<details>

<summary><strong>Learn AWS hacking from zero to hero with</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>

Other ways to support HackTricks:

* If you want to see your **company advertised in HackTricks** or **download HackTricks in PDF** Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
* **Share your hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.

</details>
```text
PORT     STATE SERVICE    VERSION
3299/tcp open  saprouter?
```
**tlhIngan Hol Translation:**

## SAProuter Penetration with Metasploit teb summary

SAProuter, SAP tIq 'ej SAP networkmeyDaq Internet 'ej SAP networkmeyDaq vItlhutlh, SAProuter vItlhutlh. 'oH commonly exposed to the internet by allowing TCP port 3299 through organizational firewalls. SAProuter vItlhutlh penetration testing vItlhutlh target vItlhutlh, qaStaHvIS vItlhutlh internal networks vItlhutlh gateway vItlhutlh.

**Scanning 'ej Information Gathering**

Initially, a scan is performed to identify if a SAP router is running on a given IP using the **sap_service_discovery** module. This step is crucial for establishing the presence of a SAP router and its open port.
```text
msf> use auxiliary/scanner/sap/sap_service_discovery
msf auxiliary(sap_service_discovery) > set RHOSTS 1.2.3.101
msf auxiliary(sap_service_discovery) > run
```
**sap_router_info_request** module-vaD, SAP router'e configuration vItlhutlhla' 'e' vItlhutlh. vItlhutlh internal network details potentially reveal.
```text
msf auxiliary(sap_router_info_request) > use auxiliary/scanner/sap/sap_router_info_request
msf auxiliary(sap_router_info_request) > set RHOSTS 1.2.3.101
msf auxiliary(sap_router_info_request) > run
```
**Enumerating Internal Services**

**sap_router_portscanner** module-vaD, vItlhutlhlu'pu' 'ej SAProuter DaH jImej vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlhlu'pu' 'e' vItlhutlh
```text
msf auxiliary(sap_router_portscanner) > set INSTANCES 00-50
msf auxiliary(sap_router_portscanner) > set PORTS 32NN
```
**QInmey SAProuter vItlhutlh**

SAP vItlhutlh je vItlhutlh vItlhutlh je vItlhutlh vItlhutlh je vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh vItlhutlh
```text
msf auxiliary(sap_router_portscanner) > set MODE TCP
msf auxiliary(sap_router_portscanner) > set PORTS 80,32NN
```
**Qa'vIn Hosts De'wI'pu'**

SAProuter vItlhutlhlaHbe'chugh, vaj SAProuter vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh, vaj vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaHbe'chugh vItlhutlhlaH
```text
msf auxiliary(sap_hostctrl_getcomputersystem) > set Proxies sapni:1.2.3.101:3299
msf auxiliary(sap_hostctrl_getcomputersystem) > set RHOSTS 192.168.1.18
msf auxiliary(sap_hostctrl_getcomputersystem) > run
```
**QaH**

**QaH**
QaH vItlhutlhchu'pu' SAProuter configurations je 'ej vItlhutlhchu'pu' network penetration testing. SAP routers vItlhutlhchu'pu' 'ej network security architecture vItlhutlhchu'pu' jang vItlhutlhchu'pu' je protection against unauthorized access.

**References**

* [https://www.rapid7.com/blog/post/2014/01/09/piercing-saprouter-with-metasploit/](https://www.rapid7.com/blog/post/2014/01/09/piercing-saprouter-with-metasploit/)

## Shodan

* `port:3299 !HTTP Network packet too big`


<details>

<summary><strong>Learn AWS hacking from zero to hero with</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>

Other ways to support HackTricks:

* If you want to see your **company advertised in HackTricks** or **download HackTricks in PDF** Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
* **Share your hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.

</details>