Introduction

This is how I found two Remote Code Execution (RCE) vulnerabilities on a bug bounty program target by combining Shodan reconnaissance with default credential testing on an exposed SAP Commerce admin panel.

Reconnaissance

I started by searching for the target's infrastructure on Shodan using the SSL certificate:

ssl:target.com

This returned several IP addresses associated with the target. One of them caught my attention: 40.117.x.x.x

Discovery — SAP Commerce Admin Panel

Running a directory scan against the IP, I found an interesting endpoint:

/hac/login/

This is the HAC (Hybris Administration Console) — the default admin panel for SAP Commerce (formerly SAP Hybris). This panel should never be exposed to the internet.

The exposed HAC (Hybris Administration Console) login at /hac/login — SAP Commerce's admin panel, sitting on the public internet.
The exposed HAC (Hybris Administration Console) login at /hac/login — SAP Commerce's admin panel, sitting on the public internet.

Default Credentials

I tried the well-known default credentials for SAP Commerce HAC:

Username: admin
Password: nimda

It worked. I was logged into the administration console with full access.

Remote Code Execution

The HAC admin panel includes a Scripting Console that allows executing Groovy scripts directly on the server. This is by design — it's meant for administrators to run maintenance tasks.

The HAC Scripting Console — it runs arbitrary Groovy on the server by design, intended for admin maintenance tasks.
The HAC Scripting Console — it runs arbitrary Groovy on the server by design, intended for admin maintenance tasks.

I used this functionality to execute system commands on the server, achieving Remote Code Execution.

Executing system commands through the console to achieve RCE — here enumerating the server's accounts from /etc/passwd.
Executing system commands through the console to achieve RCE — here enumerating the server's accounts from /etc/passwd.

Impact

With RCE on the server, an attacker could:

  • Read sensitive files — configuration, database credentials, API keys
  • Access internal systems — pivot to other services on the network
  • Modify application data — tamper with the e-commerce platform
  • Deploy backdoors — maintain persistent access

Both RCE findings were on different servers belonging to the same program, doubling the impact.

Key Takeaways

  1. Shodan is incredibly powerful for recon — Search by SSL certificate, organization name, or specific headers to find hidden infrastructure.
  2. Always test default credentials — Especially on admin panels. SAP Commerce's admin:nimda is a classic.
  3. Exposed admin panels are critical findings — Even without default creds, an internet-facing admin panel is a serious misconfiguration.
  4. Check for scripting consoles — Many enterprise platforms (SAP, Jenkins, JMX) have built-in code execution features.

TL;DR

Shodan + Default Creds + SAP Commerce HAC Scripting Console = RCE

Originally published on Medium