nuclei-templates/http/exposed-panels/mikrotik/mikrotik-routeros.yaml

65 lines
1.9 KiB
YAML

id: mikrotik-routeros
info:
name: MikroTik Router OS Login Panel - Detect
author: gy741
severity: info
description: MikroTik Router OS login panel was detected.
reference:
- https://systemweakness.com/routeros-user-with-just-ftp-policy-can-write-to-filesystem-cve-2021-27221-e3e45d780dfe
classification:
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
cvss-score: 0
cwe-id: CWE-200
metadata:
vendor: mikrotik
product: routeros
max-request: 1
tags: panel,login
http:
- method: GET
path:
- '{{BaseURL}}'
matchers-condition: and
matchers:
- type: word
words:
- 'If this device is not in your possession, please contact your local network administrator'
- '.mikrotik.com'
condition: and
- type: word
name: router-old
part: body
words:
- '<title>mikrotik routeros > administration</title>'
- '<title>Mikrotik Router'
- '<img src="/webcfg/'
- '<title>MikroTik RouterOS Managing Webpage</title>'
condition: or
- type: word
name: hotspot
part: body
words:
- 'Please log on to use the mikrotik hotspot service'
- 'mikrotik hotspot > login'
condition: and
- type: word
name: mikrotik-httpproxy
part: header
words:
- "Server: mikrotik httpproxy"
extractors:
- type: regex
group: 1
regex:
- "<h1>RouterOS (.+)</h1>"
- '<div class="top">mikrotik routeros (.[0-9.]+) configuration page</div>'
- 'routeros (.[0-9.]+) '
- '<b>MikroTik RouterOS (.[0-9.]+)</b>'
# digest: 4b0a00483046022100b18b8668b8c43ec1768337a9b60be00322c49f51e293870b9b4dfc8ba9978f54022100cdb04ee215c3b3260ac8dc3c15a81cc0fd212a6496f49b4807ac013a87a46f95:922c64590222798bb761d5b6d8e72950