SAP.暴力破解SAP系統DDIC賬戶密碼

Goller.CN SAP Education	贊助商連結
www.goller.cn

參考文檔:
Data from searchsap.com.
Here is how to find lost SAP* and DDIC passwords:
1.) Logon as DB admin (on oracle: ora, for informix: informix)
2.) Run the SQL program of your database (on oracle: sqlplus, for informix: dbaccess)
3.) IMPORTANT: Make a current snapshot of the table. Do an export on table USR02
(Oracle: use the command exp, Informix: use dbexport) ... Alternative: Create a
table copy of USR02 This will be used if anything goes wrong.
4.) Now do a SELECT command on table USR02. The idea is to check if SAP* is present
in the client you want. (Command: SELECT * FROM USR02 WHERE MANDT='XXX' and
BNAME='SAP*' ... MANDT here is the client) ... this is an optional step ...
5.) The next step is to make a copy of the SAP* table record (to be used on step
#9). For Oracle, create a temporary table with USR02 structure and insert the value
SAP* from the client that you want. For Informix, you may just copy the exported
USR02 data and edit it using vi to delete other records other than SAP* .. or use
the same steps as in Oracle.
6.) Delete the record SAP* ON THE REQUIRED CLIENT ONLY on table USR02. (Command:
delete from USR02 where MANDT='XXX' and BNAME='SAP*').
Commit the changes, if needed.
7.) Now logon to SAP. Use the ID SAP* and password PASS (or 06071992). You can now
edit the password for the DDIC user ID. You have to create a user ID or give
authorization to DDIC (if needed) to access transaction SU01.

感謝 Dragon.lan

測試環境：
windows 2003 sp1
SAP R/3 IDES 4.71 <SID:R3D>
ORACLE 9.2.0.1
client 800 (DDIC:123456)
client 100 (DDIC:123456) 拷貝800

通過exp對R3D資料表進行匯出：
C:/>exp

Export: Release 9.2.0.2.1 - Production on Fri Feb 1 21:58:00 2008

Copyright (c) 1982, 2002, Oracle Corporation.  All rights reserved.

Username: sapr3d  'schema預設SAP<SID>
Password:

Connected to: Oracle9i Enterprise Edition Release 9.2.0.2.1 - Production
With the Partitioning, OLAP and Oracle Data Mining options
JServer Release 9.2.0.2.0 - Production
Enter array fetch buffer size: 4096 >

Export file: EXPDAT.DMP > 200802012158_USR02.dmp

(2)U(sers), or (3)T(ables): (2)U > T

Export table data (yes/no): yes > Y

Compress extents (yes/no): yes > Y

Export done in WE8DEC character set and UTF8 NCHAR character set

About to export specified tables via Conventional Path ...
Table(T) or Partition(T:P) to be exported: (RETURN to quit) > USR02

. . exporting table                          USR02       2138 rows exported

查詢DDIC賬戶在CLIENT100的記錄：
C:/>sqlplus /nolog                                          

SQL*Plus: Release 9.2.0.2.0 - Production on Fri Feb 1 22:01:33 2008                                                         

Copyright (c) 1982, 2002, Oracle Corporation.  All rights reserved.       

SQL> conn sapr3d/sap@r3d                                                                                                    
Connected.
SQL> select * from usr02 where bname='DDIC' and mandt=100;  '注意大小寫敏感

MAN BNAME        BCODE            GLTGV    GLTGB    U CLASS             LOCNT
--- ------------ ---------------- -------- -------- - ------------ ----------
     UFLAG ACCNT        ANAME        ERDAT    TRDAT    LTIME  OCOD1
---------- ------------ ------------ -------- -------- ------ ----------------
BCDA1    C OCOD2            BCDA2    C OCOD3            BCDA3    C
-------- - ---------------- -------- - ---------------- -------- -
OCOD4            BCDA4    C OCOD5            BCDA5    C VER C TZONE  Z
---------------- -------- - ---------------- -------- - --- - ------ -
PASSCODE
----------------------------------------
100 DDIC         404CDE71EE977FDE 00000000 00000000 A SUPER                 0
         0              SAP*         19920619 20071108 205051 61D26428640DBAB5
20270712 B 26C6795EEEFB72A9 20021028 B 5FC8939AB19D23CA 20000713 B

