Technical Analysis of SAP Exploit Script Used in JLR, Harrods Hacks (detect.fyi)

Interesting, I worked on SAP for a few years and I expect this is just the tip of the iceberg on SAP systems :(

In recent years, we got patches (OSS Notes) almost daily.

This is just a really bad AI summary of the script.

You may as well just pop the script (mirrored here: https://gist.github.com/nneonneo/9caabf7c9d2f94711bce005e144...) into your own AI of choice and tweak the analysis to your liking.

(Note the giveaway "likely via argparse in Python" and similar constructs; the script obviously does use argparse so there's no need for hedging)

Who does even run Netweaver Java AS today? Apparently some do, but that was a bad idea from the start. It is an optional server component letting Java applications run in the SAP server. In my eyes it was always an unnecessary additional source of complexity, they added it to the portfolio back when Java was the hype. Now its been pwned by an unchecked upload.

But i know that HN does not have an appreciation for SAP anyhow.