SAP ASE Default Logins, Enumeration & Privilege Escalation

Once the Dataserver port is reachable (see Service discovery & enumeration), ASE offers a short, high-yield path from “no credentials” to sa-equivalent SQL access and from there to OS execution.

Every ASE instance ships with a built-in sa login. Historically this account is created with no password at all (“null password”) and, at install time only, holds all three standard roles - sa_role (server administration), sso_role (security administration), oper_role (operator) - combined in one account. SAP’s own documentation gives two reasons not to run sa in production: the initial password is null, and a single shared login provides no accountability. Both are testable in seconds.

With any valid login held, the role model itself becomes the enumeration target: sysloginroles records every role grant, sp_displaylogin shows the current role set per login, and syslogins.sysadmin marks the accounts worth attacking. From a low-privilege login on an unpatched build, several documented escalation paths reach sysadmin or OS-level execution - all indexed in Known CVEs, with the hands-on technique for each below.

Port: 5000 (default standalone ASE listener); connect with isql, sqsh, or sqsh_r.

• Null or default sa password - full server administration, security administration, and operator privilege in a single unauthenticated step. No CVE; a configuration state SAP documents as install-default.
• Shared/unrotated sa-role logins - where sa itself has been locked per SAP’s hardening guidance, a second setup-time login carrying sa_role/sso_role is frequently created and never rotated. Locking sa without auditing the accounts that inherited its roles moves the target rather than removing it.
• Authenticated SQL injection -> sysadmin - CVE-2020-6241 (general object-creation path, CVSS 8.8) and CVE-2020-6253 (ASE Web Services interface, CVSS 7.2). Any valid low-privilege login on an unpatched build is sufficient.
• XP Server extended stored procedures -> OS execution - CVE-2020-6243 (Windows only, CVSS 8.8). XP Server runs extended stored procedures with OS-level privileges and omits required checks for authenticated users, reaching connected/RPC-mapped servers, not only the local instance.
• Backup Server DUMP/LOAD -> code execution - CVE-2020-6248 (SAP-rated CVSS 9.1). Missing validation on DUMP/LOAD for an authenticated user with those rights.
• Credential disclosure from installation logs - CVE-2020-6250 / -6295 / -6317. The sa password and other credentials are written into installer logs that routinely outlive the installation and are rarely cleaned up. Patching stops new writes; it does not delete logs already on disk.
• ASE Cockpit authorization gaps - CVE-2020-6252 (Windows, AV:A, SAP-rated CVSS 9.0). Local-network reach to the Cockpit web port yields credentials and configuration beyond the authenticated user’s intended scope.
• Local root via sybctrl - CVE-2022-31594 (CVSS 3.2). SUID-root binary follows a symlink when writing error-log messages. Only where ASE runs as the DB layer under a NetWeaver ABAP/Java Business Suite install - not standalone Sybase ASE.
• Windows installer PATH hijack - CVE-2022-22528 (CVSS 7.8). The installer prepends a SYBASE entry to the system %PATH%; a standard user plants an earlier-matching binary and gains the installer’s elevated context. Installer-only, and fixed at a later patch level than the 2020 cluster.

Version ranges, fixed patch levels, and SAP Note references for all of the above: Known CVEs.

• Test for a blank/default sa password first - zero-cost, no injection required:

  isql -Usa -P '' -Shost:5000
  sqsh -Usa -P '' -Shost:5000
  

  If sa is locked (SAP’s recommended hardening), pivot to the less-scrutinized setup-time logins that were granted its roles instead.
• Fingerprint the build before investing in any CVE path - most of the ASE CVE surface is one 2020 patch cluster, so this single query decides whether the rest of this page is worth running:

  select @@version;
  exec sp_version
  

• Enumerate roles and login posture once any valid login is held (no sa required):

  exec sp_who
  exec sp_helpuser
  exec sp_displaylogin '<login>'
  select name, sysadmin, password_expiration from syslogins;
  select * from sysloginroles;
  

  sp_displaylogin shows whether a login currently holds sa_role/sso_role/oper_role; sysloginroles gives the full role-grant picture and exposes accounts that inherited sa’s privileges when sa was locked.
• SQL injection -> privilege escalation (CVE-2020-6241 / -6253): requires only an authenticated low-privilege login - an application service account, or one obtained via the password test above. Target the object-creation path for CVE-2020-6241, the Web Services HTTP/SOAP interface for CVE-2020-6253, and escalate toward sysadmin. dbcc import_sproc is a genuine ASE mechanism for importing stored procedures across databases and is worth enumerating as part of a privesc surface review, but its role in either CVE is unverified - do not present it as the established injection point.
• XP Server -> OS command execution (CVE-2020-6243, Windows): from an authenticated low-privilege SQL login, invoke xp_cmdshell-class extended stored procedures against an unpatched XP Server; the missing check lets the injected command act on RPC-mapped remote ASE instances, not just the local one:

  exec xp_cmdshell 'whoami'
  

