id: dell-idrac9-default-login

info:
  name: DELL iDRAC9 Default Login
  author: kophjager007,milo2012
  severity: high
  description: DELL iDRAC9 default login information was discovered. The default iDRAC username and password are widely known, and any user with access to the server could change the default password.
  reference:
    - https://www.dell.com/support/kbdoc/en-us/000177787/how-to-change-the-default-login-password-of-the-idrac-9
  classification:
    cwe-id: cwe-798
  metadata:
    max-request: 1
  tags: dell,idrac,default-login

http:
  - raw:
      - |
        POST /sysmgmt/2015/bmc/session HTTP/1.1
        Host: {{Hostname}}
        User: "{{username}}"
        Password: "{{password}}"

    payloads:
      username:
        - root
      password:
        - calvin
    attack: pitchfork

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 201
          - 200
        condition: or

      - type: word
        part: body
        words:
          - '"authResult":0'
# digest: 4a0a00473045022075708871311ecc1e56f7229c666f9e770f4ca9d89aca4d5d21cbedab933ef93702210090257f243ada75b6bb86b4556c103bbbdac1f4f3882f9c2488e9f47a23afbf13:922c64590222798bb761d5b6d8e72950