system.