• Backup Server DUMP/LOAD (CVE-2020-6248): from an authenticated login holding DUMP/LOAD rights, craft a malformed DUMP DATABASE / LOAD DATABASE statement against the missing validation to execute code in the Backup Server process context. Narrow window - ASE 16.0 SP03 PL04 through PL07 only.
• Installation logs -> plaintext credentials (CVE-2020-6250 / -6295 / -6317): with any OS foothold, hunt the installer log directory for the sa password:

  find / -iname '*ase*install*.log' -o -iname '*cockpit*install*.log' 2>/dev/null
  grep -iE 'password|passwd' <install-log-path>
  

  Worth checking even on hardened, fully-patched hosts - the fix stopped the writes, not the leftovers.
• ASE Cockpit (CVE-2020-6252, Windows): from local-network reach to the Cockpit web port, enumerate management/monitoring endpoints for responses leaking credentials or configuration beyond the authenticated user’s scope. SAP frames this generically as “insufficient authorization checks,” so map the actually-exposed endpoints on the target build rather than assuming a named leak point.
• sybctrl symlink -> root (CVE-2022-31594): only where ASE sits under a NetWeaver ABAP/Java stack. Confirm by file mode rather than version:

  ls -la /usr/sap/<SAPSID>/SYS/exe/run/sybctrl   # rwsr-xr-x = SUID set = unpatched
  

  With the SUID bit present, a local privileged user replaces the error-log target with a symlink to a sensitive file, then triggers a sybctrl error to have the SUID-root binary write to the linked path. Absent SUID bit = patched, or never in the affected configuration.
• Windows installer PATH hijack (CVE-2022-22528): during or shortly after an ASE 16.0 Windows install on an unpatched build, plant a malicious binary matching a name ASE utilities invoke, earlier in %PATH% than the legitimate one, to execute in the installer’s elevated context.

• Set a strong, unique sa password immediately after install; then lock the sa login and grant sa_role/sso_role/oper_role individually to named, accountable logins - SAP’s own recommended practice. Audit those inheriting logins as part of the same change; locking sa alone relocates the risk.
• Configure login profile objects enforcing max failed_logins and min passwd length server-wide rather than per-login ad hoc.
• Patch to ASE 16.0 SP02 PL09 HF2 / SP03 PL08 HF2 (15.7: SP141 HF2) - clears the whole 2020 cluster including the installation-log CVEs. Windows: additionally 16.0 SP03 PL11 / SP04 PL01 HF1 for CVE-2022-22528. Details in Known CVEs.
• Disable ASE Web Services entirely if not in active use - removes the CVE-2020-6253 surface rather than patching it.
• Restrict DUMP/LOAD grants and Backup Server network reachability to the backup service account and named DBAs only.
• Delete or rotate credential-bearing install logs after setup; restrict the install-log directory to administrators.
• Restrict Cockpit web-port reachability to a dedicated management network or VPN, matching the treatment given other SAP admin consoles.
• Remove the SUID bit from sybctrl (chmod 0755 /usr/sap/<SAPSID>/SYS/exe/run/sybctrl) and start the database via SAP Host Agent’s StartDatabase command instead.

• Failed-login auditing (sp_configure 'auditing' plus the sybsecurity database) for repeated sa logon attempts.
• sp_displaylogin / syslogins.sysadmin drift monitoring - alert on any login unexpectedly gaining sa_role.
• sysloginroles change auditing - role grants outside a scheduled admin change window.
• XP Server extended-stored-procedure execution auditing for xp_cmdshell-class calls from unexpected logins.
• Backup Server DUMP/LOAD command auditing for malformed or unusually-crafted statements from non-backup-service accounts.
• Application-layer logging on the Web Services listener for malformed or anomalous SOAP/HTTP request bodies.
• OS-level file-access auditing on ASE/Cockpit installer log directories for reads by non-administrative accounts.
• File-integrity monitoring on /usr/sap/<SAPSID>/SYS/exe/run/sybctrl for the SUID bit reappearing after a patch or upgrade.
• Cockpit web-port access logs for requests originating outside the intended management network.

• Known CVEs
• Service discovery & enumeration
• SEC Consult Vulnerability Lab - Local Privilege Escalation in SAP Sybase sybctrl