Create stem-audio-table-private-keys.yaml

Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>

iot/stem-audio-table-private-keys.yaml

@@ -0,0 +1,30 @@
+id: stem-audio-table-private-keys
+
+info:
+  name: Detect Private Key on STEM Audio Table
+  author: gy741
+  severity: high
+  reference: https://blog.grimm-co.com/2021/06/the-walls-have-ears.html
+  tags: stem,config,exposure
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/cgi-bin/privatekey.pem"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "BEGIN RSA PRIVATE KEY"
+        condition: or
+
+      - type: status
+        status:
+          - 200
+
+      - type: dsl
+        dsl:
+          - '!contains(body_2, "<html")'
+          - '!contains(body_2, "<HTML")'
+        condition: and