MAN BNAME        BCODE            GLTGV    GLTGB    U CLASS             LOCNT
--- ------------ ---------------- -------- -------- - ------------ ----------
     UFLAG ACCNT        ANAME        ERDAT    TRDAT    LTIME  OCOD1
---------- ------------ ------------ -------- -------- ------ ----------------
BCDA1    C OCOD2            BCDA2    C OCOD3            BCDA3    C
-------- - ---------------- -------- - ---------------- -------- -
OCOD4            BCDA4    C OCOD5            BCDA5    C VER C TZONE  Z
---------------- -------- - ---------------- -------- - --- - ------ -
PASSCODE
----------------------------------------
0398BC76DDC790AB 20000713 B 5FC8939AB19D23CA 19991116 B     B
0000000000000000000000000000000000000000

刪除DDIC使用者記錄：
SQL> delete from usr02 where bname='DDIC' and mandt=100;
***************

啟動SAP系統，應用DDIC賬戶成功登陸，此時使用的密碼依舊是123456，也許是因為client100是拷貝client800,切在拷貝之前client800中的DDIC密碼已經被改為123456；

重新查詢DDIC使用者記錄：
SQL> select * from USR02 where bname='DDIC' and mandt=100;        

no rows selected       

停止SAP系統後，查詢DDIC使用者記錄：

SQL> select * from usr02 where bname='DDIC' and mandt=100;  '注意大小寫敏感

MAN BNAME        BCODE            GLTGV    GLTGB    U CLASS             LOCNT
--- ------------ ---------------- -------- -------- - ------------ ----------
     UFLAG ACCNT        ANAME        ERDAT    TRDAT    LTIME  OCOD1
---------- ------------ ------------ -------- -------- ------ ----------------
BCDA1    C OCOD2            BCDA2    C OCOD3            BCDA3    C
-------- - ---------------- -------- - ---------------- -------- -
OCOD4            BCDA4    C OCOD5            BCDA5    C VER C TZONE  Z
---------------- -------- - ---------------- -------- - --- - ------ -
PASSCODE
----------------------------------------
100 DDIC         404CDE71EE977FDE 00000000 00000000 A SUPER                 0
         0              SAP*         19920619 20071108 205051 61D26428640DBAB5
20270712 B 26C6795EEEFB72A9 20021028 B 5FC8939AB19D23CA 20000713 B

MAN BNAME        BCODE            GLTGV    GLTGB    U CLASS             LOCNT
--- ------------ ---------------- -------- -------- - ------------ ----------
     UFLAG ACCNT        ANAME        ERDAT    TRDAT    LTIME  OCOD1
---------- ------------ ------------ -------- -------- ------ ----------------
BCDA1    C OCOD2            BCDA2    C OCOD3            BCDA3    C
-------- - ---------------- -------- - ---------------- -------- -
OCOD4            BCDA4    C OCOD5            BCDA5    C VER C TZONE  Z
---------------- -------- - ---------------- -------- - --- - ------ -
PASSCODE
----------------------------------------
0398BC76DDC790AB 20000713 B 5FC8939AB19D23CA 19991116 B     B
0000000000000000000000000000000000000000

應用exp輸出USR02資料表 ... ...

此後為什麼查不到DDIC這個客戶紀錄了？ 登陸系統也無法使用DDIC了，應用SU01也查不到DDIC使用者的存在... 

 

 

次日向高手請教, 提示: 只能刪除SAP*, 但不要刪除DDIC

相關操作記錄:

SQLPLUS 輸出記錄，刪除SAP*記錄在USR02表；
退出SQLPLUS；
啟動SAP系統；
登陸SQLPLUS 查詢SAP*記錄
C:/>sqlplus /nolog                                                         

SQL*Plus: Release 9.2.0.2.0 - Production on Sun Feb 3 21:09:12 2008        

Copyright (c) 1982, 2002, Oracle Corporation.  All rights reserved.

SQL> conn sapr3d/sap@r3d                                          
Connected.
SQL> select * from USR02 where bname='SAP*' and mandt='100';      

no rows selected       
通過GUI登陸SAP；
SAP* : PASS 登陸系統, 並通過SU01查詢SAP*賬戶,此時無法查到相關資訊,但此時已經可以修改DDIC的密碼;