AS Java Credential-Material Taxonomy

AS Java (SAP NetWeaver Java / the J2EE Engine) keeps its secrets in two main stores an attacker targets after a foothold: the Secure Store (SecStore.properties / SecStore.key), which holds the administrative and system-connection credentials the engine needs at startup, and the UME (User Management Engine) user store holding logon-password hashes. As on AS ABAP, the default file-based protection is obfuscation rather than strong encryption, so the effective control is filesystem access to the store and its key, not the format itself.

This page covers only AS Java credential material. For the ABAP, BTP, and Cloud Connector equivalents see the cross-references at the bottom.

The Secure Store typically contains the master-password / administrator credential and the connection secrets (database, RFC-to-ABAP, LDAP) the Java stack uses - recovering it yields both admin access to the engine and pivot credentials into the systems it connects to. UME hashes, once recovered, are crackable offline or (for the portable SHA-based scheme) forgeable, giving named-user access. A single readable SecStore.key/.properties pair is frequently full compromise of the Java system and its trusted backends.

AS Java credential material, by type - recover the file/store via the foothold, then decrypt with the referenced tool (lead with an existing PoC, do not re-implement crypto):

• Secure Store recovery - with OS read access to the engine’s sec directory (/usr/sap/<SID>/<inst>/sec/ or the configured SecStore path), pull both SecStore.properties (the ciphertext) and SecStore.key (the key material) and run ERPScan SecStoreDec offline. The key file being co-located with, or as loosely protected as, the ciphertext is the common failure. The recovered master password unlocks the rest of the store.
• UME hashes - where the UME uses its own (database) store rather than delegating to an ABAP backend, the password hashes use a portable SHA-N(password+digest) construction that is straightforward to crack with a wordlist; where UME delegates to AS ABAP, the hashes are the ABAP USR02 hashes instead - see the AS ABAP taxonomy.
• General methodology: harvest the store via the OS/file foothold, decrypt offline with the PoC, then follow the recovered DB/RFC/LDAP connection secrets to pivot into the backends the Java stack trusts.

• Restrict OS-level access to the SecStore.properties / SecStore.key pair (and the whole sec directory) to the <sid>adm service account only; never leave them group/world-readable, and do not co-locate backups of the key with the ciphertext.
• Change the Secure Store master password / key from any installation default and after any suspected OS compromise; rotate the connection secrets it protects, not just the key.
• Enforce a strong password policy on UME users so recovered hashes resist offline cracking; prefer delegating UME authentication to a hardened ABAP backend or corporate IdP over the local portable-hash store.
• Harden the upstream footholds (OS command execution, file read) that grant access to these files in the first place.

• OS-level file-access auditing on the sec directory (SecStore.properties / SecStore.key) for reads by any account other than <sid>adm.
• Monitor UME administrative actions (user creation, role assignment) and anomalous logon patterns via the Java security/audit log.

• ERPScan SecStoreDec - AS Java Secure Store decryptor
• AS ABAP Credential-Material Taxonomy
• BTP Credential Material
• Cloud Connector Admin Access & Keystore/SSFS Extraction