Default SAP Users and Passwords

SAP systems ship with a set of standard users that are created automatically during installation and, on unhardened systems, still carry their well-known default passwords. Because these accounts are created per client (000, 001, 066, and every customer client), a single system can expose several default-credentialed logon opportunities. Testing them over the DIAG protocol (SAP GUI logon) is a fast, unauthenticated path to an initial foothold - frequently a highly privileged one.

Commonly checked standard users:

Note

Test credentials sequentially, not in parallel, and stop on the first User is locked response for a given user - repeated failed logons trigger login/fails_to_user_lock and cause account lockouts. Non-dialog user types are rejected before the password is even checked, so they are not a reliable positive/negative signal.

Standard SAP users left on default passwords allow an attacker with only network reachability to the Dispatcher port to authenticate - often as a super-user (SAP*, DDIC) - bypassing all access controls and immediately compromising the confidentiality, integrity, and availability of the system and its data. Because default users exist in every client, a single unhardened client (e.g. a forgotten training or sandbox client) can compromise the whole system.

• Enumerate clients first (000/001/066 + customer clients) so EARLYWATCH (client 066) and client-specific accounts are covered.
• DIAG-protocol logon testing of the default user/password table against the Dispatcher (32XX, e.g. 3200 for instance 00)
  • SAPMAP modules/discovery/sap_default_creds.py
  • pysap DIAG login bruteforce
  • Metasploit auxiliary/scanner/sap/sap_soap_rfc_susr_rfc_user_interface and related SAP modules.
• Defender-equivalent check (also useful with any authenticated access): report RSUSR003 lists the default-password status of all standard users.

• Run report RSUSR003 regularly and remediate any standard user still on a default password.
• Lock SAP* (login/no_automatic_user_sapstar = 1, and ensure a locked SAP* record exists in every client), DDIC, and EARLYWATCH; set unique, vaulted passwords for TMSADM, SAPCPIC, and any SMD_*/SOLMAN_* service users.
• Delete SAPCPIC in clients where it is unused.
• Change the TMSADM password per SAP Note 1414256.
• Restrict network reachability to 32XX to trusted segments; enforce login/fails_to_user_lock and monitor the Security Audit Log for standard-user logon failures.

• Security Audit Log (SM20): failed dialog logons for the well-known standard usernames from a single source in rapid succession - a textbook default-credential-spray signature.
• Any successful logon as SAP*, DDIC, or EARLYWATCH outside planned administrative activity.
• login/fails_to_user_lock triggering for any standard user ID.

• SAP Note 1414256 - TMSADM password change
• SAP Security Baseline Template (SAP Note 2253549)
• pysap (OWASP CBAS)
• pysap list of default credentials