GoIP GSM VoIP Gateway Default Password

goip-default-login.yaml

id: goip-default-login

info:
  name: GoIP GSM VoIP Gateway Default Password
  author: drfabiocastro
  severity: high
  description: GoIP GSM VoIP Gateway Default Password, Allows attackers to send, receive sms and calls.
  reference:
    - http://en.dbltek.com/
    - https://medium.com/@hackatnow/how-to-create-a-python-script-to-find-goip-gsm-gateway-on-shodan-and-send-sms-ussd-via-goip-e2e203f5d339
    - https://www.voip-systems.ru/assets/files/voip/voip-gsm/User_Manual_1_4_8_16.pdf
  metadata:
    shodan-query: 'HTTP/1.0 401 Please Authenticate\r\nWWW-Authenticate: Basic realm="Please Login"'
    tags: default-login,goip
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
    cvss-score: 8.3
    cwe-id: CWE-522

requests:
  - raw:
      - |
        GET /default/en_US/status.html HTTP/1.1
        Host: {{Hostname}}
        Authorization: Basic {{base64(username + ':' + password)}}

    payloads:
      username:
        - admin
        - root
        - sms
        - user
      password:
        - admin
        - root
        - 1234
    attack: clusterbomb

    matchers-condition: and

    matchers:
      - type: word
        words:
          - "RoIP"
          - "GoIP"
      - type: status
        status:
          - 200