id: dell-idrac9-default-login

info:
  name: DELL iDRAC9 - Default Login
  author: kophjager007,milo2012
  severity: high
  description: |
    DELL iDRAC9 default login credentials was discovered.
  reference:
    - https://www.dell.com/support/kbdoc/en-us/000177787/how-to-change-the-default-login-password-of-the-idrac-9
  classification:
    cwe-id: cwe-798
  metadata:
    max-request: 1
  tags: dell,idrac,default-login

http:
  - raw:
      - |
        POST /sysmgmt/2015/bmc/session HTTP/1.1
        Host: {{Hostname}}
        User: "{{username}}"
        Password: "{{password}}"

    payloads:
      username:
        - root
      password:
        - calvin
    attack: pitchfork

    matchers-condition: and
    matchers:
      - type: regex
        name: authresult
        regex:
          - '"authResult"\s*:\s*0'

      - type: status
        status:
          - 201
          - 200
# digest: 4b0a00483046022100c8cf50ad2870a1cbf0d8900c7826e6288336928170f974753735cae6c0d911af022100feca13be40403a6e874869bfe7a525f6a4a69ba6a0bf5fa1dad62c5b8a780408:922c64590222798bb761d5b6d8e72950